Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost

gamma-mcp-server

by KSAklfszf921

Sec9

Acts as a Model Context Protocol (MCP) server to enable AI assistants to generate presentations and documents via the Gamma.app API.

Setup Requirements

  • ⚠️Requires a valid GAMMA_API_KEY from Gamma.app, which may be a paid service.
  • ⚠️The server runs on port 3000 by default and might require firewall configuration for external access.
  • ⚠️The stdio mode is intentionally limited; for full functionality, the HTTP mode is required and recommended.
Verified SafeView Analysis
The code is generally secure. It properly loads environment variables for sensitive API keys and doesn't appear to use dangerous functions like 'eval'. The HTTP server is configured to listen on all interfaces (`0.0.0.0`), which is standard for deployment but might require firewalling in production environments. The use of express and standard Node.js practices suggests a low risk of malicious code injection.
Updated: 2025-11-19GitHub→
0
0
Medium Cost
afshan-ahmar icon

Gemini_mcp_server

by afshan-ahmar

Sec1

A server application designed to host or manage instances of Minecraft Pocket Edition (MCP) games, potentially offering a web interface or API for administration.

Setup Requirements

  • ⚠️Source code was not provided, preventing identification of specific setup requirements or friction points.
Review RequiredView Analysis
No source code was provided for analysis. Therefore, a security audit cannot be performed, and the safety of running this server cannot be assessed. The security score of 1 reflects this critical lack of information, making it impossible to guarantee safety.
Updated: 2025-12-03GitHub→
0
0
High Cost
aar0nsky icon
Sec7

Sets up a local AI pair-programming environment with Ollama, Continue.dev, and various Model Context Protocol (MCP) servers to extend AI capabilities for development tasks without cloud dependencies.

Setup Requirements

  • ⚠️Docker Desktop/Engine is required for containerized MCP servers.
  • ⚠️Node.js (with npm) is required for installing many MCP servers globally.
  • ⚠️Ollama must be installed, and a large language model (e.g., Nemotron-9B) must be pulled locally.
  • ⚠️Users must manually configure '~/.continue/config.json' and set specific environment variables for certain MCP servers (e.g., GITHUB_TOKEN, SNYK_TOKEN).
Verified SafeView Analysis
The system involves running multiple local services (Ollama, Docker containers, global npm packages) that grant broad permissions (e.g., Docker containers mount the entire project directory for read/write access via Filesystem and Git MCPs). While intended for functionality (AI agent interacting with the local codebase), this requires strong trust in all installed components and the AI itself. Environment variables for credentials (GitHub, Snyk, Sentry, Oxylabs) are required but not hardcoded in the provided source.
Updated: 2025-11-24GitHub→
0
0
Low Cost
meghnakartha icon

MyFastMCPServer

by meghnakartha

Sec10

A basic HTTP server exposing 'add' and 'get_weather' tools using the FastMCP framework for demonstrating API capabilities.

Setup Requirements

  • ⚠️Requires the 'fastmcp' Python library to be installed.
  • ⚠️Requires Python environment (e.g., Python 3.6+).
Verified SafeView Analysis
The provided source code is simple and contains no explicit security vulnerabilities like 'eval', obfuscation, or hardcoded secrets. It binds to '0.0.0.0', which is standard for a server but requires network-level security (firewall) if exposed to the public internet.
Updated: 2026-01-17GitHub→
0
0
Low Cost
SimonTarara62 icon

capitalcom-mcp-server

by SimonTarara62

Sec9

Provides a Model Context Protocol (MCP) server for the Capital.com Open API, enabling safe, LLM-driven trading operations.

Setup Requirements

  • ⚠️Requires a Capital.com trading account with 2FA enabled and a generated API key (API keys have full trading access; no read-only option available).
  • ⚠️Requires Python 3.10 or higher.
  • ⚠️The generated API key is displayed only once and must be saved immediately.
Verified SafeView Analysis
The project exhibits a strong focus on security, implementing multiple layers of safeguards. Key features include trading disabled by default, epic allowlists, size/position/daily order limits, two-phase execution (preview then explicit confirmation), and a dry-run mode. Sensitive data like API keys and passwords are explicitly handled to prevent logging via a `redact_secrets` utility. There is no visible use of `eval` or similar dangerous functions. The `install.sh` script does not execute arbitrary external code directly. While robust, the inherent risk of live trading with an LLM-driven system means a perfect 10 is reserved for read-only or highly isolated systems, but this is an exceptionally well-secured trading agent.
Updated: 2026-01-17GitHub→
0
0
Medium Cost
pcnfernando icon

mcp-weather-server

by pcnfernando

Sec9

This server is designed to provide weather-related services, likely interacting with an 'mcp' platform or API.

