Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
Sec3

A server for tracking expenses and managing financial data.

Review RequiredView Analysis
No code or README content was provided for analysis due to '404: Not Found', making a thorough security audit impossible. The score reflects the unknown and potentially risky status.
Updated: 2025-11-18GitHub→
0
0
Low Cost
Sec7

Provides a simple Model Context Protocol (MCP) server implementation using Yupiik Fusion JSON-RPC API.

Setup Requirements

  • ⚠️Requires Apache Maven >= 4.0.0-rc1
  • ⚠️Requires Java >= 25
Verified SafeView Analysis
This is a standard Java Maven project that acts as a server, inherently exposing network ports (e.g., 8080 for the demo). No apparent 'eval' or obfuscation. As with any server application, robust security practices (authentication, authorization, input validation) are required for production deployment, which are not explicitly detailed in the truncated README.
Updated: 2025-11-17GitHub→
0
0
Low Cost
cassiama icon

LicenseGuard-MCP

by cassiama

Sec8

Provides a Micro-Agent Protocol (MCP) server that analyzes project dependencies from 'requirements.txt' for their software licenses by interacting with a separate REST API.

Setup Requirements

  • ⚠️Requires Docker Desktop/Engine installed.
  • ⚠️An external REST-server (LicenseGuard-API) must be running and accessible before starting the MCP server.
  • ⚠️Mandatory environment variables BACKEND_URL_HOST and BACKEND_URL_PORT must be set for the server to function.
Verified SafeView Analysis
The server's code does not contain obvious malicious patterns like 'eval', 'exec', or direct shell command execution. Input validation is present for project name length and requirements content type, preventing basic injection attempts. Error handling for network, HTTP status, and timeout errors is robust, designed to prevent crashes and return structured error messages to the client. No hardcoded secrets are present; backend communication URLs are configured via environment variables. The overall security profile is intrinsically linked to the trustworthiness and security of the external REST-server it communicates with.
Updated: 2025-12-14GitHub→
0
0
High Cost
Rafiza115 icon

lara-mcp

by Rafiza115

Sec9

This MCP server provides a single tool to translate text between languages using the Lara API, supporting language detection and context-aware translations.

Setup Requirements

  • ⚠️Requires LARA_ACCESS_KEY_ID environment variable.
  • ⚠️Requires LARA_ACCESS_KEY_SECRET environment variable.
  • ⚠️Requires Node.js and a package manager (pnpm recommended for local development/build).
Verified SafeView Analysis
Credentials (LARA_ACCESS_KEY_ID, LARA_ACCESS_KEY_SECRET) are correctly handled via environment variables. All input arguments for the 'translate' tool are rigorously validated using Zod schemas, significantly mitigating common injection vulnerabilities. Output is safely stringified to JSON. The use of StdioServerTransport indicates communication over standard I/O, which is generally secure for a local process execution and doesn't expose network ports by default. No 'eval' or other highly dangerous patterns with user-controlled input were found.
Updated: 2025-12-15GitHub→
0
0
Low Cost
deptz icon

qontak-mcp

by deptz

Sec9

Provides a Model Context Protocol (MCP) server for managing Contacts, Companies, Deals, Tickets, Tasks, Notes, Products, and Product Associations in Qontak CRM with dynamic field discovery capabilities.

Setup Requirements

  • ⚠️Requires Qontak CRM API Refresh Token.
  • ⚠️Requires Python 3.10+.
  • ⚠️Redis server is recommended for development/staging performance (local Redis or Docker setup provided).
  • ⚠️For production, HashiCorp Vault is required for token storage (needs VAULT_ADDR, VAULT_TOKEN, and proper Vault setup).
Verified SafeView Analysis
The server demonstrates a strong security posture with extensive use of Pydantic for input validation (including 'forbid extra fields' and custom regex for injection prevention). It implements robust multi-tenant isolation via user_id validation and structured security logging with sensitive data redaction. Authentication uses lazy token refresh with tiered token storage options (environment for local dev, Redis for dev/staging, and Vault for production-grade security with encryption/auditing). The HTTP client explicitly verifies SSL certificates. All hardcoded API endpoints are for the known Qontak service. Explicit warnings are provided for non-production token storage solutions. No 'eval' or similar dangerous patterns were found. A score of 9 is given due to the explicit warnings about plain-text token storage in Redis for staging environments, which is a deployment-level risk if misused without proper network security, although the code itself responsibly highlights this.
Updated: 2025-11-30GitHub→
0
0
High Cost
liliankasem icon
Sec9

An Azure Functions MCP (Model Context Protocol) server that provides comprehensive monitoring and insights tools for Azure Functions resources.

