Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
jeffellin icon
Sec9

A Python-based Model Context Protocol (MCP) server providing weather forecasting and alerts from the National Weather Service API, with optional JWT authentication.

Setup Requirements

  • ⚠️Requires Python 3 and installation of dependencies via `pip install -r requirements.txt`.
  • ⚠️Enabling JWT authentication requires setting several environment variables (e.g., `JWT_REQUIRED=true`, `JWT_JWKS_URI`, `JWT_CUSTOM_HEADER`, `JWT_ALGORITHM`) correctly, especially ensuring `JWT_JWKS_URI` points to a valid public key endpoint.
  • ⚠️The server fetches JWKS from an external URL which must be accessible and trusted.
Verified SafeView Analysis
The server implements JWT authentication using standard practices, fetching JWKS from a configurable URI for public key validation. It properly handles token extraction, validation (signature, expiration, etc.), and error cases (401 Unauthorized). No 'eval' or malicious patterns were found. Configuration is via environment variables, preventing hardcoded secrets. The reliance on an external JWKS URI introduces a trust dependency on that endpoint's security and availability, which is standard for JWT but a point to note. Input validation for weather tools is basic (e.g., coordinate rounding), which is generally sufficient for its purpose.
Updated: 2025-11-30GitHub→
0
0
Low Cost
neerajnayan icon
Sec5

A remote Model Context Protocol (MCP) server deployed on Cloudflare Workers, providing unauthenticated access to basic calculator tools for AI agents.

Setup Requirements

  • ⚠️Requires a Cloudflare account and configured bindings (Durable Object, KV Namespace) for deployment.
  • ⚠️The server is explicitly unauthenticated; implementing proper authentication is a critical step for any production use.
  • ⚠️Requires Node.js and npm/pnpm/yarn to set up and run locally.
Verified SafeView Analysis
The server is explicitly designed to operate "without auth" as indicated by its name and README. This means that anyone with the deployed URL can invoke the calculator tools without any authentication or authorization. While acceptable for a demo or development environment, deploying this as-is in a production environment poses a critical security risk due to the complete lack of access control. The provided code does not contain 'eval', hardcoded secrets, or obvious injection vulnerabilities within the tool implementations (which utilize Zod for schema validation).
Updated: 2025-11-27GitHub→
0
0
Low Cost
jtcole icon
Sec9

Provides performance benchmarking capabilities for an exploratory data analysis (EDA) server built on the Model Context Protocol.

Setup Requirements

  • ⚠️Requires `Pydantic` (v2 implied by `model_dump_json`).
  • ⚠️Requires `NumPy`.
  • ⚠️GPU benchmarks require `PyTorch` and a CUDA-compatible GPU, otherwise, they are skipped gracefully.
Verified SafeView Analysis
The provided code is a local benchmarking script with no network interaction or sensitive data handling. It writes results to a local file specified by the user, posing a minor risk only if a malicious output path is provided (e.g., overwriting critical system files), which is a standard CLI risk. No `eval`, obfuscation, or hardcoded secrets found.
Updated: 2025-12-05GitHub→
0
0
Low Cost
shoaibraza123 icon

promptbook-mcp

by shoaibraza123

Sec1

This project is likely a server-side component or framework designed for developing and managing modifications (mods) within a Minecraft server environment, facilitating custom gameplay or features.

Setup Requirements

  • ⚠️Source code is not available for review, preventing identification of specific setup requirements, dependencies, or configuration parameters. Running this project would first require obtaining the source code.
  • ⚠️Based on its name, it likely requires a running Minecraft server environment or specific Minecraft-related development tools and dependencies.
Review RequiredView Analysis
No source code was provided for analysis. A comprehensive security audit could not be performed. Running this project without access to and a thorough review of its source code is highly risky due to unknown vulnerabilities, potential malicious patterns, or hardcoded secrets.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
tdnupe3 icon
Sec8

Connects LLMs to real-time blockchain, crypto, and traditional market data via 38 Coin Railz micropayment services.

