Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
MaNGOSDX icon

NixOS

by MaNGOSDX

Sec4

An unofficial Electron-based desktop client for Nvidia's GeForce NOW game streaming service on Linux, offering native integration and Discord Rich Presence.

Setup Requirements

  • ⚠️Requires Node.js and npm for building from source.
  • ⚠️Primarily designed for Linux operating systems; Flatpak is the recommended installation method, with manual installs not officially supported.
  • ⚠️The `contextIsolation: false` setting in Electron introduces a significant security risk, allowing potential arbitrary code execution via XSS in the loaded web content.
Review RequiredView Analysis
The application sets `contextIsolation: false` in its Electron `webPreferences`. This is a significant security risk as it allows the loaded GeForce NOW web content to access Node.js APIs directly. A Cross-Site Scripting (XSS) vulnerability in the remote web application could be exploited to achieve arbitrary code execution on the user's system. While the client loads the 'official' GFN web page, this configuration inherently trusts the remote content's security, which is generally not recommended for Electron apps. The Discord client ID is hardcoded, but it is a public identifier and not a secret.
Updated: 2025-11-28GitHub→
0
0
Medium Cost

codemenu-mcp

by Extiri

Sec7

A local server designed to facilitate interactions with Claude AI, likely serving as a backend for a desktop application or a specific client.

Setup Requirements

  • ⚠️Requires Node.js and npm to be installed.
  • ⚠️Requires Claude AI access (e.g., an API Key for remote access, or a local Claude Desktop application running for local interaction).
  • ⚠️A `claude_desktop_config.json` file must be created based on the provided `claude_desktop_config.example.json`.
Verified SafeView Analysis
The project acts as a local server, potentially handling AI interactions and user-provided data. Without code analysis, risks such as improper handling of Claude AI API keys, insufficient input validation for client requests, or unintended exposure of local services cannot be fully assessed. No 'eval' or obfuscation is indicated by file names, but this cannot be verified without source code.
Updated: 2025-11-18GitHub→
0
0
Low Cost
beatrizcristina-ux icon

akilomba-

by beatrizcristina-ux

Sec10

This project defines and documents a comprehensive design system (Majoris) through design tokens for spacing, elevation, colors, and typography, to ensure consistency and scalability in UI development.

Setup Requirements

  • ⚠️Requires loading the custom font 'Bradesco Sans' in the consuming project for full typographic fidelity.
  • ⚠️Requires a build process (e.g., using Style Dictionary or similar tools) to generate consumable CSS variables and JavaScript objects from the raw JSON design token files.
  • ⚠️Relies on a Figma Design System ('Majoris') as the source of truth for token definitions, implying potential future synchronization needs.
Verified SafeView Analysis
The provided source code consists solely of declarative design tokens in JSON format and documentation in Markdown. It does not contain any executable code, network operations, or user input processing, thus posing no direct runtime security risks. There are no hardcoded secrets or suspicious patterns.
Updated: 2025-12-15GitHub→
0
0
Low Cost
umesh-khatiwada icon

list-of-mcp-server

by umesh-khatiwada

Sec1

Provides local SQLite database operations for managing people data, enabling AI assistants to interact with it using SQL queries.

Setup Requirements

  • ⚠️Requires Python 3.7+ (usually pre-installed)
  • ⚠️SQLite is required (usually included with Python)
  • ⚠️Severe SQL injection vulnerability due to direct execution of user-provided SQL queries.
Review RequiredView Analysis
The server directly executes SQL queries provided by the 'query' parameter in both 'add_data' and 'read_data' functions. This design is highly vulnerable to SQL injection, as there is no apparent input sanitization or use of parameterized queries. A malicious AI assistant or user could inject arbitrary SQL commands to read, modify, or delete database contents.
Updated: 2026-01-07GitHub→
0
0
Medium Cost
clikader icon
Sec8

Enables AI coding agents to interact with BitBucket Cloud for repository, branch, pull request, code search, and memory management operations.

Setup Requirements

  • ⚠️Requires Python 3.12 or higher.
  • ⚠️Requires a BitBucket App Password with specific permissions (Repositories: Read, Write, Admin; Pull requests: Read, Write).
  • ⚠️Requires `BITBUCKET_USERNAME`, `BITBUCKET_API_TOKEN`, and `BITBUCKET_WORKSPACE` environment variables to be set.
Verified SafeView Analysis
The server uses environment variables for credentials, which is a good practice. It wraps synchronous Atlassian API calls with asyncio.to_thread, and subprocess.run is used for git commands with controlled inputs ('origin' or no direct user input in `get_current_branch`). No obvious 'eval' or malicious patterns were found. The memory system stores JSON data, not executable code. Potential risk from un-sanitized 'query' parameters passed to BitBucket API functions, though BitBucket's API itself should handle sanitization.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
bioanywhere icon

quindio

by bioanywhere

Sec8

This project provides client libraries to interact with the World News API for programmatic access to news data, including semantic search and content extraction.

Setup Requirements

  • ⚠️Requires Python 3.7+
  • ⚠️Relevant API keys are required for World News API access (paid service).
Verified SafeView Analysis
The client libraries are generated using OpenAPI Generator and generally follow standard practices for API interaction. The C++ client includes an OAuth implementation with a local HTTP server listening on port 9999 for callbacks, which includes basic CSRF protection via the `state` parameter. No obvious `eval` or hardcoded secrets found within the provided source. Network communication relies on underlying HTTP libraries (e.g., Qt's QNetworkAccessManager, OkHttp) and SSL/TLS configurations, which are assumed to be handled securely. Users are responsible for secure storage and management of API keys.
Updated: 2025-12-13GitHub→
0
0
Low Cost
Rohit2332000 icon

mcp-math-server

by Rohit2332000

Sec10

This server provides a set of basic mathematical operations (addition, subtraction, multiplication, division, modulus) as tools via the FastMCP framework, intended for integration with AI agents or larger computational platforms.

