Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
Akungapaul icon

wp-seo-mcp

by Akungapaul

Sec8

This server provides a Model Context Protocol (MCP) interface to optimize WordPress sites for SEO and performance by leveraging WordPress REST API and WP-CLI.

Setup Requirements

  • ⚠️Requires WordPress application passwords for REST API authentication.
  • ⚠️Extensive environment variable configuration is required for WordPress REST API access and optional WP-CLI functionality (e.g., WORDPRESS_URL, WORDPRESS_USERNAME, WORDPRESS_APP_PASSWORD).
  • ⚠️If WP-CLI is enabled, proper setup of WP-CLI and potentially SSH access (with SSH keys) on the server running this MCP client is necessary.
Verified SafeView Analysis
The server handles sensitive WordPress credentials and SSH details via environment variables, which is a good practice. It utilizes a shared WordPress MCP SDK, implying a layer of abstraction and potentially secure handling of API interactions. There are no direct `eval` or arbitrary command injection points visible in the provided tool handlers. The `WPCLIClient`, if enabled and configured for SSH, represents a powerful execution context, but its use in the provided tools is confined to specific WordPress actions and not arbitrary shell commands, minimizing direct exploitability from the client's perspective. Overall, the security relies heavily on the secure configuration of the environment (e.g., strong application passwords, restricted SSH access) and the robustness of the `@akungapaul/wp-mcp-shared` library.
Updated: 2025-11-28GitHub→
0
0
High Cost
Goudham03 icon

mcp-server

by Goudham03

Sec8

AI-powered release management assistant that fetches and analyzes DevOps metrics from a Release Hound API via an MCP server.

Setup Requirements

  • ⚠️Requires Azure OpenAI API Key (MODEL_TOKEN, MODEL_ENDPOINT) - Paid service.
  • ⚠️Requires an external Release Hound API endpoint (RH_API_ENDPOINT).
  • ⚠️Requires a running MCP server instance (MCP_SERVER) for client communication.
  • ⚠️Missing authentication implementation for `RH_API_ENDPOINT` as per `TODO`.
Verified SafeView Analysis
No hardcoded secrets or 'eval' found. Sensitive API keys and endpoints are correctly loaded from environment variables. A `TODO` comment explicitly mentions 'Implement RH API Authentication Logic' for the Release Hound API (`RH_API_ENDPOINT`), indicating a potentially incomplete security feature for external API calls, which could lead to unauthorized access or functional issues if the external API requires it. The `requests.post` call in `_post` uses `params=json_body` instead of `json=json_body`, which is a functional bug that might expose data in URLs or prevent the payload from being sent correctly, but not a direct security vulnerability within this code itself.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
trangpl193 icon
Sec9

Provides a Model Context Protocol (MCP) interface for performing PostgreSQL database operations, enabling AI models or other systems to interact with a database via an HTTP API.

Setup Requirements

  • ⚠️Requires a running PostgreSQL database instance accessible from the server host.
  • ⚠️Requires specific environment variables (DB_NAME, DB_USER, DB_PASSWORD, MCP_API_KEY) to be set for CLI usage.
  • ⚠️The server exposes an HTTP endpoint, requiring proper network configuration and security measures (e.g., firewalls, access control) in production environments.
Verified SafeView Analysis
The server uses parameterized queries ($1, $2, etc.) for all database operations (SELECT, INSERT, UPDATE, DELETE, transactions, schema introspection), which is a robust defense against SQL injection. Configuration, including database credentials and API keys, is loaded from environment variables or passed programmatically, avoiding hardcoded secrets. API key authentication is implemented to control access to the server's endpoints. No 'eval' or other direct dynamic code execution from user input is apparent in the provided source code.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
ThatOtherAndrew icon

discord-search-mcp

by ThatOtherAndrew

Sec9

Retrieves data from Discord servers via a bot account for information retrieval and OSINT purposes.