Setup Requirements

  • ⚠️Requires Coin Railz account and API key for most services (paid via credits or x402 protocol).
  • ⚠️Sends anonymous telemetry data to Coin Railz.
  • ⚠️Requires Python 3.10 or higher.
Verified SafeView Analysis
The server relies on an external API (coinrailz.com) for all its functionality, meaning trust in the Coin Railz backend is essential. It handles the API key securely via environment variables and does not contain obvious code injection vulnerabilities like 'eval' or hardcoded secrets. It sends anonymous telemetry data to the Coin Railz backend, and automatically attempts to fetch a demo API key from Coin Railz if `COINRAILZ_API_KEY` is not set. While no direct security flaws were found in the provided local code, users should be aware of these external communications and the paid nature of most services.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
rishi-madhav icon

mcp-servers

by rishi-madhav

Sec9

AI-powered server for generating comprehensive educational content (flashcards, courses, quizzes, explanations, summaries, practice problems).

Setup Requirements

  • ⚠️Requires Python 3.9+
  • ⚠️Requires Claude Desktop (MCP client) to interact with the server
  • ⚠️Requires at least one AI provider API key (OpenAI/Anthropic/Gemini) – OpenAI and Anthropic generally require paid API access, while Gemini offers a free tier.
Verified SafeView Analysis
The server primarily makes outbound API calls to well-known AI providers (OpenAI, Anthropic, Gemini). API keys are loaded from environment variables, which is good practice. Input validation is implemented for tool parameters (e.g., count, level, difficulty) to prevent basic invalid inputs. There is no usage of 'eval' or 'exec' on user input. The primary risk would be prompt injection through the 'topic' or 'content' fields, which is a common concern for LLM applications but does not expose the server itself to arbitrary code execution.
Updated: 2025-12-16GitHub→
0
0
Medium Cost
tyson-swetnam icon

aqs-mcp

by tyson-swetnam

Sec9

Provides a Model Context Protocol (MCP) server for accessing and querying the EPA Air Quality System (AQS) API for air quality data, monitor information, and quality assurance data.

Setup Requirements

  • ⚠️Requires an EPA AQS API Key, which can be obtained using the `aqs_signup` tool or manual registration with EPA.
  • ⚠️Requires Node.js version 18 or higher to run.
  • ⚠️Requires a build step (`npm run build`) using TypeScript before the server can be executed.
Verified SafeView Analysis
The server securely handles API credentials by resolving them from explicit parameters or environment variables (AQS_EMAIL, AQS_API_KEY), avoiding hardcoding. Input validation is performed for date formats and ranges to prevent common errors. All external API calls are directed to the official EPA AQS API. Rate limiting is implemented to comply with API guidelines. Error handling is present to gracefully manage API failures or invalid input. No 'eval' or other dangerous dynamic code execution patterns were found, and there is no code obfuscation.
Updated: 2025-12-02GitHub→
0
0
Medium Cost
Uzeyr-Odysseus icon

BookingMCP

by Uzeyr-Odysseus

Sec9

Serves as an LLM-friendly Model Context Protocol (MCP) server for searching hotels and destinations using the Booking.com RapidAPI.

Setup Requirements

  • ⚠️Python 3.11+ required
  • ⚠️RapidAPI account and Booking.com API subscription required (potentially paid API usage)
  • ⚠️Requires `RAPIDAPI_KEY` to be set in a `.env` file
Verified SafeView Analysis
The server loads `RAPIDAPI_KEY` from environment variables, which is good practice for secrets. It uses `httpx` for external API calls, which is a standard and generally secure library. There are no obvious signs of 'eval', 'exec', or other dangerous functions being used on untrusted input, nor are there hardcoded sensitive credentials. Network requests are to a defined third-party API (RapidAPI). Logging includes API request parameters which might be a minor concern if parameters contain sensitive PII, but for hotel search queries, this is generally low risk.
Updated: 2025-11-26GitHub→
0
0
High Cost
berucha-lilly icon

a11y-mcp

by berucha-lilly

Sec8

Automated accessibility code review and WCAG 2.2 AA enforcement for GitHub Pull Requests using a hybrid analysis engine.

