Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost

mcp-client-kit

by leotrinh

Sec6

A TypeScript/Node.js client library for connecting to multiple Model Context Protocol (MCP) servers and aggregating their capabilities through a unified interface.

Setup Requirements

  • ⚠️Requires a `mcp_servers.json` configuration file to define servers.
  • ⚠️Requires external or locally running MCP servers to provide actual functionality.
Review RequiredView Analysis
The client's safety heavily depends on the trustworthiness of the `mcp_servers.json` configuration file. It can be configured to execute arbitrary local commands via the `stdio` transport (e.g., `command` and `args` properties) or connect to potentially malicious external servers via HTTP/SSE. If the configuration is untrusted, this poses a significant security risk for remote code execution or data exfiltration. Users must ensure the `mcp_servers.json` is from a trusted source.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
AttilaPataky icon

AzurePricingMCP

by AttilaPataky

Sec8

Estimates Microsoft Azure-related pricing and costs programmatically for various services and SKUs.

Setup Requirements

  • ⚠️Requires Python 3.10+.
  • ⚠️Requires a specific AI assistant (VS Code + GitHub Copilot or Claude Desktop) for client integration.
  • ⚠️Requires an absolute path to the Python executable in client configurations when not using Docker.
Verified SafeView Analysis
The server uses standard `aiohttp` for external API calls, managing sessions and retries robustly. There are no direct usages of `eval` or `exec`, nor hardcoded API keys or sensitive secrets. A default 10% customer discount is hardcoded for demonstration. When run via HTTP transport (e.g., Docker `0.0.0.0`), it exposes an endpoint, which is a standard practice but requires network security considerations.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
arjuns-ti icon

slides-mcp-server

by arjuns-ti

Sec8

Provides FastMCP tools for programmatic access to Google Slides, including presentation overviews, detailed slide content retrieval, and text editing.

Setup Requirements

  • ⚠️Requires manual Google Cloud Project setup (enable APIs, create OAuth credentials)
  • ⚠️Requires Python 3.12+
  • ⚠️Requires the 'uv' package manager for installation and execution
  • ⚠️Initial run will trigger an interactive OAuth authentication flow requiring browser interaction to grant permissions and save a token file.
Verified SafeView Analysis
The server uses standard Google OAuth 2.0 for authentication, requiring the user to set up a Google Cloud Project, enable APIs, and configure OAuth credentials. It explicitly requests high-privilege scopes (`drive.readonly`, `drive.file`, `presentations`) which grant full read/write access to Google Slides presentations and management of app-created files. The `setup.sh` script attempts to fetch OAuth configuration from an external API using `API_KEY`, which introduces a dependency on the security of that external service. All sensitive credentials (`.env`, `credentials.json`, `token.json`) are handled via environment variables and local files, with warnings in the README not to commit them. File-based logging (`logs.txt`) is optional but can contain sensitive information if enabled; users are warned to secure this file. There are no obvious 'eval' or malicious patterns, and Google API client output is suppressed from console.
Updated: 2025-11-19GitHub→
0
0
Medium Cost
taskcrew icon
Sec9

Integrates ElevenLabs Conversational AI agents with AI assistants like Claude Code for voice interactions, outbound calls, and transcript retrieval.

Setup Requirements

  • ⚠️Requires an ElevenLabs API Key (paid service, costs depend on usage)
  • ⚠️Requires a Vercel account for deployment
  • ⚠️ELEVENLABS_API_KEY must be set in Vercel environment variables (not .env files) for production
  • ⚠️Requires Node.js 18+ for local development
Verified SafeView Analysis
The server demonstrates strong security practices: API keys (`ELEVENLABS_API_KEY`) are explicitly handled as Vercel environment variables, preventing hardcoding. CORS is properly configured with an `ALLOWED_ORIGINS` whitelist. Input validation is present for critical parameters like IDs and phone numbers. Error responses are sanitized to avoid leaking sensitive information (e.g., stack traces). There is no use of `eval` or other dangerous code execution patterns, and dependencies are managed. Future multi-tenancy plans outlined in documentation suggest even more robust per-user authentication. The primary risk would be misconfiguration of environment variables or overly permissive CORS in production.
Updated: 2025-11-25GitHub→
0
0
Medium Cost
marcomatteo icon

kapua-mcp-server

by marcomatteo

Sec8

An MCP server designed for local troubleshooting and operator tooling with Eclipse Kapua or Eurotech Everyware Cloud IoT Device Management platforms, exposing Kapua APIs for device inspection and telemetry.

Setup Requirements

  • ⚠️Requires Go 1.23+ to build locally.
  • ⚠️Mandatory Kapua instance (Eclipse Kapua or Eurotech Everyware Cloud) with API endpoint and user credentials.
  • ⚠️The 'kapua-device-logs-list' tool specifically requires an Eurotech Everyware Cloud endpoint, not open-source Kapua.
  • ⚠️Local `.venv` file management for credentials or setting environment variables is required.
Verified SafeView Analysis
The server explicitly uses environment variables or a .venv file for sensitive credentials, avoiding hardcoded secrets. It implements an origin guard for HTTP streamable transport to mitigate common web vulnerabilities. Authentication uses JWT with automatic refresh. Logging middleware is in place, which is good for auditing. No 'eval' or obvious malicious patterns are present. The primary security considerations involve proper configuration by the user and the inherent security of the underlying Kapua API.
Updated: 2025-12-06GitHub→
0
0
Medium Cost
iZhenius icon
Sec8

Provides weather forecast and alert tools via a Model Context Protocol (MCP) server, integrating with the National Weather Service API.