Setup Requirements

  • ⚠️Requires .NET 10 SDK installed.
  • ⚠️Requires explicit configuration of AZURE_SUBSCRIPTION_ID in local.settings.json or environment variables.
  • ⚠️Requires the Azure identity (user or service principal) to have 'Reader' role on the Azure subscription containing Function Apps.
Verified SafeView Analysis
The server leverages Azure's managed identities for permissions, granting read-only roles (Monitoring Reader, Reader) to minimize risk. It avoids hardcoding secrets by requiring explicit configuration of subscription IDs and relying on Azure CLI login or service principals. While the 'QueryApplicationInsights' tool allows custom KQL queries, this is a feature, and its security largely depends on the permissions granted to the Function App and the context in which it is used; it does not inherently introduce code execution vulnerabilities within the server itself.
Updated: 2025-11-27GitHub→
0
0
Medium Cost
JEdward7777 icon
Sec6

Acts as a proxy server to bridge MCP clients with the translation-helps-mcp HTTP API, handling JSON-RPC 2.0 protocol translation and response formatting for translation resources.

Setup Requirements

  • ⚠️Project is explicitly marked as DEPRECATED in its README, stating it 'will no longer work because of the upstream changes', which critically contradicts other parts of the documentation claiming it is 'PRODUCTION READY'. This implies the core functionality may be broken.
  • ⚠️Requires Python 3.10 or newer (specified in `pyproject.toml`).
  • ⚠️By default, SSL certificate verification is disabled for connections to the upstream server, posing a significant security risk (Man-in-the-Middle attacks).
Review RequiredView Analysis
The `MCPProxyServer` class and temporary proxy instances (e.g., for `--list-tools` command) default to `verify_ssl=False` for `httpx.AsyncClient` connections to the upstream server. This disables SSL certificate verification, making connections vulnerable to Man-in-the-Middle attacks. It is a critical security risk for sensitive data or in production environments and should be explicitly set to `True` where possible. Input arguments for tool calls are passed to the upstream server; while `httpx` generally encodes parameters safely, the overall security relies on the upstream API's sanitization for complex inputs. No 'eval' or hardcoded secrets were found within the provided source code for this project.
Updated: 2025-11-25GitHub→
0
0
High Cost
CampbellPedersen icon

slopchat

by CampbellPedersen

Sec8

This MCP server enables AI models to generate and send chat messages to Atrioc's Twitch stream by providing real-time stream context, trending Reddit posts, and top news stories.

Setup Requirements

  • ⚠️Requires a Twitch account that follows 'biggreenau' to use the service.
  • ⚠️Requires Twitch Developer Application setup to obtain Client ID and manage OAuth.
  • ⚠️Requires a NewsAPI API Key for fetching news stories.
Verified SafeView Analysis
The server correctly uses environment variables for sensitive API keys (Twitch Client ID, NewsAPI key, Host) and the Twitch OAuth server URL. It implements a restrictive CORS policy, allowing only specific origins (Claude AI, local MCP inspector). Twitch access tokens are validated for client ID and required scopes. There are no apparent uses of `eval` or intentional obfuscation. The `exchangeAuthorizationCodeForToken` endpoint relies on the `URLSearchParams` from `req.body` to include necessary OAuth parameters (likely `client_id` and `client_secret` if it's a confidential client flow, or other PKCE parameters), but the server itself doesn't explicitly read a `TWITCH_CLIENT_SECRET` from its environment variables for this exchange. The `getChatMessageBatch` uses a hardcoded 5-second `sleep` which is not a direct security risk but could be a performance bottleneck under high load if not properly managed.
Updated: 2026-01-19GitHub→
0
0
High Cost
ajaysingh-codes icon

team-synapse

by ajaysingh-codes

Sec8

Transforms meeting recordings into a knowledge graph, enabling AI-powered chat and visualization for corporate memory and team intelligence.

