Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
memnexus-ai icon

mx-releases

by memnexus-ai

Sec9

Facilitates AI agents by providing a Model Context Protocol (MCP) server for interacting with the MemNexus memory management API.

Setup Requirements

  • ⚠️Requires Node.js 18.0.0 or higher.
  • ⚠️Requires a running MemNexus Core API backend, typically accessible at 'http://localhost:3000' (default for development).
  • ⚠️Clients connecting to the MCP server (and the MCP server itself when calling the Core API) will need an API key for authentication.
Verified SafeView Analysis
The repository demonstrates strong security practices for its CI/CD and package publishing pipeline, explicitly utilizing npm Trusted Publishing with GitHub Actions OIDC (short-lived tokens, no long-lived PATs, provenance attestations) and GitHub Apps for cross-repository access. The MemNexus API (which this MCP server interacts with) uses Bearer token authentication (ApiKeyAuth) as defined in its OpenAPI specification, a standard method for API security. No 'eval' or obvious malicious code patterns were found in the provided snippets. Runtime security would depend on the generated code, but the foundational practices are robust.
Updated: 2026-01-18GitHub→
0
0
Low Cost
cryptodaddie icon
Sec9

Deploys an unauthenticated Model Context Protocol (MCP) server with basic calculator tools on Cloudflare Workers for AI agent integration.

Setup Requirements

  • ⚠️Requires a Cloudflare account for deployment and associated `wrangler` CLI configuration.
  • ⚠️Requires Node.js and npm/npx installed for local development and dependency management.
  • ⚠️Local clients like Claude Desktop require `mcp-remote` proxy to connect.
Verified SafeView Analysis
The provided code for the calculator tools is simple and uses Zod for input validation, mitigating common injection risks. Runs on Cloudflare Workers, which provides a secure sandboxed environment. The 'authless' nature is stated, implying no authentication layer is applied for tool access in this example, which should be considered if extending with sensitive tools.
Updated: 2025-11-23GitHub→
0
0
Low Cost
nikhil-grayscale icon

nlb-mcp

by nikhil-grayscale

Sec9

Provides an unofficial FastMCP server to access the NLB Singapore Library Catalogue for title search and availability information.

Setup Requirements

  • ⚠️Requires Python 3.11+
  • ⚠️Requires NLB API Key and App Code (obtained from NLB, potentially involving registration/approval)
  • ⚠️Requires installing Python dependencies via pip after creating a virtual environment
Verified SafeView Analysis
The server correctly handles NLB API keys via environment variables, not accepting them from user input. It also redacts these keys from logs. User authentication is offloaded to FastMCP's built-in OAuth2 provider. Basic input validation is present to limit request parameters and prevent broad queries, though the README suggests that stricter pydantic models for inputs/outputs could be added for enhanced validation.
Updated: 2025-12-02GitHub→
0
0
Low Cost
Vonage icon
Sec10

Provides AI assistants with access to Vonage API documentation, code snippets, tutorials, and troubleshooting resources.

Setup Requirements

  • ⚠️Requires an MCP-compatible client (e.g., Claude Desktop, Cline) to be installed and configured.
  • ⚠️Relies on a remotely hosted server (https://documentation-mcp.vonage.dev/mcp); this repository does not contain the server's executable code.
  • ⚠️Requires internet access to connect to the remote MCP server.
Verified SafeView Analysis
The provided source code consists solely of documentation files (README, CONTRIBUTING, CODE_OF_CONDUCT, LICENSE) and an MCP configuration file (`server.json`) that points to a remotely hosted server. There is no executable server logic included in this repository to audit for security vulnerabilities like 'eval', obfuscation, hardcoded secrets, or network risks. The repository content itself is benign.
Updated: 2025-12-15GitHub→
0
0
Medium Cost
pranjal-lnct icon

Sentinel-MCP-Server

by pranjal-lnct

Sec9

Integrates various security scanning tools as an MCP server for IDEs, providing SAST, SCA, secret scanning, DAST, malware, EOL, compliance, crypto, and AI-powered threat modeling.

