Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
anjalbhattarai79 icon
Sec9

This project demonstrates how to create a minimal MCP server using the FastMCP library and expose a simple greeting tool.

Setup Requirements

  • ⚠️Requires Python 3.13+
  • ⚠️Installs `fastmcp` dependency
Verified SafeView Analysis
The server is minimal, exposing only one simple 'greet' tool. The f-string usage is safe in this context, as the input 'name' is merely inserted into the string without further interpretation or execution. No dynamic code execution, obfuscation, or hardcoded secrets were found in the provided source code. The project is a demo and would require further hardening for production use, especially regarding input validation if more complex tools were added.
Updated: 2025-11-25GitHub→
0
0
High Cost
samirsaci icon

mcp-webscraper

by samirsaci

Sec7

Enables Claude Desktop to perform advanced web scraping and crawling operations, extracting structured data and analyzing website architectures through natural language.

Setup Requirements

  • ⚠️Requires Python 3.10 or higher
  • ⚠️Requires `uv` package manager for dependency management
  • ⚠️Requires Playwright browser installation (`uv run playwright install chromium`) for dynamic content scraping
  • ⚠️Windows users require WSL2 with Ubuntu setup
Verified SafeView Analysis
The server can make arbitrary outbound network requests to user-defined URLs, which is inherent to its function. This poses a risk if controlled by a malicious prompt, potentially allowing for reconnaissance or denial-of-service attacks against internal or external targets. The code itself does not contain obvious vulnerabilities like 'eval' or hardcoded secrets. Basic rate-limiting (delay_seconds in crawl) is implemented, but user-controlled. Input URLs are validated with Pydantic's HttpUrl.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
appachhi icon
Sec8

The Bugasura MCP Server enables AI assistants to interact with Bugasura test management projects, managing test cases, issues, sprints, and requirements through natural language.

Setup Requirements

  • ⚠️Requires a Bugasura account and API Key.
  • ⚠️Requires Python 3.10 or higher.
  • ⚠️For remote deployment, an HTTPS-enabled reverse proxy (e.g., Nginx, Apache) is recommended for the SSE endpoint.
Verified SafeView Analysis
The server explicitly loads API keys from environment variables and does not hardcode them. It truncates API keys in logs for security. Input parameters are validated for type and content where appropriate (e.g., numeric IDs, string lengths, enum values). The system performs HTTP requests using Python's `requests` library, which generally protects against injection vulnerabilities. Destructive operations like deletion are clearly documented with warnings. Relying on a remote Bugasura API for core functionality means its security is also paramount. The smart resolution of user/team/project names could be a minor concern if ambiguous inputs lead to unintended selections, though the system attempts to mitigate this with prompts.
Updated: 2026-01-14GitHub→
0
0
Medium Cost
Sec5

This server fetches emails from Gmail, generates concise summaries of their content, and facilitates PDF report generation.

Setup Requirements

  • ⚠️Requires a Google Cloud Project setup with OAuth 2.0 credentials for Gmail API access (e.g., client_secret.json).
  • ⚠️Installation of Python dependencies from requirements.txt.
  • ⚠️Likely requires an API key for a commercial Large Language Model (LLM) service (e.g., OpenAI, Anthropic) for summarization functionality.
Review RequiredView Analysis
The system handles sensitive Gmail API credentials (OAuth 2.0) and processes potentially sensitive email content. Without access to the code, security practices for credential storage, API scope management, input validation, and server exposure cannot be verified. Potential risks include insecure handling of client secrets, overly broad Gmail API scopes, and vulnerabilities in the summarization or PDF generation steps if not properly sanitized. There is no explicit indication of 'eval' or obfuscation from the file list.
Updated: 2025-11-18GitHub→
0
0
Low Cost
Hari2352428 icon
Sec9

This server functions as a simple expense tracker, allowing users to add, list, and summarize their financial expenses.

Setup Requirements

  • ⚠️Requires Python 3.13 or higher.
  • ⚠️The SQLite database is created in a temporary directory, meaning all expense data will be lost when the server process terminates or the temporary directory is cleaned.
Verified SafeView Analysis
Uses parameterized queries for all database operations, effectively preventing SQL injection vulnerabilities. No 'eval' or direct 'os.system' calls are present. The database is stored in a temporary directory, which while potentially leading to data non-persistence, does not pose a direct code execution or critical security risk from the application's perspective.
Updated: 2025-12-05GitHub→
0
0
Low Cost
twoLoop-40 icon

HwpAutomation

by twoLoop-40

Sec8

Acts as an MCP (Multi-Modal Controller Protocol) server to enable Claude Desktop (or other agents) to automate tasks within the Hancom HWP word processor.

