Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost

mcp-tool-tingz

by tinymindkin

Sec8

A Python toolkit for building Model Context Protocol (MCP) servers, exposing user-defined tools via JSON-RPC over WebSocket or stdio.

Verified SafeView Analysis
The framework itself appears robust, using standard practices (FastAPI for WebSocket, JSON-RPC 2.0). No direct indications of 'eval' or malicious intent. The primary security consideration will be the quality and safety of the custom tools implemented by the user, as the framework serves to expose them.
Updated: 2025-11-17GitHub→
0
0
Low Cost
pandaboy6621 icon

mcpi-server-status

by pandaboy6621

Sec8

Monitors the status of Minecraft Pocket Edition (MCPI) servers and displays them on a basic webpage with a 24-hour heartbeat history.

Setup Requirements

  • ⚠️Requires Python 3 and Flask library to be installed (`pip install Flask`).
  • ⚠️For the custom font to display, the `static/fonts/mojangles.ttf` file must be present relative to `app.py`.
  • ⚠️The application creates and uses a local SQLite database (`status.db`), requiring write permissions in the execution directory.
Verified SafeView Analysis
The application uses parameterized queries for SQLite, mitigating SQL injection risks. The HTML template is a static string, reducing server-side XSS vulnerabilities. Input from external MCPI servers (names, versions) is displayed directly without explicit HTML sanitization in the client-side JavaScript, which could theoretically allow client-side XSS if a malicious server provides crafted data, though the impact is generally low for this type of monitoring application. No hardcoded secrets or 'eval' calls found. Network communication uses standard UDP for status checks.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
shane-kercheval icon

reasoning-agent-api

by shane-kercheval

Sec4

An AI Reasoning Agent API with LLM observability, tracing, and performance monitoring capabilities.

Setup Requirements

  • ⚠️Requires Docker and Docker Compose for backend services.
  • ⚠️Requires an OpenAI API Key (or other configured LLM provider keys) for LLM access, which is a paid service.
  • ⚠️Requires Node.js 18+ for the Electron client application, which runs natively.
  • ⚠️GitHub and Brave API keys are needed for full functionality of respective tools.
  • ⚠️Brave Search API requires `BRAVE_API_KEY` for web search.
Review RequiredView Analysis
Critical security concerns include the hardcoded `PHOENIX_SECRET` in `docker-compose.yml`, the permissive `allow_origins=["*"]` for CORS middleware in the API services, and `PHOENIX_ENABLE_AUTH=false` disabling authentication for the Phoenix observability UI by default. The use of `asyncio.create_subprocess_shell` for Git/GitHub tools in `tools_api/services/tools/github_dev_tools.py` presents a command injection risk if input is not rigorously sanitized. Development configurations (e.g., `REQUIRE_AUTH=false` in `docker-compose.dev.yml`) also pose a risk if unintentionally used in production.
Updated: 2025-12-08GitHub→
0
0
Medium Cost
t-neumann icon

GenomicOps-MCP

by t-neumann

Sec7

A Python server providing genomic feature operations from UCSC genome browser tracks via Model Context Protocol (MCP) for AI clients and a FastAPI REST API for local testing.

Setup Requirements

  • ⚠️Requires Python >= 3.11
  • ⚠️Relies on external UCSC APIs and the `liftOver` binary, requiring internet access and successful binary download/execution (platform-specific).
  • ⚠️The `uv` package is recommended for dependency management.
Verified SafeView Analysis
The server downloads and executes the `liftOver` binary from UCSC's official servers (`hgdownload.soe.ucsc.edu`). While UCSC is generally a trusted source, any downloading and executing of external binaries carries an inherent risk if the source or the binary itself were ever compromised. Input parameters for `subprocess.run` calls are carefully constructed from internally managed paths and parsed user input, mitigating direct command injection risks. No 'eval', obfuscation, or hardcoded secrets were found. All external network calls are to official UCSC endpoints.
Updated: 2026-01-19GitHub→
0
0
High Cost
ThiagoCF05 icon

