Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
High Cost
fernandes01032000 icon

MyVpsSuper

by fernandes01032000

Sec8

An AI orchestration platform for managing intelligent agents, their interactions with various microservices (MCP Servers), and monitoring via a web dashboard.

Setup Requirements

  • ⚠️Requires Claude API Key (Paid) for core AI functionality.
  • ⚠️Requires Docker and Docker Compose for core services (PostgreSQL, Redis, Puppeteer).
  • ⚠️Requires Python 3.10+ and Node.js 20+ (for certain MCPs like Puppeteer).
  • ⚠️Requires configuration of multiple external API keys (e.g., MercadoPago, Evolution API, n8n, Supabase) if these integrations are desired.
Verified SafeView Analysis
The project generally follows good practices by using environment variables for sensitive credentials. However, `docker-compose.yml` and Python MCPs provide hardcoded default passwords/tokens (e.g., 'orchestrator_secret_2024', 'puppeteer_token_2024') for local containers. While these can be overridden, relying on such defaults, even for local development, poses a minor risk. The FastAPI backend listens on `0.0.0.0`, meaning it's accessible from all network interfaces, requiring careful firewall configuration if exposed to the internet. `subprocess.run` calls are used for internal scripts or fixed commands, mitigating command injection risks. SQL queries appear to use parameterized statements, which helps prevent SQL injection.
Updated: 2025-11-25GitHub→
0
0
Medium Cost
DawoodTahir icon

MCP-Chatbot

by DawoodTahir

Sec7

An AI-powered recruitment chatbot that conducts structured interviews, analyzes candidate's soft skills and technical fit against job descriptions, and sends interview summaries to hiring managers via WhatsApp.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid) for LLM interactions and transcription.
  • ⚠️Requires WhatsApp Business API credentials (Paid) for sending messages to the hiring manager.
  • ⚠️Requires a running Neo4j database for Graph RAG features (can be deployed locally via Docker/Kubernetes or cloud-hosted).
  • ⚠️Requires AWS S3 bucket for resume storage and SQS queue for processing (can be mocked with LocalStack for development).
  • ⚠️Heavy reliance on Docker and Kubernetes for recommended deployment, requiring familiarity with these tools.
Verified SafeView Analysis
The system implements prompt injection heuristics and leverages OpenAI's moderation API, significantly enhancing defense against malicious user input. Sensitive API keys and credentials (OpenAI, WhatsApp, Neo4j, AWS) are correctly managed via environment variables and Kubernetes secrets, avoiding hardcoding. File uploads are sanitized using `secure_filename`. Web scraping is limited by page count and keyword filtering, reducing external data risks. However, reliance on third-party APIs (OpenAI, WhatsApp, AWS) inherently introduces external dependencies. Data privacy policies, especially regarding the collected PII from resumes and conversation history, should be robustly implemented beyond the UI mention of deletion requests. Ensure proper AWS S3 bucket and Neo4j database access controls are in place. The 'owner' phone number for WhatsApp reports is a configuration point that needs careful management to avoid misdirection.
Updated: 2025-12-17GitHub→
0
0
Low Cost
abg011 icon

WeatherMCP

by abg011

Sec10

A simple Model Context Protocol (MCP) server for fetching live weather alerts and forecasts from the U.S. National Weather Service (NWS) API.

Setup Requirements

  • ⚠️Requires Python 3.10 or higher
Verified SafeView Analysis
The source code appears very safe. It uses the standard 'httpx' library for network requests and does not contain 'eval' or similar dangerous functions. There are no hardcoded secrets or sensitive information. The NWS API used is public and does not require authentication. All network requests have a timeout.
Updated: 2025-12-13GitHub→
0
0
Low Cost
taufiqur0991 icon

mcp-ping-server

by taufiqur0991

Sec9

Provides a simple network utility microservice for checking host reachability via ping.