Setup Requirements

  • ⚠️Requires Hancom HWP word processor to be installed and accessible.
  • ⚠️Windows OS only (due to HWP COM API and pywinauto dependencies).
  • ⚠️Requires 'pywinauto' library (e.g., `pip install pywinauto`) for certain plugins like Latex2Hwp.
Verified SafeView Analysis
The MCP server uses standard I/O (stdio_server) for communication, which limits direct network exposure. HWP COM automation and pywinauto (via subprocess for Latex2Hwp) are utilized, which are standard for local desktop automation but could pose risks if the underlying HWP application or automation scripts were maliciously altered. No explicit hardcoded secrets or 'eval' calls were found in the provided code.
Updated: 2025-12-18GitHub→
0
0
Low Cost
manishmishra01 icon

mcp_server

by manishmishra01

Sec9

Serves simple functions as an API using the FastMCP framework.

Setup Requirements

  • ⚠️Requires Python >= 3.10.
  • ⚠️The icon path 'D://dsa_with_cpp//icons//images3.jpeg' is hardcoded and will likely cause issues if deployed on a different operating system or environment without that specific file path.
Verified SafeView Analysis
The server binds to 0.0.0.0, making it accessible from all network interfaces, which is standard but requires appropriate network security measures in production. No 'eval', obfuscation, hardcoded secrets, or malicious patterns were found in the provided code.
Updated: 2025-11-22GitHub→
0
0
Low Cost
muhammadjahanzaib789 icon

mcp-server

by muhammadjahanzaib789

Sec5

Provides server functionality, likely related to the Minecraft community or development (MCP).

Review RequiredView Analysis
Source code was not provided for analysis, making a comprehensive security audit impossible. No specific risks like 'eval', hardcoded secrets, or malicious patterns could be identified or ruled out.
Updated: 2025-11-27GitHub→
0
0
Medium Cost
cbxss icon

snusbase-mcp

by cbxss

Sec9

Integrates the Snusbase API for data breach searches, IP WHOIS lookups, and hash lookups into Model Context Protocol (MCP) clients.

Setup Requirements

  • ⚠️Requires a Snusbase API key (Snusbase is a paid service).
  • ⚠️If building from source, Rust 1.70 or later is required.
  • ⚠️Requires an MCP-compatible client (e.g., Claude Desktop) to be usable, as it communicates via stdin/stdout.
Verified SafeView Analysis
The server correctly loads API keys from environment variables or .env files, avoiding hardcoding. It handles rate limiting gracefully. The documentation explicitly warns against committing API keys to version control and cautions users about handling breach data which may contain unmodified HTML or exploits. The installation script downloads pre-built binaries, which implies trust in the maintainer's build process. No 'eval' or similar dangerous patterns are present in the provided Rust source code.
Updated: 2025-12-01GitHub→
0
0
Low Cost
concreteY icon

my-mcp-server

by concreteY

Sec8

Hosts a remote Model Context Protocol (MCP) server that exposes a simple 'add numbers' tool over HTTP and Server-Sent Events (SSE) for AI agents to interact with.

Setup Requirements

  • ⚠️Requires Node.js runtime
Verified SafeView Analysis
The server uses `cors` with `origin: '*'`, allowing requests from any domain, which is permissive but common for public tool endpoints. No direct 'eval' calls, obfuscation, or hardcoded sensitive secrets were found. Message handling is delegated to the `@modelcontextprotocol/sdk`, assuming the SDK itself is robust. The `sessionId` is retrieved from `req.query`, which the SDK is expected to manage securely.
Updated: 2025-12-08GitHub→
0
0
Medium Cost
charanadi4u icon

MCP_SERVER_DEMO

by charanadi4u

Sec9

This server acts as a tool to search for and store academic papers from arXiv, primarily for use in Retrieval-Augmented Generation (RAG) systems.

Setup Requirements

  • ⚠️Requires local file system access for data storage (`papers` directory).
  • ⚠️Relies on the `arxiv` Python library for external paper searches.
Verified SafeView Analysis
The server sanitizes user input for creating directory names, preventing common path traversal vulnerabilities. No `eval` or obvious malicious patterns are present. It interacts with the local filesystem for data storage and makes external API calls to arXiv, which is expected functionality. No hardcoded secrets were found.
Updated: 2025-11-19GitHub→
0
0
Low Cost
Hevagog icon

ap-mcp

by Hevagog

Sec3

Orchestrates LLM-powered tool selection and invocation for natural language interactions with external Python functions.

Setup Requirements

  • ⚠️Requires Ollama to be installed and 'ollama serve' running locally.
  • ⚠️Requires the Ollama model 'qwen2.5:1.5b' to be pulled (or specified via OLLAMA_MODEL).
  • ⚠️Requires Python 3.12 or higher.
Review RequiredView Analysis
The server's `/register` endpoint allows external tools to register themselves, providing a `base_url` for subsequent tool invocations. If a malicious tool registers with a `base_url` pointing to an internal network resource or a sensitive external service, the MCP server could be tricked into performing Server-Side Request Forgery (SSRF) when invoking that tool. The use of `network_mode: "host"` in Docker Compose further increases the risk by giving containers direct access to the host's network interfaces, potentially exposing local services to compromised containers. While no direct `eval()` or hardcoded secrets were found, the ability for external entities to define proxy targets is a critical vulnerability.
Updated: 2026-01-19GitHub→
PreviousPage 692 of 760Next