mcp-tutorial

by ThiagoCF05

Sec4

This server performs fundamental financial analysis of Brazilian stock market companies using AI agents to extract and interpret financial indicators.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid service).
  • ⚠️Requires Docker for easy setup and orchestration of all services.
  • ⚠️Requires Python >=3.13.
  • ⚠️Requires manual generation of RSA public/private keys for JWT authentication.
  • ⚠️Multiple `.env` files must be created and populated manually across different service directories.
  • ⚠️Relies on local SQLite databases (`cvm.db`, `fundamental_analysis.csv`) which need to be present or generated via provided scripts.
Review RequiredView Analysis
The system includes a 'code_interpreter' tool that executes arbitrary Python code using `subprocess.run`. This is a critical security vulnerability if the agent's inputs are not strictly controlled and sanitized, as it can lead to arbitrary code execution on the host system. The `DB_PATH` for CVM data is hardcoded in agent tools, which is a minor configuration vulnerability. JWT authentication is used for inter-service communication, but the overall security depends on proper management of environment variables and key files.
Updated: 2026-01-18GitHub→
0
0
Medium Cost
Countly icon
Sec9

This server enables AI assistants and MCP clients to interact with Countly's analytics data, manage applications, view dashboards, track events, and perform comprehensive analytics operations.

Setup Requirements

  • ⚠️Requires Node.js 18+ runtime environment.
  • ⚠️Requires access to an existing Countly instance (cloud or self-hosted) with a valid authentication token and appropriate permissions.
  • ⚠️Requires a modern MCP client that supports protocol version 2025-03-26 (Streamable HTTP specification).
Verified SafeView Analysis
The project demonstrates strong security awareness with robust authentication mechanisms (HTTP headers, environment variables, token files, tool arguments), clear error handling to prevent information leakage, and a LoopDetector to mitigate potential DoS from recursive tool calls. It also supports fine-grained CRUD control for tools, allowing administrators to restrict AI agent capabilities. While URL parameters are mentioned as less secure for tokens, the documentation explicitly advises against them for sensitive data and provides better alternatives.
Updated: 2026-01-07GitHub→
0
0
Medium Cost
kaustubhdeshmukh11 icon

Mcp_client-server

by kaustubhdeshmukh11

Sec9

A remote server for tracking and managing personal or small-scale expenses, accessible via a custom connector.

Setup Requirements

  • ⚠️Requires Python 3.12+.
  • ⚠️The `pyproject.toml` file is missing `fastmcp` and `aiosqlite` dependencies, which need to be installed manually (e.g., `pip install fastmcp aiosqlite`).
  • ⚠️The SQLite database is stored in a temporary directory (`tempfile.gettempdir()`), meaning all expense data will be lost upon server restart or redeployment unless the hosting environment specifically persists this directory.
Verified SafeView Analysis
The code uses parameterized SQL queries, effectively preventing SQL injection vulnerabilities. No 'eval' or other directly dangerous functions are used. No hardcoded secrets are visible. The use of a temporary directory for the SQLite database means data is ephemeral, which is a functional limitation rather than a security vulnerability of the code itself.
Updated: 2025-12-17GitHub→
0
0
Low Cost
AaryaBhusal icon

aaryabhusal.github.io

by AaryaBhusal

Sec3

Manages CTFd challenges by allowing users to list, view details, control Docker instances, and submit flags through a local web interface.

Setup Requirements

  • ⚠️Requires Python 3.13 or higher.
  • ⚠️Requires CTFd server URL, and either a CTFd user token or session cookie for authentication.
Review RequiredView Analysis
The provided 'SOURCE CODE' is an `index.md` file, which is documentation, not executable application code. Therefore, a comprehensive security audit of the actual server logic (e.g., handling of `CTFD_TOKEN`, `CTFD_SESSION`, input validation, API interaction security) could not be performed. The `index.md` itself does not contain `eval`, obfuscation, hardcoded secrets, or malicious patterns. However, the application described handles sensitive CTFd authentication details. Without access to the Python source code (`app.py` and related modules), it's impossible to assess potential vulnerabilities in how these credentials are stored, transmitted, or used, or if the server is susceptible to common web vulnerabilities.
Updated: 2026-01-19GitHub→
0
0
Low Cost
SumitKachare icon

hacker-news-mcp

by SumitKachare

Sec9

A web server that fetches and displays the top stories from Hacker News.

