Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
pravinmenghani1 icon

mcp-server-langgraph-demo

by pravinmenghani1

Sec1

This project demonstrates a server-side application integrating the LangGraph library, likely for building and orchestrating AI agent workflows.

Setup Requirements

  • ⚠️Requires an API key for a Language Model Provider (e.g., OpenAI, Anthropic).
Review RequiredView Analysis
No source code was provided for analysis beyond the README title. Therefore, a comprehensive security audit is impossible. Cannot verify the absence of dangerous patterns like 'eval', hardcoded secrets, or malicious network interactions. Running this code without review would be highly risky.
Updated: 2025-12-13GitHub→
0
0
Medium Cost
cardosolucass96 icon

kommo-mcp-server

by cardosolucass96

Sec9

Enables AI agents to interact with Kommo CRM by providing a Model Context Protocol (MCP) server over HTTP.

Setup Requirements

  • ⚠️Requires `MCP_PASSWORD` environment variable to be set; the server will not start without it.
  • ⚠️Requires a valid Kommo CRM subdomain and an API Access Token, both to be provided in the Bearer authentication token.
  • ⚠️The server is a Node.js application, requiring Node.js (v18+) and npm/yarn for installation and execution.
Verified SafeView Analysis
The server implements strong security practices including a mandatory `MCP_PASSWORD` environment variable, robust input validation using Zod schemas for all tool parameters, and structured JSON-RPC error handling. Authentication relies on a multi-part bearer token (MCP_PASSWORD|subdomain|kommoAccessToken), with server-side validation of the `MCP_PASSWORD`. CORS is enabled with a wildcard origin (`*`), which is generally permissive but may be acceptable for AI agent integrations. No 'eval' or malicious patterns were found in the provided source code.
Updated: 2025-12-17GitHub→
0
0
Medium Cost

iwsdk-mcp

by nparashuram

Sec9

A RAG-powered Model Context Protocol server designed to assist developers with Immersive Web SDK development.

Setup Requirements

  • ⚠️Requires Node.js and npm to prepare and run the server.
  • ⚠️Requires a local clone of the 'immersive-web-sdk' repository to prepare the RAG system.
  • ⚠️Client configuration needs the absolute path to the 'iwsdk-mcp' build output (e.g., '/absolute/path/to/iwsdk-mcp/build/index.js').
Verified SafeView Analysis
The server primarily operates on local code and documentation, with setup involving cloning a known SDK repository and fetching official documentation. It logs telemetry locally to a git-ignored file. No 'eval' or obfuscation is mentioned, and runtime operations appear confined to the local environment, making it relatively safe to run in a developer context.
Updated: 2025-11-18GitHub→
0
0
High Cost
floydw1234 icon

badger-graph

by floydw1234

Sec4

Visualizes, searches, and queries code graphs to enhance code understanding and assist LLMs in coding tasks.

Setup Requirements

  • ⚠️Requires Docker for Dgraph setup (`badger init_graph`)
  • ⚠️Requires GPU with CUDA support for embedding generation (`EmbeddingService` checks `torch.cuda.is_available()` and compute capability)
  • ⚠️Relies on local (vLLM/Ollama) or remote OpenAI-compatible LLMs for semantic search and agent responses
  • ⚠️Requires a Dgraph instance (local or remote) to be running and accessible
Review RequiredView Analysis
The compiled JavaScript for the VSCode extension (`vscode_ext/out/extension.js`) contains `eval(func);`, which is an inherent security risk, even if intended for legitimate dynamic loading. The `tool_edit_file` function (`cli/badger/main.py`) allows modifications to arbitrary files, though it is mitigated by a preview and user confirmation step. The system connects to a Dgraph instance (potentially remote) and external LLMs, introducing network-based risks related to data transmission and endpoint security. The `EmbeddingService` loads external models, which could be a supply chain risk if not from trusted sources.
Updated: 2025-11-21GitHub→
0
0
Low Cost
relix23 icon
Sec8

Provides a lightweight Model Context Protocol (MCP) server for integrating with GitHub APIs to fetch, transform, cache, and route GitHub data, acting as a bridge for client applications.

Setup Requirements

  • ⚠️Requires Python 3.10 or newer.
  • ⚠️An active GitHub API token is mandatory for authenticating with GitHub, particularly for accessing private resources or performing write operations.
Verified SafeView Analysis
The server adheres to good practices by loading the GitHub token from environment variables. No direct use of 'eval' or code obfuscation is present. The 'get_file_content' function constructs URLs to raw.githubusercontent.com, which is designed to fetch public raw file content from GitHub and is inherently limited to that domain, reducing arbitrary Server-Side Request Forgery (SSRF) risk to internal networks. The primary security consideration lies in the scope of the `GITHUB_TOKEN` provided; if granted broad permissions (e.g., 'repo' scope), the server acts as a powerful proxy, enabling clients capable of invoking its MCP tools to perform sensitive GitHub actions. Secure deployment requires careful token scope management and robust authentication/authorization for clients interacting with the MCP server.
Updated: 2026-01-19GitHub→
0
0
Low Cost
Ali2220 icon
Sec8

Enables an AI model (specifically Google Gemini) to interact with and utilize custom external tools/functions defined on a local server via the Model Context Protocol.

