Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
DharmpratapSingh icon

Team-1B-Fusion

by DharmpratapSingh

Sec9

Analyzing global greenhouse gas emissions from EDGAR v2024 data using natural language queries, providing actionable insights for researchers, policymakers, and developers.

Setup Requirements

  • ⚠️Requires Python 3.11 (not 3.10 or 3.12)
  • ⚠️Requires 'uv' for dependency management (can use pip as fallback)
  • ⚠️Requires OpenAI API Key (Paid service) in 'username:password' format
  • ⚠️Requires EDGAR v2024 data to be pre-processed and DuckDB database populated (run 'process_edgar_complete.py' if starting from raw data)
Verified SafeView Analysis
The server demonstrates strong security practices including comprehensive SQL injection prevention (parameterized queries, column name sanitization, input validation), explicit `OPENAI_API_KEY` validation in `username:password` format, strict CORS configuration (`ALLOWED_ORIGINS`), and rate limiting. `subprocess.run` calls are contained within a controlled LLM tool dispatch mechanism, mitigating arbitrary code execution risks from user input.
Updated: 2026-01-05GitHub→
0
0
Low Cost
afronski icon
Sec8

Provides a simple greeting service for an agentic workflow, demonstrating how to build a custom FastMCP server.

Setup Requirements

  • ⚠️Python 3.12+ required
  • ⚠️`fastmcp` library required (install via pip)
Verified SafeView Analysis
The server code itself (`strands-agents-examples/40-mcp/32-custom-mcp-server.py`) is simple, does not use 'eval' or obscure code, and handles basic user input for a name. It listens on `localhost:8000` by default, which is safe for local development. Deployment beyond localhost would require standard network security practices (e.g., firewall, authentication) if exposed. No hardcoded secrets. The primary risk would be potential vulnerabilities in the `fastmcp` library itself, which is outside the scope of this source code.
Updated: 2025-11-30GitHub→
0
0
Medium Cost
Gyeom icon

openfga-mcp

by Gyeom

Sec7

Integrates OpenFGA authorization management with Claude Code, enabling AI agents to manage stores, models, tuples, and permissions.

Setup Requirements

  • ⚠️Requires `fga` CLI to be installed for `openfga_model_write` tool functionality.
  • ⚠️Requires Node.js version 18.0.0 or higher.
  • ⚠️Environment variables (`OPENFGA_ENVIRONMENTS`, `OPENFGA_LOCAL_URL`, etc.) must be properly configured for OpenFGA API access.
Verified SafeView Analysis
The server uses `child_process.execSync` to invoke the `fga` CLI for model transformations (`openfga_model_write`). While the temporary file path used in the command is properly quoted, the content of the DSL passed to the `fga` CLI originates from user input. This introduces a dependency on the security of the `fga` CLI itself against potential vulnerabilities such as command injection through crafted DSL content. `execSync` is also a blocking call, which can impact performance and availability under high load for this specific operation.
Updated: 2025-12-14GitHub→
0
0
Low Cost
Sec1

Cannot be determined due to missing files and README for analysis.

Review RequiredView Analysis
No files or README provided for security analysis. Cannot identify 'eval', obfuscation, or network risks. The score reflects the inability to perform an audit rather than actual vulnerabilities.
Updated: 2025-11-18GitHub→
0
0
Medium Cost
asadmpatel9890 icon

basic_mcp_server

by asadmpatel9890

Sec8

Facilitates AI-powered interaction and retrieval of GitHub repository information using Groq's fast inference capabilities.

Setup Requirements

  • ⚠️Requires Groq API Key (Paid service)
  • ⚠️Requires installation of Python dependencies (langchain, fastmcp, requests, etc.)
Verified SafeView Analysis
The code primarily fetches public GitHub repository information using the 'requests' library, which is generally secure. The 'get_repo' function takes a 'name' parameter, which is used to construct a GitHub API URL. While this could potentially be misused to query non-existent users or trigger rate limits on the GitHub API, it does not appear to enable arbitrary code execution, file system access, or expose hardcoded secrets. All sensitive keys are loaded via environment variables. The client runs the server locally via a direct Python command.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
oabdelrahman98 icon

outlook-mcp-server

by oabdelrahman98

Sec9

Manages Microsoft Outlook emails through the Microsoft Graph API, enabling features like listing, sending, reading, and searching emails via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires Azure subscription and Azure CLI for initial setup.
  • ⚠️Mandatory Azure AD Application registration with specific Microsoft Graph API permissions (Mail.ReadWrite, Mail.Send).
  • ⚠️Requires manual configuration of OpenAPI specification (openapi.yaml) with deployed server URL and Azure tenant ID.
  • ⚠️Requires setting up a Power Platform Custom Connector and configuring OAuth 2.0 with the Azure AD app's client ID and secret.
Verified SafeView Analysis
The server correctly extracts the OAuth access token from the Authorization header for each request and uses it to call the Microsoft Graph API. There are no hardcoded secrets within the provided source code, nor any usage of 'eval' or other highly dangerous functions. Security largely depends on the proper configuration of the Azure AD application and OAuth 2.0 flow as described in the README.
Updated: 2025-11-25GitHub→
0
0
Low Cost
Porta048 icon

AutoCad-MCP

by Porta048

Sec8

This server controls AutoCAD, GstarCAD, or ZWCAD software through natural language commands received via the Model Context Protocol (MCP) from Claude Desktop.