Setup Requirements

  • ⚠️Requires Go toolchain to build and run.
Verified SafeView Analysis
The server fetches data from the public Hacker News Firebase API. No hardcoded secrets or 'eval'-like patterns were found in the provided code. Standard web server risks apply, but no critical vulnerabilities are evident.
Updated: 2025-12-01GitHub→
0
0
Low Cost
Donmandela icon

gsc-mcp

by Donmandela

Sec1

Analyzes Google Search Console data to monitor website performance, track keywords, and enhance SEO strategy.

Setup Requirements

  • ⚠️Requires a Google account with access to Google Search Console data.
  • ⚠️Distributed as a pre-compiled binary (.zip) without public source code for the application itself, requiring trust in the distributor.
  • ⚠️Operating System: Windows 10 or higher, or macOS 10.13 or higher.
Review RequiredView Analysis
The provided 'SOURCE CODE' for analysis is solely the README.md file. No executable source code (e.g., Python, JavaScript, C#, etc.) for the actual application was provided. The application is distributed as a pre-compiled binary within a ZIP file (.zip). Without access to the application's underlying source code, it's impossible to perform a security audit for patterns like 'eval', obfuscation, network risks, hardcoded secrets, or malicious logic. Therefore, a security score cannot be assigned based on source code analysis, and its safety cannot be guaranteed. Users are advised to exercise extreme caution when installing unknown binaries from the internet.
Updated: 2026-01-19GitHub→
0
0
High Cost

mcp-server

by SingTheCode

Sec3

This agent facilitates CLI-based AI assistance for developers, leveraging a proprietary Shinsegae LLM and Model Context Protocol (MCP) to interact with development environments and perform tasks like file operations and code analysis.

Setup Requirements

  • ⚠️Requires access to a Shinsegae internal LLM API and a valid 'LLM_API_TOKEN' from DevX, which is not publicly available.
  • ⚠️Relies on specific MCP servers (e.g., filesystem, playwright, serena, chrome-devtools) configured in 'mcp-config.json', which may have their own installation and dependency requirements (e.g., 'npx', 'uvx', specific project contexts).
  • ⚠️Requires Python 3.14 or newer, as specified in 'pyproject.toml', which might be a more recent version than many users have installed.
Review RequiredView Analysis
The agent allows direct execution of shell commands via user input prefixed with '!' (src/cli/app.py -> run_shell). This feature, combined with the LLM's potential to generate or misinterpret commands, poses a significant risk for arbitrary code execution on the host system. While the primary ReAct loop focuses on MCP tools, the direct shell command input is a critical vulnerability. The use of 'subprocess.Popen' is temporarily altered to suppress stderr during MCP server connection, which could hide potential issues from a user but is restored.
Updated: 2025-11-27GitHub→
0
0
Medium Cost
thabiso-m-absa icon

opensearch-mcp-server

by thabiso-m-absa

Sec4

This server integrates OpenSearch clusters with AI systems via the Model Context Protocol (MCP), enabling AI to perform search, indexing, aggregation, and management tasks across multiple clusters.

Setup Requirements

  • ⚠️Requires Node.js 18+.
  • ⚠️Requires access to an OpenSearch cluster (local or remote).
  • ⚠️The `aws-sdk` package is a silent dependency if AWS authentication is used, and it's not listed in `package.json`.
  • ⚠️Configuration for multi-cluster support can be complex, involving a JSON string in environment variables or multiple separate environment variable sets.
Verified SafeView Analysis
The source code, specifically `src/mcp.json`, contains hardcoded OpenSearch production-like credentials (URL, username, and password). While this might be intended as an example for VS Code configuration, storing such secrets directly in the repository is a critical security vulnerability if the repository is public or accessed by unauthorized individuals. The application itself relies on environment variables for configuration, which is a better practice, but the presence of this example reduces the overall security posture due to potential misuse. Additionally, `aws-sdk` is `require`d dynamically for AWS authentication but is not listed as a dependency in `package.json`, which could lead to runtime errors in AWS-configured environments.
Updated: 2025-11-25GitHub→
PreviousPage 611 of 760Next