Setup Requirements

  • ⚠️Requires a Google Gemini API Key configured as GEMINI_API_KEY in a .env file (likely a paid service).
  • ⚠️Requires Node.js runtime (version 20.0.0 or higher as per @google/genai dependency).
Verified SafeView Analysis
The server uses `dotenv` to load API keys from environment variables, avoiding hardcoded secrets. Communication between the client and server is handled via STDIN/STDOUT using `StdioClientTransport` and `StdioServerTransport`, which limits direct external network exposure for the server itself, enhancing security. The system's overall security depends on the nature of the tools registered and the access permissions granted to the Node.js process.
Updated: 2025-11-25GitHub→
0
0
Low Cost

incode-idv-mcp

by IncodeTechnologies

Sec9

Integrates Incode's identity verification into AI assistants like Claude, enabling tools for generating verification links, checking session status, retrieving scores, and managing authentication tokens.

Setup Requirements

  • ⚠️Requires Incode API Key (signup required at mcp-playground.labs.incode.com)
  • ⚠️Requires Claude Desktop App
  • ⚠️Requires Node.js/npm environment for `npx` command
Verified SafeView Analysis
The project integrates with Incode's external identity verification services via an API key, which is standard for such integrations. It uses `npx` to execute an official package from npm. No 'eval' or obvious obfuscation detected. The primary 'risk' is reliance on the security and trustworthiness of the external Incode service and the npm package itself, which is assumed high given it's a security product.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
quercledev icon

quercle-mcp

by quercledev

Sec9

Provides AI-powered web fetching and search capabilities to AI agents via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires a Quercle API key (paid service) from quercle.dev.
  • ⚠️Relies on the external Quercle API for all core functionality.
  • ⚠️Requires Node.js version 18 or higher.
Verified SafeView Analysis
The server primarily acts as a wrapper, forwarding requests to the external Quercle API. It correctly handles the API key via environment variables, avoiding hardcoding. No 'eval' or direct execution of user-provided code on the local server is observed. Potential security considerations are primarily inherited from the underlying Quercle API and its handling of prompts and queries. The immediate server code appears clean and focused.
Updated: 2025-12-15GitHub→
0
0
Low Cost
Areeshsheikh icon

mcp-server-connect

by Areeshsheikh

Sec10

The provided source code serves as a static biographical document detailing the life and legacy of Muhammad Ali Jinnah.

Verified SafeView Analysis
The provided source code is a static Markdown file with no executable content, client-side scripts, network calls, or server logic. It poses no inherent security risks.
Updated: 2025-11-23GitHub→
0
0
Medium Cost
bhishman-desai icon

resume-mcp

by bhishman-desai

Sec9

A Model Context Protocol (MCP) server for managing and versioning resume data stored in a PostgreSQL database, with robust validation and safety features.

Setup Requirements

  • ⚠️Requires a PostgreSQL database connection (e.g., via DATABASE_URL or individual DB_HOST/PORT/NAME/USER/PASSWORD environment variables).
  • ⚠️An API_KEY environment variable must be set for all write and restore operations (update_resume, patch_resume, restore_version).
Verified SafeView Analysis
The server implements robust security measures including API key authentication for write operations, Zod schema validation for all data inputs (including merged patch results), and filename sanitization to prevent path traversal attacks during version restoration. Environment variables are used for sensitive configurations like API keys and database credentials, preventing hardcoding. Emergency backups are created on validation failures and before restores, enhancing data safety. No 'eval' or obfuscation is present. The resume schema uses `.passthrough()` which allows additional custom fields, offering flexibility but requiring careful consideration if strict schema enforcement is critical for preventing arbitrary data storage.
Updated: 2025-12-03GitHub→
0
0
Medium Cost
Cyberpion-Github icon

ionix-mcp-server

by Cyberpion-Github

Sec9

The server provides an MCP interface for Claude Desktop and other clients to query IONIX API for asset information, security findings, assessments, and remediation items.

Setup Requirements

  • ⚠️Requires Claude Desktop or another compatible Model Context Protocol (MCP) client for full integration.
  • ⚠️Requires an active IONIX API Key and Account Name, which implies an existing IONIX account (likely a paid service). API keys have expiry dates that must be managed.
  • ⚠️Requires the 'uv' package manager for installation as per the official usage instructions.
Verified SafeView Analysis
Secrets (API Key, Account Name) are correctly loaded from environment variables, enhancing security. The `httpx` library is used for network requests with `response.raise_for_status()` for error handling. No 'eval' or obvious obfuscation patterns were found. The README provides strong privacy recommendations, advising users to disable data collection by AI tools when using this server.
Updated: 2025-11-20GitHub→
0
0
Medium Cost
mach3builders icon

mach3ui-mcp

by mach3builders

Sec9

Provides structured access to Mach3UI component documentation, code snippets, and design tokens for AI assistants via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires Node.js 18+ runtime
  • ⚠️Requires an AI assistant or tool that supports the Model Context Protocol (MCP) to be functional
Verified SafeView Analysis
The server primarily operates over standard I/O (stdin/stdout) using the MCP SDK, limiting direct network attack surface in its default configuration. It processes pre-defined, in-memory component and theme data, which significantly reduces risks associated with external data sources or dynamic code execution from user input. No direct usage of 'eval' or hardcoded sensitive credentials were found. Input arguments for tools are validated against schemas provided by the MCP SDK. Error handling for tool calls seems robust, reporting specific component/variant not found issues.
Updated: 2026-01-19GitHub→
PreviousPage 635 of 760Next