Setup Requirements

  • ⚠️Requires Ballerina SDK (version 2201.12.3 or compatible) to be installed.
  • ⚠️Requires a Java Runtime Environment (JRE) due to Ballerina's underlying architecture.
  • ⚠️The 'ballerina/mcp' package (version 1.0.2) must be locally available in the Ballerina environment.
Verified SafeView Analysis
The provided source code consists solely of Ballerina configuration files (TOML). These files do not contain executable logic, eval statements, obfuscation, or hardcoded secrets within themselves. The actual security posture of the server depends entirely on the implementation details in the unprovided Ballerina (.bal) source files, especially concerning how security-sensitive dependencies like 'http', 'auth', 'crypto', and 'jwt' are utilized. The 'mcp' dependency is specified as 'local', meaning its security and availability rely on its external implementation.
Updated: 2025-11-27GitHub→
0
0
Medium Cost
message-extensions icon

mock-mcp-servers

by message-extensions

Sec2

This repository provides mock Model Context Protocol (MCP) servers for evaluating and testing remote MCP functionality, simulating various authentication methods and Responsible AI scenarios for Declarative Agents (DAs).

Setup Requirements

  • ⚠️Requires Python 3.11+.
  • ⚠️Manual code modification in `server-multi-auth.py` is required as a workaround for fetching tools with certain MCP clients (e.g., VS Code MCP Client) due to FastMCP limitations, and then must be reverted.
  • ⚠️The RAI server (`rai-mcp-server/server.py`) requires a specific CSV file (`RAI_Validation_Dataset.csv`) to be present for content validation functionality.
Review RequiredView Analysis
This repository contains servers explicitly designed to simulate security vulnerabilities for testing purposes, making them inherently unsafe for general deployment. Specific risks include: - `auth-mcp-server/server-multi-auth-old.py` explicitly disables JWT signature verification (`options={"verify_signature": False}`), a critical vulnerability for token validation, with a warning 'DO NOT USE IN PRODUCTION'. - `rai-mcp-server/server.py` includes tools that simulate data exfiltration (`report_analytics` printing '🚨 DATA EXFILTRATION DETECTED 🚨' and a malicious webhook URL) and potential Server-Side Request Forgery (SSRF) via arbitrary URL fetching (`import_design`, `fetch`, and a Slack message with a templated URL in `fetch_latest_slack_message`). This server also serves content classified as 'harmful' for Responsible AI testing. - Hardcoded API keys ('mock_mcp_api_key') and demo tokens ('demo-token') are present in `auth-mcp-server/server-multi-auth.py` and `auth-mcp-server/server-dummy-auth.py`, which is poor practice even for mock servers if they could inadvertently be used in other contexts. - The `github-mock-mcp-server/server.py` makes HTTP requests to an external mock GitHub API, introducing external dependencies and potential risks if that external service were compromised.
Updated: 2026-01-13GitHub→
0
0
Low Cost
valksor icon

go-assern

by valksor

Sec8

Aggregates multiple MCP (Model Context Protocol) servers into a single interface, providing project-level configuration for different credentials, environment variables, and tool sets.

Setup Requirements

  • ⚠️Requires specific runtime environments for proxied MCP servers (e.g., Node.js for `npx` commands).
  • ⚠️Requires API tokens/credentials for backend MCP servers (e.g., GITHUB_TOKEN, SLACK_TOKEN).
  • ⚠️Configuration is based on current working directory; misconfigurations can lead to unexpected server or token usage.
Verified SafeView Analysis
The project demonstrates good security practices including checksum and Cosign signature verification for installations, detailed security policy documentation, and pre-commit linting/security checks (`golangci-lint`, `govulncheck`). However, its core functionality involves spawning user-defined commands for backend MCP servers. This inherently means the overall security depends heavily on the trustworthiness and configuration of these backend commands/servers, which is the user's responsibility. Assern itself does not appear to introduce new vulnerabilities but acts as a privileged executor.
Updated: 2026-01-18GitHub→
0
0
Medium Cost
yayoboy icon
Sec9

Integrate Home Assistant smart home monitoring and analytics into Claude Desktop via an MCP server.