Setup Requirements

  • ⚠️Requires Java 21 or later
  • ⚠️Requires Gradle to build the JAR file
Verified SafeView Analysis
The server's HTTP endpoint enables CORS for 'anyHost()', which is common for public APIs but should be noted. User-provided `latitude`, `longitude`, and `state` parameters are directly interpolated into API URLs; however, the Ktor HTTP client is expected to handle URL encoding for path segments, and input parsing (`doubleOrNull`, `jsonPrimitive?.content`) helps mitigate simple injection risks. No hardcoded secrets or 'eval' statements were found.
Updated: 2025-11-19GitHub→
0
0
Low Cost
pikkujs icon
Sec4

Develop and deploy a Model Context Protocol (MCP) server that provides AI-compliant tools, resources, and prompts for managing a todo list application.

Setup Requirements

  • ⚠️Hardcoded JWT secret must be replaced with a secure secret management solution for production.
  • ⚠️Requires Pikku CLI (`@pikku/cli`) to generate necessary code files (`yarn prebuild` or `pikku all`).
Review RequiredView Analysis
The application contains a hardcoded JWT secret ('super-secret-jwt-key-change-in-production') which is a critical vulnerability for production deployments. A generic HTTP endpoint (`/rpc/:rpcName`) exposes RPC functions marked as 'exposed' without authentication (`auth: false`), requiring careful management of which functions are exposed. Furthermore, an internal remote RPC queue worker (`pikku-remote-internal-rpc`) explicitly notes a 'security risk' as it allows invoking any internal RPC by name (`rpc.invoke`) without further validation, which could be exploited if an attacker can inject messages into this queue.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
Haramain-Talat icon

mcp_server_tn

by Haramain-Talat

Sec1

A server implementation for the Minecraft Protocol, likely enabling custom game logic or proxying connections for Minecraft clients.

Review RequiredView Analysis
No source code was provided for analysis. A security audit is impossible. Running software without its source code carries inherent and extreme security risks, including the potential for 'eval' without justification, hardcoded secrets, or malicious patterns that cannot be detected.
Updated: 2025-12-06GitHub→
0
0
Low Cost
vikassrathi icon

MCP-Server

by vikassrathi

Sec10

A learning project focused on understanding and building servers compatible with the Minecraft Protocol (MCP).

Verified SafeView Analysis
No server implementation code was provided for analysis; the assessment is based solely on the README.md file, which contains no executable code, 'eval' calls, obfuscation, hardcoded secrets, or malicious patterns.
Updated: 2025-11-30GitHub→
0
0
Low Cost
piotrsobczak-rgb icon

agents-mcp-server

by piotrsobczak-rgb

Sec8

Intelligent agent system for task automation by routing commands to specialized agents based on keywords and context.

Setup Requirements

  • ⚠️Requires Node.js (version >=18.0.0)
  • ⚠️Server runs on `http://localhost:3000` by default; ensure port is available.
Verified SafeView Analysis
The current agent implementations are inert, primarily returning informational messages. If agents were to perform actual system operations (e.g., file writes, shell commands, database queries), significant input sanitization and authorization would be required, as `command` and `context` are directly passed to `agent.execute()`. CORS is enabled for development, which could be a security concern if deployed without stricter policies.
Updated: 2025-11-27GitHub→
0
0
Low Cost
DhiraPT icon

mcp-servers

by DhiraPT

Sec1

Provides server-side logic and functionality, likely related to Minecraft modding or a custom game experience using the Mod Coder Pack.

Review RequiredView Analysis
Critical: Source code was not provided for analysis. Without access to the source code, a comprehensive security audit is impossible. Therefore, the server is considered unsafe to run as potential vulnerabilities (e.g., 'eval' usage, hardcoded secrets, network risks, malicious patterns) cannot be verified.
Updated: 2025-12-03GitHub→
0
0
Medium Cost
marckent04 icon
Sec7

Provides an AI-powered chat interface for document management, enabling users to query, read, edit, and format documents.

Setup Requirements

  • ⚠️Requires Bun runtime (v.. or later)
  • ⚠️Requires Anthropic API Key (Paid)
Verified SafeView Analysis
The `edit_document` tool allows the AI to perform arbitrary string replacements within document content. While an intended feature for document manipulation, this capability could lead to data corruption or alteration of critical information if the AI agent's behavior is not adequately controlled or if malicious prompts are used. No direct code injection vulnerabilities, obfuscation, or hardcoded secrets were identified. The server uses `stdio` for local communication, and the client communicates with an external AI API (Anthropic).
Updated: 2025-12-08GitHub→
PreviousPage 749 of 760Next