Setup Requirements

  • ⚠️Requires Node.js 18+
  • ⚠️Requires GitHub repository with admin access (for full GitHub Actions integration and branch protection)
  • ⚠️Requires npm dependencies installed
Verified SafeView Analysis
The server uses `fs.readFileSync` based on a `filePath` argument, which could be a local file system risk if the input is not carefully controlled. In its intended GitHub Actions context, `filePath` is expected to refer to files within the PR's changes, mitigating arbitrary file access. The `GITHUB_TOKEN` is used for GitHub API interactions (fetching PR content, posting comments) which is standard but requires appropriate token permissions. No explicit `eval` or code obfuscation found. Dependencies are standard for code analysis.
Updated: 2025-12-05GitHub→
0
0
Low Cost
dtrog icon
Sec8

The GPG Webservice MCP Adapter allows AI agents (like ChatGPT) to perform GPG cryptographic operations (sign, verify, encrypt, decrypt) by dynamically exposing them as MCP tools and acting as a proxy to a Flask REST API.

Setup Requirements

  • ⚠️Requires Docker & Docker Compose (v2.0+) for the full suite.
  • ⚠️The Flask GPG Webservice REST API must be running for the MCP server to function.
  • ⚠️Requires Node.js >= 18.0.0 and npm to build and run the MCP server directly.
  • ⚠️For production, update CORS settings from `*` and ensure proper TLS certificate validation (`NODE_TLS_REJECT_UNAUTHORIZED` should not be `0`) as detailed in deployment guides.
Verified SafeView Analysis
The project demonstrates a strong focus on security, particularly in the core Flask backend with features like Argon2id password hashing, AES-256-GCM encryption for private keys, PBKDF2-HMAC-SHA256 for key derivation, and process isolation for GPG operations. For the MCP server specifically, it enables CORS with `origin: '*'` and `NODE_TLS_REJECT_UNAUTHORIZED=0` for internal Docker communication during development. While these are documented as development defaults and production hardening (e.g., via Caddy reverse proxy) is detailed, they are significant security risks if directly deployed to a public-facing production environment without modification. The server itself is a proxy and does not directly handle private keys, mitigating some risks. Extensive security documentation and testing procedures are provided, indicating a strong security-conscious development approach.
Updated: 2025-12-03GitHub→
0
0
Medium Cost
Sec5

A server supporting an Excel add-in with AI integration, specifically leveraging Claude for enhanced functionality within spreadsheets.

Setup Requirements

  • ⚠️Requires Claude AI setup (API key or a locally running Claude Desktop instance is likely needed based on 'claude_desktop_config.json').
  • ⚠️Requires Node.js and npm/yarn to be installed to manage dependencies and run the server.
  • ⚠️Requires Microsoft Excel (desktop or web) to load the add-in via the 'manifest.json' (sideloading steps will likely be involved).
Review RequiredView Analysis
The absence of a README.md makes a comprehensive security audit impossible. As a server, it will open network ports. Integration with Claude AI implies potential external API calls and handling of data. The file 'excel-mcp-server.mcpb' is an unknown binary/package format, which could contain obfuscated or unauditable code. Without code review of the 'src' directory, risks related to 'eval' or other vulnerabilities cannot be assessed.
Updated: 2025-11-18GitHub→
0
0
Medium Cost
Akungapaul icon

wp-themes-mcp

by Akungapaul

Sec3

WordPress theme management and automation through a Model Context Protocol (MCP) server, allowing agents to list, activate, install, delete, and create WordPress themes.

Setup Requirements

  • ⚠️Requires a running WordPress instance with REST API enabled and appropriate user credentials for theme management.
  • ⚠️WP-CLI must be installed and configured on the server, or SSH access provided for remote execution, if WP-CLI dependent tools are enabled.
  • ⚠️Requires Node.js v18 or higher.
Review RequiredView Analysis
The server uses `cliClient.exec` to run WP-CLI commands. In `get_theme_mods` and `create_child_theme` tools, user-provided arguments (`args.theme`, `args.child_slug`, `args.parent_theme`) are directly interpolated into the shell command string without explicit sanitization beyond Zod type validation. This creates a high risk of command injection if a malicious actor or agent provides specially crafted input, allowing arbitrary command execution on the host where WP-CLI is run. Although other WP-CLI calls like `activateTheme` or `installTheme` might be safer if `WPCLIClient` performs internal sanitization, the direct `exec` interpolation is a critical vulnerability.
Updated: 2025-11-28GitHub→
PreviousPage 748 of 760Next