Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
tomoharu-hayashi icon

mcp-skills-server

by tomoharu-hayashi

Sec8

The MCP Brain Server acts as a long-term memory and knowledge base for AI agents, allowing them to learn from past experiences, store new knowledge, and retrieve relevant information via semantic search, mimicking human learning processes.

Setup Requirements

  • ⚠️Requires Python 3.13.
  • ⚠️Requires Git installed and configured (the knowledge directory must be a Git repository with an 'origin' remote).
  • ⚠️Interactive UI elements (confirmation dialogs, sounds, VS Code integration for editing) are primarily designed for macOS.
Verified SafeView Analysis
The server primarily operates locally, interacting with the file system and Git. Input validation for knowledge names (kebab-case pattern) helps prevent directory traversal. `pyyaml.safe_load` is used for parsing knowledge files, mitigating YAML-related vulnerabilities. `pickle.load` is used for the embedding cache; while a known risk, it's mitigated here as the cache file is internally generated and its integrity is checked against a hash of the knowledge directory content. macOS-specific dialogs use AppleScript with input escaping (`_escape_applescript`) to prevent injection. Git operations (commit, push) are handled with `gitpython`, including mechanisms to prevent or resolve conflicts (rebase). The server requires a trusted Git repository and user interaction for `create`/`update` tools, making it generally safe for its intended use within a developer's environment.
Updated: 2025-12-11GitHub→
0
0
Medium Cost
asiyakhan990 icon

mcp-server

by asiyakhan990

Sec5

The server implements or proxies the Minecraft Protocol, enabling custom multiplayer game experiences or integrations.

Setup Requirements

  • ⚠️Requires a specific runtime environment (e.g., Node.js, Python, Java) depending on its implementation.
  • ⚠️Requires specific network ports to be open and configured for external access.
Review RequiredView Analysis
Source code was not provided for analysis. A server handling network connections generally carries inherent security risks such as potential for DoS attacks, unauthorized access, or data manipulation if not properly secured. Without the actual code, specific vulnerabilities like 'eval' usage, hardcoded secrets, or malicious patterns cannot be identified. Users should exercise caution and review the complete source before deployment.
Updated: 2025-11-30GitHub→
0
0
Low Cost
vthapar icon

sum-mcp-server

by vthapar

Sec7

Manages multiple Kubernetes clusters by providing generic and specialized operations (like ServiceExports) via a JSON-RPC 2.0 interface over stdio or HTTP.

Setup Requirements

  • ⚠️Requires Go 1.21 or later to build.
  • ⚠️Requires access to one or more Kubernetes clusters with valid kubeconfig files.
  • ⚠️Needs a `config.yaml` file explicitly defining cluster configurations.
Verified SafeView Analysis
The HTTP transport sets `Access-Control-Allow-Origin: *`, which enables broad CORS access. While potentially acceptable for internal or CLI-driven use, exposing this directly to the internet without additional security layers (e.g., API Gateway, more specific CORS policies, authentication/authorization) could be a significant risk, as it manages Kubernetes clusters. The generic resource operations pass user-provided API versions, resources, namespaces, and names directly to the Kubernetes API, meaning the server's effective permissions are those of the configured kubeconfig(s). Compromising this server would grant broad access to the configured Kubernetes clusters.
Updated: 2025-11-26GitHub→
0
0
Low Cost
sumeetbansaloo7 icon

k8s-mcp-server

by sumeetbansaloo7

Sec10

An initial Python project possibly intended for Kubernetes multi-cluster management, currently serving as a minimal placeholder.

Setup Requirements

  • ⚠️Requires Python 3.13 or newer
Verified SafeView Analysis
The provided source code is extremely minimal, consisting only of a print statement and project metadata. There are no identifiable security risks, such as 'eval', network operations, hardcoded secrets, or malicious patterns.
Updated: 2025-11-28GitHub→
0
0
Medium Cost
JAYKIM501 icon

my-mcp-server

by JAYKIM501

Sec8

A boilerplate TypeScript Model Context Protocol (MCP) server providing various tools (calculator, greeting, real-time clock, image generation, code review prompt) and resources (server information) for integration with MCP-compatible clients.

