Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
2ca3 icon
Sec9

Provides a Model Context Protocol (MCP) server for integrating AI clients like Claude Desktop with Garoon's schedule, user, and meeting management features.

Setup Requirements

  • ⚠️Requires Python 3.10 or higher.
  • ⚠️Requires an active Garoon account with REST API utilization permissions.
  • ⚠️Requires an MCP client like Claude Desktop for full functionality.
  • ⚠️Requires `GAROON_BASE_URL`, `GAROON_USERNAME`, and `GAROON_PASSWORD` to be set as environment variables.
Verified SafeView Analysis
The server uses environment variables (GAROON_BASE_URL, GAROON_USERNAME, GAROON_PASSWORD) for authentication credentials, which is good practice to avoid hardcoding. Authentication is performed via the X-Cybozu-Authorization header using Base64-encoded username:password, which is a standard Garoon API method, though it is Basic Auth (not OAuth). The server utilizes `aiohttp` for secure asynchronous HTTP requests and logs errors to stderr. No direct 'eval' calls or obvious malicious patterns were found. Users are explicitly warned not to commit `.env` files.
Updated: 2025-11-30GitHub→
0
0
Low Cost
ATLANTBH icon

mcp-server-demo

by ATLANTBH

Sec9

Exposes simulated company sales and customer data operations via a local MCP server for AI client interaction, facilitating tool-use demonstrations.

Setup Requirements

  • ⚠️Requires Python 3.10 specifically.
  • ⚠️Manual editing of Claude's `claude_desktop_config.json` is required.
  • ⚠️Users need to manually replace `<system python filepath>` and `<project_root>` placeholders in the Claude configuration.
Verified SafeView Analysis
The server uses `stdio` transport, limiting external network attack surface. File write operations in `post_report` create files in a dedicated `reports` directory; filenames are constructed to mitigate basic path traversal, and content is directly written. No `eval` or direct shell execution of user input is present. Data is simulated, reducing real data exposure risks.
Updated: 2025-11-19GitHub→
0
0
Medium Cost

DevNarrate

by kmandana

Sec7

Automates or assists in generating narrative descriptions or documentation for software development artifacts, likely leveraging Large Language Models.

Setup Requirements

  • ⚠️Requires `uv` for dependency management, which may need to be installed if not already present.
  • ⚠️Likely requires an API key for an external LLM service (e.g., OpenAI, Anthropic) for narrative generation, incurring usage costs.
  • ⚠️Requires Python 3.8+ (estimated based on typical modern Python project and `uv` compatibility).
Verified SafeView Analysis
No code provided for deep analysis; score based on common Python project structure and file types. Potential network risks and data handling practices depend on specific implementation, especially regarding external API interactions.
Updated: 2025-11-18GitHub→
0
0
Low Cost
Zoey-Labs icon

mcpx

by Zoey-Labs

Sec9

Bridges stdio-based Model Context Protocol (MCP) clients to HTTP-based MCP servers, translating between standard input/output and HTTP requests.

Setup Requirements

  • ⚠️Requires a pre-existing HTTP-based MCP server to connect to.
  • ⚠️Requires the `MCP_URL` environment variable to be set, pointing to the target MCP server.
  • ⚠️Requires Node.js 18.0.0 or higher.
Verified SafeView Analysis
The code is minimal and uses standard Node.js features for network communication. Configuration is handled via environment variables, with no hardcoded secrets. The `MCP_INSECURE` flag allows users to disable SSL certificate validation for development, which is an explicit opt-in and not a vulnerability in the bridge itself. The primary security consideration is ensuring the `MCP_URL` points to a trusted MCP server, as the bridge forwards all client requests to it.
Updated: 2025-12-14GitHub→
0
0
Low Cost
PeeyooshLimkar icon
Sec9

The server provides an API for users to track, add, list, and summarize their personal expenses, storing the data in a local SQLite database.

Setup Requirements

  • ⚠️Python 3.12+ required
  • ⚠️Requires write access to the temporary directory for database storage (expenses.db)
Verified SafeView Analysis
The server uses parameterized queries for all database interactions, effectively mitigating SQL injection risks. There are no indications of 'eval', obfuscation, or hardcoded sensitive credentials. The database is stored in a temporary directory, which is a design choice impacting data persistence and local system security rather than a direct code vulnerability. The server binds to 0.0.0.0, making it accessible externally if not behind a firewall.
Updated: 2026-01-17GitHub→
0
0
Low Cost
securesubmit-buildmaster icon

mcp-server

by securesubmit-buildmaster

Sec1

Unable to determine a specific use case due to the absence of source code for analysis. Implies a server component for an unspecified application.

Review RequiredView Analysis
CRITICAL: Source code was not provided for analysis. Therefore, a comprehensive security audit is impossible. Without reviewing the code, it's impossible to check for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns. A score of 1 is assigned as a default due to the inability to verify any security posture.
Updated: 2025-12-12GitHub→
0
0
Medium Cost
xargs-P icon

hcp_mcp_server

by xargs-P

Sec7

Provides a natural language interface to the HashiCorp Cloud Platform (HCP) by implementing the Model Context Protocol (MCP) for LLM interaction, allowing management of cloud resources.