Setup Requirements

  • ⚠️Requires creating a Discord bot, granting it necessary permissions, and enabling specific Discord Intents (message_content, members).
  • ⚠️The `DISCORD_TOKEN` environment variable must be set with the bot's token.
  • ⚠️Requires Python 3.10 or newer.
Verified SafeView Analysis
The server requires a Discord bot token (DISCORD_TOKEN) to be set as an environment variable, which users must manage securely. All Discord API interactions are handled through the well-vetted `discord.py` library. No 'eval', 'exec', or direct arbitrary command execution from user input is evident. The server binds to localhost, limiting its direct external network exposure.
Updated: 2025-11-23GitHub→
0
0
Medium Cost
Jocko-Fuel icon

mcp-promo-order

by Jocko-Fuel

Sec9

MCP server for sales team to create 100% discount promo/sample orders and manage customer accounts via chat.

Setup Requirements

  • ⚠️Requires Python 3.10+.
  • ⚠️Requires Shopify Private Apps with specific permissions to be installed on both Promo (read/write) and Wholesale (read-only) stores. This involves a multi-step manual OAuth flow to obtain the necessary API tokens.
  • ⚠️Requires `SHOPIFY_CLIENT_ID` and `SHOPIFY_CLIENT_SECRET` (and optionally `WHOLESALE_CLIENT_ID`, `WHOLESALE_CLIENT_SECRET`) to be set as environment variables to obtain the Shopify access tokens during initial setup.
Verified SafeView Analysis
Secrets (API tokens) are correctly loaded from environment variables, preventing hardcoding. OAuth token exchange scripts handle credentials and tokens securely. The local OAuth callback server is temporary and isolated to localhost. No 'eval' or malicious patterns were found.
Updated: 2025-12-14GitHub→
0
0
Low Cost
deb-sahu icon

mcp-skeleton

by deb-sahu

Sec7

A generic template for building Model Context Protocol (MCP) servers to expose custom business logic as tools for AI models and clients.

Setup Requirements

  • ⚠️Requires Poetry for dependency management and execution.
  • ⚠️Requires Python 3.10+.
  • ⚠️The example tools (calculator, weather, HTTP, text analysis) are for demonstration ONLY and MUST be replaced with domain-specific business logic for production use.
Verified SafeView Analysis
The server infrastructure (Docker, Kubernetes configurations, Pydantic settings) is robust. However, the `http_tools.py` example tool allows making arbitrary HTTP requests to any URL provided by the client. If deployed as-is and exposed to untrusted clients, this tool could be exploited for Server-Side Request Forgery (SSRF) attacks or internal network scanning. Developers are explicitly instructed to replace all example tools with their own, so the risk is contingent on proper implementation and security hardening of custom business logic.
Updated: 2025-11-26GitHub→
0
0
Low Cost
Johnny2x2 icon
Sec5

Manages and updates an ExpressionEngine V7 website using CLI commands, integrated with Devil Box and Docker.

Setup Requirements

  • ⚠️Requires Devil Box setup
  • ⚠️Docker required
Review RequiredView Analysis
Security analysis is severely limited as only the README.md file was provided. Critical security checks (e.g., 'eval' usage, obfuscation, network risks, hardcoded secrets, malicious patterns) could not be performed without access to the actual source code. A score of 5 reflects an unknown state rather than a verified safe or unsafe one.
Updated: 2025-12-10GitHub→
0
0
High Cost
neubirdai icon

hawkeye-mcp-docs

by neubirdai

Sec7

Facilitates AI-powered autonomous incident investigation and root cause analysis through an MCP server.

Setup Requirements

  • ⚠️Requires an active (paid) Hawkeye account.
  • ⚠️Requires Node.js 20+ to run the MCP server.
  • ⚠️Requires configuration with an MCP-compatible client (e.g., Cursor, Claude Code, GitHub Copilot).
Verified SafeView Analysis
The provided source code is for the documentation site (hawkeye-mcp-docs) and a deployment script, NOT the actual hawkeye-mcp-server application. Therefore, a comprehensive security audit of the server's source code cannot be performed. The documentation itself and the deployment script for the documentation site appear safe and do not contain obvious malicious patterns, direct 'eval' usage, or hardcoded secrets (credentials are specified as environment variables by the user). The server relies on user-provided credentials (HAWKEYE_EMAIL, HAWKEYE_PASSWORD) and a base URL, which are handled as environment variables. The system is designed to use 'read-only' access to cloud resources, which is a good security practice. Without the actual server's source code, assumptions about its internal security, dependency vulnerabilities, or specific runtime risks cannot be made.
Updated: 2025-12-10GitHub→
0
0
Medium Cost
BlackWarTurtle icon

pk-mcp-testing

by BlackWarTurtle

Sec9

Manages a parking facility with 300 spots across 3 floors, offering vehicle tracking, reservation, and real-time statistics via an MCP server.