Setup Requirements

  • ⚠️Requires Node.js (version >=18 based on package.json engines and tsconfig.json target ES2022).
  • ⚠️A Hugging Face API Token (via `HF_TOKEN` environment variable or `huggingFaceToken` config) is required for the image generation feature, which may incur external API costs.
  • ⚠️The recommended build process relies on `@smithery/cli` (`npx smithery build`), adding a specific CLI tool dependency to the development workflow.
Verified SafeView Analysis
The server correctly uses environment variables or a configuration object for sensitive API tokens (e.g., Hugging Face API token), avoiding hardcoded secrets. Input validation for tools is implemented using Zod. No usage of dangerous functions like 'eval' or obvious malicious patterns were found. Standard server dependencies are used, implying common web security practices should be followed for deployment.
Updated: 2025-11-27GitHub→
0
0
Low Cost
yang0733 icon
Sec9

Provides AI assistants with semantic search access to Databricks documentation via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires Python 3.12 or higher.
  • ⚠️Initial setup (crawl and embedding generation) takes 15-22 minutes.
  • ⚠️Requires manual configuration in AI IDE settings (e.g., ~/.cursor/mcp.json or ~/Library/Application Support/Claude/claude_desktop_config.json).
Verified SafeView Analysis
The server binds to `0.0.0.0` by default, making it potentially network-accessible if local firewall rules permit. This is common for local development servers but should be secured (e.g., with a reverse proxy and authentication) if exposed publicly. No 'eval' or direct arbitrary command execution found. File persistence is local. The crawler includes URL filtering to restrict scope to Databricks documentation.
Updated: 2026-01-16GitHub→
0
0
High Cost

agent-mcp

by tgrunnagle

Sec9

Provides a flexible, production-ready AI agent server with conversation context management via an MCP (Model Context Protocol) server.

Setup Requirements

  • ⚠️Requires API key for a supported LLM provider (e.g., OpenAI, Anthropic, Google) which incurs costs.
  • ⚠️Requires Docker for containerized deployment or Python 3.13+ and 'uv' for local execution.
  • ⚠️Relies on in-memory conversation context, which means state is lost if the server restarts (future enhancement mentions Redis).
Verified SafeView Analysis
The server binds to localhost by default, enhancing local security. API keys are loaded from environment variables, preventing hardcoding. No 'eval' or other highly dangerous patterns were observed. Standard network security practices should be applied if exposed externally.
Updated: 2025-11-24GitHub→
0
0
Low Cost
scopweb icon

mcp-go-github

by scopweb

Sec9

A Go-based MCP server that connects GitHub to Claude Desktop, enabling direct local Git and GitHub API repository operations from Claude's interface.

Setup Requirements

  • ⚠️Requires Go 1.24.0 or superior to compile and run.
  • ⚠️Requires Git CLI installed locally for '0-token' local Git operations (recommended).
  • ⚠️Requires a GitHub Personal Access Token with 'repo' scope (minimum) for GitHub API operations and dashboard tools.
  • ⚠️Windows users may need PowerShell for batch scripts.
Verified SafeView Analysis
The project demonstrates a strong commitment to security with a dedicated `test/security` suite that includes dependency vulnerability scanning, code security analysis, and module integrity verification. Explicit tests for CWE-22 (Path Traversal) and CWE-78 (Command Injection) are present. The README.md and CHANGELOG.md confirm the implementation of these protections, input validation, and argument injection prevention. Go's built-in memory safety, type safety, and bounds checking are leveraged. Credentials (`GITHUB_TOKEN`) are handled via environment variables. The primary mechanism for local Git operations uses `os/exec.Command`, which is generally safer than direct shell execution. Overall, a high level of security awareness and implementation is evident.
Updated: 2025-12-01GitHub→
0
0
Low Cost
mistermusiker icon

DLVMCP

by mistermusiker

Sec9

The server sets up basic TCP and WebSocket listeners to simulate a Minecraft server, demonstrating network communication handling for game-like applications.