Setup Requirements

  • ⚠️Requires an active HashiCorp Cloud Platform (HCP) account and OAuth2 Client Credentials for authentication.
  • ⚠️Requires Python dependencies to be installed from `requirements.txt` (e.g., `pip install -r requirements.txt`).
  • ⚠️Requires specific configuration within the Gemini CLI's `settings.json` to enable and specify the server's path.
Verified SafeView Analysis
Credentials (HCP_CLIENT_ID, HCP_CLIENT_SECRET) are correctly loaded from environment variables. The server operates as a stdio-based transport, not directly exposing network ports, which reduces its attack surface. API calls are authenticated using bearer tokens. However, a significant security consideration is the potential for sensitive data logging: if 'HCP_API_LOGGING_ENABLED' is set to 'true', detailed API responses (which may contain sensitive data such as secrets or user emails) are written to local log files. Additionally, the 'main.py' logs all incoming MCP requests and outgoing responses, including tool arguments and results, which could also contain sensitive information. Proper securing of log files is critical to prevent data leakage. The `update_service_principal` function is explicitly marked as unimplemented, preventing potential issues with an unbaked feature.
Updated: 2025-12-24GitHub→
0
0
Low Cost
menorhge3556 icon

Crypto_MCP_Server

by menorhge3556

Sec8

Provides real-time and historical cryptocurrency market data via a Model Context Protocol (MCP) server.

Setup Requirements

  • ⚠️The README provides incorrect Linux installation commands (`dpkg -i`, `dnf install`) for a `.zip` file, suggesting it's designed for pre-packaged binaries rather than source-code installation.
  • ⚠️The 'Download Latest Release' link in the README points to a `.zip` file within the `tests` directory, which is an unusual and potentially confusing location for official releases.
  • ⚠️Requires a Python 3 environment and the `ccxt` library to be installed if running from source. No specific Python version is declared, but `asyncio` implies Python 3.7+.
Verified SafeView Analysis
The server uses stdin/stdout for inter-process communication, which is common for MCP servers. It dynamically calls registered Python functions based on incoming JSON requests. Input validation is performed within each tool handler (e.g., `get_ticker`, `get_ohclv`, `stream_ticker`), mitigating common injection risks for parameters. The `ccxt` library is used for external API calls. There are no explicit uses of `eval`, `exec`, or `subprocess` on arbitrary user input within the provided source code, nor any hardcoded API keys. The primary risk would be if the application consuming the server's output or providing its input via stdin is compromised or poorly secured.
Updated: 2026-01-19GitHub→
0
0
Low Cost
Sec9

An AI-powered serverless honeypot built with Cloudflare Workers and Model Context Protocol (MCP) to detect unauthorized AI agent behaviors and access attempts by simulating sensitive internal tools and triggering Canarytokens.

Setup Requirements

  • ⚠️Requires an active Cloudflare account for deployment and operation of Cloudflare Workers.
  • ⚠️Requires integration with an external Canarytokens service for its core detection and alerting functionality.
  • ⚠️Node.js and npm are required for dependency installation and deployment.
Verified SafeView Analysis
The server is a honeypot designed to detect AI-based threats and unauthorized access, not a system prone to direct compromise. It's built on Cloudflare Workers, a serverless platform, and incorporates security features like rate limiting, sensitive username detection, and enhanced error handling. It's explicitly stated to be OWASP AI Security tested. It does not appear to use 'eval' or other risky code patterns from the provided information.
Updated: 2025-11-17GitHub→
0
0
Low Cost
Abhishek3689 icon

Weather_MCP_Server

by Abhishek3689

Sec9

Provides real-time weather data, forecasts, and weather comparison between cities to AI assistants via an MCP server.

Setup Requirements

  • ⚠️Requires a WeatherAPI.com API key (free tier available)
  • ⚠️Requires Python 3.8 or higher
  • ⚠️For Claude Desktop integration, the absolute path to the Python executable might be needed.
Verified SafeView Analysis
The server uses `os.getenv` for the API key, preventing hardcoding. It uses `httpx` for secure HTTP requests and includes basic error handling for API calls. No dangerous functions like `eval` or obfuscation are present. The primary external interaction is with WeatherAPI.com, which is the intended function.
Updated: 2025-11-25GitHub→
0
0
Low Cost
weiqing20 icon
Sec1

This server provides a Multi-Component Protocol (MCP) service built on the fastmcp framework, integrating various development and AI implementation tools.

Review RequiredView Analysis
A comprehensive security audit is impossible due to the extremely truncated source code, which only includes a README.md file. Critical analysis for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns cannot be performed.
Updated: 2025-11-30GitHub→
0
0
Medium Cost
shopanaio icon

carrier-api

by shopanaio

Sec9

Integrates Nova Poshta shipping and logistics data with AI assistants via Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires a Nova Poshta API Key for full functionality (especially waybill operations and some authenticated reference/counterparty methods).
  • ⚠️Requires an MCP-compatible AI client (e.g., Claude, Cursor, OpenAI) to be configured to interact with this server.
  • ⚠️Relies on 'npx' for quick execution, which requires Node.js and npm to be installed on the host system.
Verified SafeView Analysis
The project follows good practices for handling API keys by using environment variables. No 'eval' or explicit obfuscation is found. Usage of 'child_process.exec' is confined to build scripts, not runtime. Standard HTTP transport is used, and input validation is implemented in the MCP server tools. The main risk would be potential vulnerabilities in the underlying Nova Poshta API itself or unintended data exposure through verbose AI responses.
Updated: 2025-11-23GitHub→
PreviousPage 668 of 760Next