Setup Requirements

  • ⚠️Requires a Windows operating system for COM interface.
  • ⚠️Requires AutoCAD, GstarCAD, or ZWCAD to be installed locally.
  • ⚠️Requires manual configuration within Claude Desktop's `claude_desktop_config.json`.
Verified SafeView Analysis
The server primarily relies on Windows COM automation to interact with CAD software. While the code itself does not contain obvious malicious patterns, hardcoded secrets, or direct network vulnerabilities (it uses standard I/O for communication), the nature of COM automation means that if the underlying CAD application or the COM interface itself has vulnerabilities, this server could potentially be a vector for exploitation. However, the server's internal logic for dispatching commands based on natural language parsing appears robust, mapping to predefined and controlled CAD operations rather than arbitrary command execution.
Updated: 2026-01-19GitHub→
0
0
Low Cost
rocky3419 icon

mcp-dev-utils

by rocky3419

Sec9

Provides a Model Context Protocol (MCP) compatible server to expose simple developer utility tools, demonstrating tool discovery and execution via stdio transport.

Setup Requirements

  • ⚠️Requires Node.js runtime
  • ⚠️Requires a build step (TypeScript compilation) before running via `start` script
  • ⚠️Requires an MCP Gateway for external interaction (communicates via stdio)
Verified SafeView Analysis
The server explicitly routes tool calls based on the tool name, preventing arbitrary execution. No 'eval' or direct 'child_process' use was detected in the provided code. It utilizes stdio transport, which limits direct network exposure to the MCP gateway it interacts with, enhancing security through isolation.
Updated: 2025-12-13GitHub→
0
0
Medium Cost
seanshin0214 icon

mcp-rag-template

by seanshin0214

Sec8

This server acts as a Model Context Protocol (MCP) endpoint, providing Retrieval-Augmented Generation (RAG) capabilities by searching a local ChromaDB knowledge base and offering markdown-defined 'skills' to enhance an AI assistant's persona and expertise.

Setup Requirements

  • ⚠️Requires Node.js (>=18.0.0)
  • ⚠️Requires manual execution of 'npm run embed' after adding or modifying knowledge/skill markdown files to update the ChromaDB vector store.
  • ⚠️The 'CHROMA_PATH' environment variable should be configured to specify where ChromaDB stores its data, otherwise it defaults to './chroma-data'.
Verified SafeView Analysis
The server design generally follows good practices by using a switch-case for tool calls, preventing arbitrary code execution. File system access for knowledge and skills is restricted to predefined local directories during embedding/resource loading, not arbitrary user-controlled paths. ChromaDB operations are based on collection names, which typically limits direct file system vulnerabilities. No 'eval' or other obviously dangerous functions handling user input directly were found. The main potential risks would involve unforeseen vulnerabilities in the ChromaDB client or SDK, or if the embedding process were exposed to malicious markdown files.
Updated: 2025-11-28GitHub→
0
0
Medium Cost
PyJudge icon

pdfblocks-mcp

by PyJudge

Sec4

This project implements a server for the Minecraft Client Protocol (MCP), likely intended for custom Minecraft clients, tools, or game development.

Setup Requirements

  • ⚠️Requires Python installed
  • ⚠️Potential firewall configuration for server port
  • ⚠️Unknown Python package dependencies (no `requirements.txt` or `setup.py` provided)
Review RequiredView Analysis
Cannot perform a detailed security audit as source code content was not provided. As a network protocol server, it inherently exposes a network attack surface. Without inspecting the code, it's impossible to verify input validation, authentication mechanisms, or the absence of common vulnerabilities like hardcoded secrets or 'eval' statements. Running a network server without a security review carries inherent risks.
Updated: 2025-11-20GitHub→
0
0
Low Cost
BachEndDeveloper icon

dotnet-agent-demo

by BachEndDeveloper

Sec9

This project demonstrates a .NET Aspire application with an API service and a web front-end, showcasing distributed application development and orchestration.

Setup Requirements

  • ⚠️Requires .NET SDK (8.0 or later recommended)
  • ⚠️Requires .NET Aspire workload installed
Verified SafeView Analysis
The provided code consists of configuration files (launchSettings.json, appsettings.json) and does not contain any executable logic like 'eval' or obfuscation. All network endpoints configured in launchSettings.json are localhost, limiting direct external exposure. 'AllowedHosts: "*"' in appsettings.json is a common default for development but should be restricted in a production environment. No hardcoded secrets or malicious patterns are observed.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
LAB271 icon

mcp-studies

by LAB271

Sec6

Demonstrates the fundamental architecture of an MCP server using stdio transport, showcasing core primitives like tools, prompts, and resources.

Setup Requirements

  • ⚠️Requires Python 3.10+ (Python 3.11/3.13 used in Dockerfiles for other spikes)
  • ⚠️Requires 'uv' package manager for environment setup
  • ⚠️Docker and Docker Compose are required for more advanced spikes (e.g., Docker deployment, database integrations)
  • ⚠️Specific database instances (Neo4j, PostgreSQL) are needed for relevant spikes and require their own setup/credentials.
Verified SafeView Analysis
The `calculate` tool uses `eval()` which is inherently dangerous, even with the `allowed_chars` filtering. While the filtering reduces common injection vectors, `eval()` can still be a source of vulnerabilities if not meticulously secured against all possible edge cases. Additionally, some Docker Compose files contain default hardcoded database credentials which could pose a risk if deployed without proper environment variable overrides.
Updated: 2026-01-06GitHub→
PreviousPage 717 of 760Next