Setup Requirements

  • ⚠️Requires Python 3.10 or newer.
  • ⚠️Relies on the `mcp[cli]` library for server functionality.
Verified SafeView Analysis
The code correctly uses `subprocess.run` with a list of arguments for the `ping` command, which effectively prevents shell injection vulnerabilities. The `host` parameter is passed directly as a distinct argument to the system's `ping` utility, rather than being interpreted by a shell. No `eval`, `exec`, hardcoded secrets, or other immediately apparent malicious patterns are present. The primary remaining risk, albeit low, would stem from potential vulnerabilities within the system's `ping` utility itself when processing extremely malformed hostnames, which is outside the control of this application's direct code.
Updated: 2025-11-25GitHub→
0
0
Low Cost
Babajan-B icon

BioQC-MCP

by Babajan-B

Sec3

A Model Context Protocol (MCP) server for AI-assisted bioinformatics quality control analysis of sequencing data, including report generation and advanced visualization.

Setup Requirements

  • ⚠️Requires external installation of FastQC (operating system specific: `brew` for macOS, `apt-get` for Linux).
  • ⚠️Requires external installation of MultiQC (Python package installed via `pip`).
  • ⚠️Requires careful manual configuration of full, absolute file paths to the Python interpreter within the virtual environment and the server script in the AI client's (e.g., Claude Desktop, Cursor IDE) `mcp.json` configuration file.
Review RequiredView Analysis
The `run_qc_pipeline` tool directly executes arbitrary Python code using `exec()` within a supposedly sandboxed environment (`safe_globals`). While an attempt is made to restrict the available functions, perfect sandboxing of `exec()` is notoriously difficult to achieve. This makes the server highly susceptible to arbitrary code execution if an AI agent is compromised or given a malicious prompt, leading to potential data breaches, denial-of-service, or system compromise. Subprocess calls to external tools (`fastqc`, `multiqc`) also pose a minor risk if input paths are not fully validated against path traversal attacks, though `Path().expanduser()` provides some protection.
Updated: 2025-12-06GitHub→
0
0
Low Cost

mcp-registry

by trustpilot

Sec10

Provides a centralized allowlist of trusted Model Customization Platform (MCP) servers for Trustpilot Copilot integrations.

Verified SafeView Analysis
This repository primarily hosts a static JSON file (`tp-registry.json`) via GitHub Pages, which serves as an allowlist. There is no executable code, 'eval', or obfuscation described within this component. The security risk pertains to the content of the JSON file (e.g., if a malicious server URL were added), but the mechanism of the registry itself is secure. All changes are subject to review for security impact.
Updated: 2025-11-19GitHub→
0
0
Medium Cost
wernerglinka icon
Sec9

The Metalsmith Plugin MCP Server provides tools for AI assistants to scaffold, validate, and maintain high-quality Metalsmith plugins, enforcing best practices and modern development standards.

Setup Requirements

  • ⚠️Requires Node.js v20.0.0 or higher.
  • ⚠️GitHub CLI (`gh`) must be installed and authenticated for release automation and some validation checks.
  • ⚠️Specific configuration is needed for AI assistant (e.g., Claude Desktop/Code) integration.
Verified SafeView Analysis
The server incorporates robust path sanitization (`sanitizePath`) across all tools to prevent directory traversal vulnerabilities. It uses `spawn` and `execSync` for necessary interactions with `npm`, `git`, `eslint`, and `prettier`, which is appropriate for a development tool, and the commands are largely fixed. The server itself actively *validates* user-provided plugins for security anti-patterns like `eval()`, shell execution without input validation, hardcoded secrets, and environment variable logging, indicating strong security awareness in its design. Release processes leverage `gh auth token` for secure GitHub token handling.
Updated: 2026-01-18GitHub→
0
0
High Cost
artmamedov icon

ios-sim-mcp

by artmamedov

Sec2

Enables AI assistants to visually interact with and automate iOS Simulator apps for testing or task completion.