Setup Requirements

  • ⚠️Requires Docker to be installed and running.
  • ⚠️Requires Python 3.13 or higher.
  • ⚠️AI Threat Modeling requires an external LLM API Key (e.g., OpenAI API Key), which typically involves costs.
Verified SafeView Analysis
The server's core logic (docker_runner.py) correctly isolates security tool execution via Docker, with robust error handling and retries. Input to external tools (target_path, target_url) is user-controlled, implying trust in the client, but the server itself doesn't introduce obvious internal vulnerabilities. Test resources containing 'eval' and hardcoded secrets are correctly identified as *targets* for the scanner, not part of the server's own codebase.
Updated: 2025-11-29GitHub→
0
0
Low Cost
manishdhull1990 icon

test-remote-mcp-server

by manishdhull1990

Sec9

This server provides an API for tracking and managing personal or business expenses by adding, listing, and summarizing entries.

Setup Requirements

  • ⚠️Data stored in a temporary directory (`/tmp` or similar) might be lost on system restarts or cleanup routines, leading to potential data loss.
  • ⚠️Requires Python 3.13 or newer, as specified in `pyproject.toml`.
Verified SafeView Analysis
All database interactions use parameterized queries, effectively mitigating SQL injection risks. The codebase does not contain dangerous functions like `eval` or `exec`, nor does it have hardcoded sensitive credentials. The database is stored in a temporary directory, which is an operational concern for data persistence but not a direct security vulnerability of the code itself. The server binds to `0.0.0.0` by default, which is standard for a server but means it's accessible from all network interfaces; appropriate firewall rules should be considered for production deployments.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
ssdavidai icon

joeAPI

by ssdavidai

Sec9

Provides a Model Context Protocol (MCP) server for the JoeAPI construction management system, exposing construction management tools to AI assistants like Claude.

Setup Requirements

  • ⚠️Requires an existing Microsoft SQL Server database to function.
  • ⚠️Relies on a separate, running instance of the main JoeAPI backend (specified by JOEAPI_BASE_URL) for its core functionality.
  • ⚠️Requires specific configuration in Claude Desktop for local STDIO transport setup.
  • ⚠️Extensive environment variable configuration is necessary for database, JWT, and API base URL settings.
Verified SafeView Analysis
The server features robust multi-tenancy enforcement, ensuring users only access their own data, and utilizes parameterized SQL queries to prevent SQL injection vulnerabilities. JWT authentication is used for API access. Development mode allows authentication bypass via `DEV_USER_ID`, which is a recognized convenience but should not be enabled in production environments.
Updated: 2025-11-22GitHub→
0
0
Low Cost
rim1230 icon
Sec9

A basic tutorial for setting up and running a simple Spring Boot web server exposing a 'Hello World' REST API.

Setup Requirements

  • ⚠️Requires Java Development Kit (JDK) 17 or higher
Verified SafeView Analysis
The provided source code is extremely minimal and consists of a standard Spring Boot 'Hello World' application. No 'eval', obfuscation, hardcoded secrets, or unusual/malicious patterns were identified within the truncated code. Default Spring Boot setup is generally secure for basic operation, but production deployments would require further hardening and dependency auditing.
Updated: 2025-11-28GitHub→
0
0
High Cost
tindevelopers icon

notion-retell-mcp

by tindevelopers

Sec8

Provides a Model Context Protocol (MCP) server to allow AI agents to interact with the Notion API, primarily supporting Retell AI integration.