Setup Requirements

  • ⚠️Python 3.11+ required
  • ⚠️Requires installation of specified Python dependencies (e.g., fastmcp, langchain)
Verified SafeView Analysis
The code is minimal and straightforward, implementing basic arithmetic operations. The `_as_number` utility robustly handles type conversion from integers, floats, or numeric strings without introducing any execution risks (e.g., no `eval`). There are no hardcoded secrets, network vulnerabilities, or other dangerous patterns present in the provided source.
Updated: 2025-11-26GitHub→
0
0
Low Cost
cp-weiland icon

biohackathon2025MCP

by cp-weiland

Sec7

This project demonstrates an AI agent interacting with multiple local Micro-Co-Pilot (MCP) servers, each providing specialized tools for tasks like hashing, weather forecasting, and SPARQL queries against various data sources.

Setup Requirements

  • ⚠️Requires Ollama server running locally with the `qwen3:1.7b` model installed.
  • ⚠️Requires `uv` package manager to be installed and accessible in the PATH for starting sub-servers.
  • ⚠️Requires Python dependencies such as `mcp-use`, `mcp.server.fastmcp`, `SPARQLWrapper`, `loguru`, `httpx`, and `langchain_ollama` to be installed.
Verified SafeView Analysis
The system directly executes LLM-generated SPARQL queries against public endpoints (DBpedia, Research Vocabularies Australia). While `SPARQLWrapper` handles the protocol, an LLM could formulate resource-intensive or unintended queries. The `simpleServerFLOPO.py` mitigates this by hardcoding the query in its description. No `eval`, obfuscation, or hardcoded secrets were identified. Network risks are confined to calls to known public APIs (weather.gov, various SPARQL endpoints).
Updated: 2025-12-03GitHub→
0
0
Medium Cost
consigcody94 icon

notion-weaver

by consigcody94

Sec9

Automate Notion workspace tasks and integrate them into AI workflows using the Model Context Protocol.

Setup Requirements

  • ⚠️Requires Notion API Key (Internal Integration Token) configured as an environment variable.
  • ⚠️The Notion integration must be explicitly shared with any pages or databases it intends to access.
  • ⚠️Node.js version 18.0.0 or higher is required.
Verified SafeView Analysis
The server retrieves the Notion API key from environment variables (NOTION_API_KEY) and explicitly checks for its presence. Input validation for tool arguments relies on JSON schemas defined for each tool, which are processed by the @modelcontextprotocol/sdk. The code uses `args as unknown as Type`, implicitly trusting the SDK's validation. No 'eval', code obfuscation, or hardcoded secrets were found. Comprehensive error handling for API calls is implemented.
Updated: 2025-11-22GitHub→
0
0
Low Cost
zjc19891106 icon

easeim-mcp-server

by zjc19891106

Sec8

Provides documentation query, source code search, intelligent assistance, and integration diagnosis capabilities for EaseIM SDK as a local MCP (Model Context Protocol) server.

Setup Requirements

  • ⚠️Requires Node.js >= 18.
  • ⚠️Requires a build step (`npm run build`) before running if not installed globally via npm.
  • ⚠️The `smart_assist` feature relies on an external LLM (e.g., Claude), which would incur separate API costs and requires client-side configuration for an API key.
Verified SafeView Analysis
The server is designed to run locally as a development assistant. It uses argument validation to prevent arbitrary input from being executed directly. Data sources are local JSON files. While it interacts with the local development environment, no direct shell execution of user-supplied commands or clear hardcoded secrets were found in the provided server-side code that would pose an immediate risk beyond normal development tool operations. Potential risks like SSRF in URL preview (if user-controlled) or code generation from untrusted inputs are mitigated by its local context and schema validation, but inherent to such tooling.
Updated: 2026-01-19GitHub→
0
0
Low Cost
SackeyDavid icon

cursor-eod-mcp

by SackeyDavid

Sec7

An MCP server that automates the generation and posting of end-of-day (EOD) status updates to Slack, including auto-summarization of Cursor workspace conversations.

Setup Requirements

  • ⚠️Requires Node.js 18 or newer.
  • ⚠️Requires a Slack Workspace and a manually created Slack app with specific OAuth scopes (chat:write, channels:read, groups:read) to obtain Slack API tokens (xoxb- or xoxp-).
  • ⚠️Requires manual configuration in your IDE's MCP settings (~/.cursor/mcp.json or ~/.vscode/mcp.json) to specify the server command and Slack tokens (as environment variables or via the 'configure' tool).
Verified SafeView Analysis
Slack tokens are stored locally in an unencrypted JSON file (data/eod-mcp.json) if configured via the 'configure' tool, or expected as environment variables. This relies on file system permissions for security, which is a common practice for local tools but presents a vulnerability if the file system is compromised. No 'eval' or malicious code patterns were found. The use of `child_process.spawn` is limited to test files and does not pose a production risk.
Updated: 2025-12-05GitHub→
0
0
Low Cost
sritajkumarpatel icon

sritaj_info_mcp_server

by sritajkumarpatel

Sec10

This server provides static personal information about 'Sritaj' via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires Python 3.13+
  • ⚠️Recommended use of 'uv' package manager
  • ⚠️Manual VS Code MCP configuration required for integration
Verified SafeView Analysis
The server's source code is simple, returning only static, hardcoded information. There are no dynamic code execution functions (like eval), no hardcoded secrets, and no external dependencies beyond the MCP framework. It poses minimal security risk.
Updated: 2025-12-03GitHub→
PreviousPage 706 of 760Next