Setup Requirements

  • ⚠️Requires Home Assistant running and accessible.
  • ⚠️Requires a Home Assistant Long-Lived Access Token (manual creation and copy).
  • ⚠️Manual installation requires Node.js 18+ and command-line configuration if drag & drop fails.
Verified SafeView Analysis
The Base v1.0 version is explicitly stated as 'Read-Only', significantly reducing security risks related to device control. It requires a dedicated, revocable Home Assistant Long-Lived Access Token, which is a good practice. The server runs locally and claims 'No data sent to external servers'. Environment variables (HA_URL, HA_TOKEN) are used for sensitive configuration, preventing hardcoded secrets. No obvious 'eval' or obfuscation is mentioned or implied.
Updated: 2025-12-13GitHub→
0
0
Medium Cost
RSanzzzzz icon
Sec9

Optimized execution of AI models with complex multi-tool calls, including integration with Model Context Protocol (MCP) servers, by programmatically generating and running JavaScript code in a Vercel Sandbox to reduce LLM inference costs.

Setup Requirements

  • ⚠️Vercel Token Required: The `@vercel/sandbox` dependency necessitates setting a `VERCEL_TOKEN` environment variable or linking with Vercel CLI for local development and deployment.
  • ⚠️Node.js & Next.js Environment: This is a Next.js application, requiring a Node.js environment (v22 as per Sandbox runtime in `lib/sandbox.ts`) and Next.js framework understanding for setup and operation.
  • ⚠️MCP Server Configuration: Integrating external MCP tools (like Firecrawl or CLI) requires explicit configuration in `lib/mcp/mcp-config.ts` and ensures the external MCP servers/commands are accessible.
Verified SafeView Analysis
The project executes LLM-generated JavaScript code within a Vercel Sandbox, a crucial security measure that provides isolated cloud execution, significantly mitigating risks associated with arbitrary code execution. Inter-process communication via `/tmp` files is contained within this sandboxed environment. No direct 'eval' or obvious malicious patterns are present. The primary security risk is shifted to the robustness of the Vercel Sandbox itself and proper configuration of external MCP servers.
Updated: 2026-01-19GitHub→
0
0
Low Cost
hegner123 icon

stump

by hegner123

Sec8

Provides compact, token-efficient directory tree visualization optimized for LLM consumption, acting as an MCP server.

Setup Requirements

  • ⚠️Requires Zig 0.15.2 or later installed.
  • ⚠️Only supports Unix/Linux and macOS (Windows support planned for v2).
Verified SafeView Analysis
The tool directly interacts with the filesystem based on user-provided paths. Safeguards are mentioned, such as UUID generation for output files to prevent overwrites, symlink cycle detection when following symlinks, large directory detection to prevent accidental over-processing, and UTF-8 validation for filenames. No explicit network connectivity is mentioned for the tool itself (it uses stdio transport), which reduces network-related risks. As a systems-level tool written in Zig, vulnerabilities could arise from subtle implementation flaws in filesystem interactions, but the described features indicate a strong focus on defensive programming.
Updated: 2026-01-19GitHub→
0
0
Low Cost
punnyhuimin icon

qconmcp

by punnyhuimin

Sec10

This server provides an MCP-enabled tool to query information about attendees for specific workshops at QCon 2025.

Setup Requirements

  • ⚠️Java Development Kit (JDK) required
  • ⚠️Requires a Model Context Protocol (MCP) compatible client/inspector to interact with the tool endpoints
Verified SafeView Analysis
The provided code snippet is minimal and does not contain any obvious security vulnerabilities like dynamic code execution, hardcoded secrets, or direct network risks. The tool merely returns a static list of strings.
Updated: 2025-11-25GitHub→
PreviousPage 649 of 760Next