Setup Requirements

  • ⚠️Requires Google Cloud Platform (GCP) project with Vertex AI API enabled and a GCS bucket.
  • ⚠️Requires a GCP Service Account Key file (`GOOGLE_APPLICATION_CREDENTIALS`).
  • ⚠️Requires a Neo4j AuraDB instance URI and credentials.
  • ⚠️Requires a Google Gemini API Key (`GEMINI_API_KEY` or `GOOGLE_API_KEY`) for live agent.
  • ⚠️Notion integration requires Node.js/npm to run the `@notionhq/notion-mcp-server` subprocess.
  • ⚠️Miro integration requires `MIRO_API_TOKEN` and `MIRO_BOARD_ID`.
Verified SafeView Analysis
The application relies heavily on environment variables for sensitive credentials (GCP, Neo4j, Gemini, Miro, Notion), which is good practice. The Gradio server can be launched with `share=True`, which would expose it publicly without authentication if `GRADIO_USERNAME` and `GRADIO_PASSWORD` are not set. The Notion integration uses `npx @notionhq/notion-mcp-server`, implying a dependency on Node.js/npm and potentially introducing supply chain risks from that external package, though it's a standard tool. No 'eval' or obvious malicious code patterns were found.
Updated: 2025-11-26GitHub→
0
0
Low Cost
tyagianant1 icon
Sec9

An asynchronous MCP server designed for tracking and summarizing personal or small-scale expenses with a local SQLite database, exposing its functionality via an HTTP API.

Setup Requirements

  • ⚠️Requires Python 3.14 or higher (Note: Python 3.14 is currently pre-release and not widely available)
  • ⚠️Requires a writable temporary directory for database storage
Verified SafeView Analysis
The server uses parameterized queries with aiosqlite, effectively preventing SQL injection vulnerabilities. No 'eval', direct shell execution, or hardcoded sensitive credentials were found. The database is created in a temporary directory, which is generally safe but means the database is not persistently stored in a fixed location across system reboots unless specifically handled.
Updated: 2025-11-20GitHub→
0
0
Medium Cost
learner14 icon

mcpserver

by learner14

Sec5

To host multiplayer sessions for the Minecraft game.

Setup Requirements

  • ⚠️Requires proper network port configuration for external access
  • ⚠️Sufficient system resources (RAM, CPU) required based on player count and world complexity
Review RequiredView Analysis
A thorough security audit could not be performed as the source code was not provided. Game servers inherently expose network ports, which could pose risks (e.g., DDoS, unauthenticated access) if not properly secured. Specific vulnerabilities like 'eval', hardcoded secrets, or malicious patterns cannot be identified without the code.
Updated: 2025-12-10GitHub→
0
0
Medium Cost
abhi-824 icon

ppt-automation

by abhi-824

Sec9

An AI-powered PowerPoint add-in that allows users to create, edit, and enhance presentations using natural language, with features like smart slide generation, component-wise change management, and cross-file data referencing.

Setup Requirements

  • ⚠️Requires local Ollama (or compatible MCP provider) running for local AI models.
  • ⚠️Requires Node.js (v18+), Python (v3.8+), and Go (v1.21+) installed.
  • ⚠️Requires local TLS certificates (`localhost+2.pem`, `localhost+2-key.pem`) for the Go orchestrator for HTTPS communication, which are typically generated during Office Add-in development setup.
Verified SafeView Analysis
The `my-mcp-server` component, analyzed as the MCP Server, communicates via standard I/O (stdio) and is intended to be run as a subprocess of the `mcphost` orchestrator. This significantly reduces its direct external network attack surface. The overall system involves a Go orchestrator (exposed via HTTPS with CORS for local access), which interacts with a Python FastAPI backend (exposed locally via HTTP) and the MCP host/tools. Input processing, including `slideBase64` data from the PowerPoint add-in, is handled internally. While there's no explicit sanitization for all content sent to the Python API, the context implies trusted input from the user's local PowerPoint. Text inputs are processed for styling/layout, not direct code execution (e.g., no `eval`). The primary LLM interaction (handled by the orchestrator via `mcphost` SDK) inherently carries prompt injection risks, but this is a function of LLM design, not a server vulnerability. No hardcoded secrets or malicious patterns were found in the truncated source code.
Updated: 2026-01-17GitHub→
PreviousPage 728 of 760Next