Setup Requirements

  • ⚠️Requires Node.js v18 or higher to be installed locally.
  • ⚠️Requires a running PostgreSQL v14 or higher instance.
  • ⚠️Requires manual configuration of the `DATABASE_URL` environment variable in the `.env` file.
Verified SafeView Analysis
The source code appears to follow good security practices for a Node.js application interacting with a database. It uses Prisma ORM, which inherently protects against SQL injection. Environment variables are correctly used for sensitive data like `DATABASE_URL`, preventing hardcoding. Custom error handling (`formatErrorForMCP`) prevents sensitive internal server details from being exposed to the client. No dangerous functions like `eval` or direct `child_process` calls without clear justification were found. The use of StdioServerTransport reduces the direct network attack surface for the MCP communication itself.
Updated: 2025-11-20GitHub→
0
0
High Cost
mejakitadev icon
Sec8

A multi-component platform providing AI-powered omnichannel customer service, intelligent chat agents with knowledge base integration and tool use, OCR for document processing (KTP, STNK, BPKB, KK), analytics, and specialized data management for business operations (orders, support tickets, job vacancies) and agricultural intelligence (plantation data analysis and recommendations).

Setup Requirements

  • ⚠️Requires Google Cloud Platform (GCP) project with enabled APIs (e.g., Vision AI, Vertex AI) and proper authentication setup.
  • ⚠️Requires PostgreSQL database with the pgvector extension enabled for embedding storage.
  • ⚠️Requires running instances of RabbitMQ and Redis for queuing and caching/state management.
  • ⚠️Relies heavily on environment variables for configuration (database connection, Redis, RabbitMQ, GCP settings, encryption keys).
Review RequiredView Analysis
The server generally uses SQLAlchemy ORM for database interactions, which protects against common SQL injection. However, 'api/archive/analytics.py' uses f-strings in SQL query construction for 'date_group', though currently mitigated by using a 'Literal' type. One hardcoded Google Cloud Storage bucket name ('bprks_sarana_temp') is present in 'api/archive/loan_origination.py'. File upload/decryption (`helper/encrypt.py`, `helper/cloud_storage.py`) and GCS interaction flows are implemented, requiring careful management of encryption keys and cloud storage permissions. Binding to '0.0.0.0' for uvicorn should be secured by external firewalling in production environments.
Updated: 2025-12-03GitHub→
0
0
Low Cost
SamMorrowDrums icon

mcp-rust-starter

by SamMorrowDrums

Sec9

A feature-complete starter template for developing Model Context Protocol (MCP) servers in Rust.

Setup Requirements

  • ⚠️Requires Rust 1.75+ and Cargo to build and run.
  • ⚠️Full MCP elicitation features (e.g., user confirmation, feedback forms) are currently placeholder implementations in the tool macros, requiring custom `call_tool` implementation and client support for full interactive functionality.
Verified SafeView Analysis
The project uses standard Rust libraries and practices, including `unsafe_code = "forbid"` in Cargo.toml. The HTTP transport uses CORS `Any` which is broad for a production environment but acceptable for a starter. The 'calculator' tool currently only returns a hint, avoiding direct evaluation of user-provided arithmetic expressions, thus mitigating a potential injection risk. No hardcoded secrets or 'eval' functions are present. Placeholder elicitation tools do not pose a direct security risk in their current form.
Updated: 2026-01-18GitHub→
0
0
Low Cost
Scarmonit icon

my-mcp-server

by Scarmonit

Sec9

This server exposes an AI-centric microservice API using the MCP protocol, providing tools, resources, and prompt templates.

Setup Requirements

  • ⚠️Requires Python 3.10 or higher
Verified SafeView Analysis
The provided source code does not contain 'eval', hardcoded secrets, or obvious malicious patterns. It is a standard FastAPI web server, and its exposure via '0.0.0.0:8000' is typical, with inherent network risks common to any publicly accessible service. The 'mcp' library itself would need separate scrutiny, but based on the provided usage, it appears safe.
Updated: 2025-11-30GitHub→
PreviousPage 653 of 760Next