Setup Requirements

  • ⚠️Requires macOS, Xcode with iOS Simulator.
  • ⚠️Node.js 18+ is a prerequisite.
  • ⚠️Requires manual installation of `idb` via Homebrew and pip3 (`brew install idb-companion` and `pip3 install fb-idb`).
Review RequiredView Analysis
The server uses `child_process.execAsync` to run `idb` commands. String arguments for tools like `boot_simulator`, `launch_app`, `open_url`, `find_elements`, `tap_element` (and potentially others that take user-provided strings) are directly interpolated into shell commands without comprehensive sanitization. This creates a critical command injection vulnerability, allowing arbitrary commands to be executed on the host system if malicious input is provided to these tools. For example, a `udid` containing shell metacharacters could execute unintended commands.
Updated: 2026-01-18GitHub→
0
0
Low Cost
carrmen03-blip icon

carmen-mcp-server

by carrmen03-blip

Sec6

This server provides a central configuration management service, allowing clients to get and set configuration data for a distributed system or application.

Review RequiredView Analysis
The server does not use `eval` or exhibit obfuscation, nor does it contain hardcoded secrets in the provided snippets. However, the primary security risk is the lack of authentication and authorization for the `SET_CONFIG` command. Any client that can connect to the server can modify its configuration, which could lead to service disruption, misconfiguration, or potentially impact dependent systems if the configuration controls critical operations. This design choice makes it vulnerable if exposed to untrusted networks or clients without additional security layers.
Updated: 2026-01-16GitHub→
0
0
Low Cost
dev-houssam icon

mcp-server-ai

by dev-houssam

Sec10

This repository serves as a centralized directory and curated list of various MCP (Multi-Modal Compute Protocol) servers and their respective clients, facilitating discovery and integration for AI applications.

Verified SafeView Analysis
The provided source code consists solely of a README file, which is static text and contains no executable code. Therefore, there are no direct security vulnerabilities within this repository's code itself. Any potential risks would stem from vulnerabilities in the *linked* third-party repositories, which are outside the scope of this analysis.
Updated: 2025-11-29GitHub→
0
0
High Cost
kayoMichael icon

bowman-prospects-mcp

by kayoMichael

Sec8

Classifies Bowman Prospects baseball cards, provides player statistics, and retrieves market pricing data to assess card value.

Setup Requirements

  • ⚠️Requires DEEPSEEK_API_KEY (paid API).
  • ⚠️Requires BRAVE_API_KEY (for search, likely paid API).
  • ⚠️Requires the fine-tuned CLIP model 'clip-card-model-v1' to be available locally (downloadable from HuggingFace).
  • ⚠️Performance benefits from GPU for the CLIP model and EasyOCR (supports Apple GPU/CUDA, falls back to CPU).
Verified SafeView Analysis
The system generally follows good practices for handling secrets (environment variables) and database interactions (parameterized queries). File system operations for image downloads and dataset creation employ filename sanitization. HTML parsing includes some sanitization before passing to the LLM. The primary inherent risk is from processing untrusted inputs (images for OCR, scraped HTML for LLM parsing) and relying on the integrity of the fine-tuned CLIP model and external APIs.
Updated: 2025-12-01GitHub→
0
0
Low Cost
dmarsters icon
Sec9

Enhances image generation prompts with synthetic aperture radar (SAR) and microwave remote sensing aesthetics, providing 'material truth' insights.

Setup Requirements

  • ⚠️Requires Python 3.10 or higher.
  • ⚠️Requires the `fastmcp` library, installed via `pip install -e ".[dev]"`.
  • ⚠️The full workflow implicitly relies on an external LLM (specifically Claude, as mentioned in the philosophy/architecture) to synthesize the generated 'synthesis_guidance' into a final image prompt.
Verified SafeView Analysis
The server primarily loads YAML configuration files and performs deterministic logic based on string matching and dictionary lookups. It uses `yaml.safe_load` to mitigate YAML parsing risks. There are no apparent uses of `eval`, `exec`, or direct shell commands within the server logic itself. No hardcoded secrets or direct external network requests are evident in the provided code, making it relatively safe for its stated purpose.
Updated: 2025-11-29GitHub→
PreviousPage 606 of 760Next