Setup Requirements

  • ⚠️Requires a Notion internal integration token (NOTION_TOKEN) configured with specific page/database access permissions.
  • ⚠️The server offers 'stdio', 'http', and 'hybrid' transport modes. Hybrid mode (STDIO + HTTP health endpoint) is recommended for Railway/Retell AI, requiring client configurations to use STDIO for tool calls, not HTTP.
  • ⚠️Contradictory information in the README: mentions 'No need to fiddle with JSON or API token anymore' for Notion MCP, but then details extensive token setup.
Verified SafeView Analysis
The server correctly uses environment variables for sensitive Notion API tokens and authentication tokens, which is crucial for security. The README explicitly warns users about configuring Notion integration permissions to mitigate risks when exposing data to LLMs. There are no clear hardcoded secrets. A commented-out `eval` statement in `src/openapi-mcp-server/openapi/parser.ts` is a minor concern, but it is not active in the provided source.
Updated: 2025-11-21GitHub→
0
0
Medium Cost
mako10k icon
Sec9

Enables AI assistants to search the web using Google Custom Search and manage Redmine projects, including issue and project management, comments, and smart updates with workflow-aware error handling.

Setup Requirements

  • ⚠️Requires Google API Key and Custom Search Engine ID to use Google Search features (free tier limited to 100 queries/day).
  • ⚠️Requires Redmine instance URL and API Key for Redmine features, or a multi-repository config file (e.g., `redmine-repositories.json`) with corresponding environment variables.
  • ⚠️Requires manual setup of Google Cloud Console and Google Custom Search Engine for web and image search functionality.
Verified SafeView Analysis
The server demonstrates strong security practices, particularly in secret management. It uses a `SecretsResolver` utility to resolve environment variables, validate API keys (length, placeholders, unresolved references), mask keys in logs, and redact them from error messages. Configuration files use environment variable references (`${VAR_NAME}`) to avoid hardcoding secrets. It supports a prioritized search for config files and a fallback to legacy environment variables. Network requests use `axios` with timeouts. No obvious malicious patterns or `eval` usage found. Comprehensive documentation on security setup is also provided.
Updated: 2025-11-20GitHub→
0
0
Low Cost
alexnichol50n icon

summary-page-prototype

by alexnichol50n

Sec9

This project serves as a frontend prototype or dashboard for managing and assessing insurance claims and related documents.

Setup Requirements

  • ⚠️Requires Node.js and npm installed to run development scripts.
  • ⚠️The application primarily uses mock data; a backend service would be required for dynamic functionality.
Verified SafeView Analysis
The provided source code is for a client-side React application. It does not contain server-side logic, direct database interactions, explicit 'eval' usage, or hardcoded sensitive secrets. Font loading from a well-known CDN is standard practice. The app appears to be a prototype using mock data, minimizing direct security risks from the code itself. Any potential security concerns would arise from its integration with a backend (not provided) or specific deployment practices.
Updated: 2025-11-27GitHub→
0
0
Medium Cost
adhit-r icon

aran-mcp

by adhit-r

Sec5

Provides a comprehensive security and management platform for Model Context Protocol (MCP) deployments, with the specific mcp-server component offering simulated filesystem operations for testing and integration.

Setup Requirements

  • ⚠️Requires Docker for the recommended quick start, or manual setup of Go, Node.js, and PostgreSQL.
  • ⚠️A PostgreSQL database is strictly required.
  • ⚠️Requires careful configuration of authentication providers (Clerk, Authelia, or NeonAuth) and API keys; default settings are insecure.
  • ⚠️The `mcp-server` component is intentionally vulnerable and should not be exposed or used in production.
Review RequiredView Analysis
The project aims for high security with detailed threat modeling (SAFE-MCP) and features like tool attestation and anomaly detection. However, several critical implementation gaps exist: (1) The default API key in `backend/internal/middleware/production.go` is a hardcoded placeholder, requiring manual override for production. (2) MCP API routes in `backend/cmd/server/main.go` are explicitly unprotected by default for testing, posing a significant risk if deployed without enabling the `ENABLE_MCP_AUTH` flag. (3) The cryptographic verification for tool attestation in `backend/internal/mcp/tool_manager.go` is stubbed, weakening the integrity checks. (4) The example `mcp-server` component is intentionally vulnerable to path traversal for demonstration purposes, which should not be used in a real environment without proper hardening.
Updated: 2025-12-13GitHub→
PreviousPage 613 of 760Next