Setup Requirements

  • ⚠️Requires Node.js installed.
  • ⚠️Requires 'ws' npm package to be installed (npm install ws).
  • ⚠️Ports 25565 (TCP) and 8080 (WebSocket) must be open and available.
Verified SafeView Analysis
The current implementation is very basic, primarily setting up network listeners without sophisticated data parsing or state management. This simplicity inherently limits immediate security risks. There are no 'eval' calls, obfuscation, or hardcoded secrets. Future development to implement actual Minecraft protocol handling would introduce new attack surface areas requiring careful validation and sanitization.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
maldalur icon
Sec6

Automate grading of Moodle submissions using AI, track student progress, and generate reports.

Setup Requirements

  • ⚠️Requires Ollama to be installed and running locally or at a specified host for AI model inference.
  • ⚠️Requires significant Moodle Web Service configuration (creating a service, assigning capabilities, and generating a token).
  • ⚠️Requires `MOODLE_URL`, `TOKEN_MOODLE`, `COURSE_LIST`, `OLLAMA_HOST`, and `OLLAMA_MODEL` environment variables to be configured in a `.env` file.
Review RequiredView Analysis
The `moodle_client.py`'s `download_file` and `_process_vpl_file_entry` functions are vulnerable to path traversal. If a malicious filename containing '..' (e.g., `../../etc/passwd`) is received from the Moodle API, it could lead to arbitrary file writes outside the intended 'downloads' directory. Additionally, while environment variables are used for sensitive API tokens, the `MOODLE_SERVICE_SETUP.md` document explicitly shows a token value, which is a common security risk if copied directly into production code. AI model output is parsed from JSON, which is generally safe, but if displayed on an unsanitized web interface, could lead to XSS (not directly applicable to this project's current output methods to Markdown files).
Updated: 2025-11-27GitHub→
0
0
Medium Cost
immy2good icon
Sec3

Provides MQL4/MQL5 development tools, including compilation, syntax validation, code analysis, AI/ML data collection, and deep documentation integration, for professional MetaTrader development workflows.

Setup Requirements

  • ⚠️Requires MetaTrader 4 or 5 to be installed on the host system (or Wine configured for Linux/macOS).
  • ⚠️Requires Node.js >=16.0.0.
  • ⚠️The conflicting documentation regarding 'interface provider only' vs. 'direct tool execution' is a critical gotcha for deployment and security expectations.
Review RequiredView Analysis
The core server (`mql4-tools-server.js`) directly executes external processes (e.g., `metaeditor.exe`, Python scripts) and performs extensive file system operations (read/write). This contradicts explicit documentation and configuration claiming the server acts as an 'interface provider only' with 'no process execution'. User-provided `filePath` parameters in various tools (`compile_mql4`, `validate_syntax`, `analyze_code`, `auto_fix_syntax_errors`, etc.) could potentially be exploited for arbitrary file access (read/write) or, in the case of `compile_mql4`, arbitrary code execution via `metaeditor.exe` if not properly sandboxed. This discrepancy between code and documentation makes it unsafe for deployments expecting an interface-only security model.
Updated: 2025-11-28GitHub→
0
0
Medium Cost
olgasafonova icon

gleif-mcp-server

by olgasafonova

Sec9

Enables AI assistants to verify legal entities, research corporate ownership structures, and perform compliance checks by querying the Global Legal Entity Identifier (LEI) database.

Setup Requirements

  • ⚠️Requires Go 1.25+ to build from source.
  • ⚠️macOS requires manual permission adjustments (`chmod +x`, `xattr -d com.apple.quarantine`) for downloaded binaries to run.
Verified SafeView Analysis
The server primarily acts as a proxy to GLEIF's public API, which requires no authentication. No hardcoded secrets were identified in the provided source code. It employs good practices for external API interaction including client-side rate limiting, retry logic with exponential backoff, and robust error handling. Requests use `http.NewRequestWithContext` and `slog` for structured logging. The build script uses `CGO_ENABLED=0`, enhancing binary security. Overall, the implementation adheres to good security principles for its intended function.
Updated: 2026-01-18GitHub→
PreviousPage 636 of 760Next