Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 3251 to 3300 of 3,335 Grade C entries. Page 66 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/auth.ts:118 this.fetchImpl = opts.fetch ?? ((input, init) => fetch(input, init));Heypcb Mcp (MCP server)
Compatibility: Not stated.
HeyPCB for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
scripts/dev.py:44 result = subprocess.run(cmd, check=False)Image Gen Mcp (MCP server)
Compatibility: Not stated.
**Empowering Universal Image Generation for AI Chatbots**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
setup_uv.sh:5 curl -LsSf https://astral.sh/uv/install.sh | shipybox (MCP server)
Compatibility: Not stated.
<p align="left"> <img src="docs/images/ipybox-crop-nobg.png" alt="ipybox" width="300"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
bench/baselines/common.py:109 result = await session.fetcher.fetch(url)jevcrawl (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:8 preinstalljs (MCP server)
Compatibility: Not stated.
The MCP spec [requires OAuth 2.1 and other RFCs](https://modelcontextprotocol.io/specification/latest/basic/authorization) for auth.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.dagger/main.go:27 WithExec([]string{"sh", "-c", "curl -qsSf https://just.systems/install.sh | bash -s -- --toJust Mcp (MCP server)
Compatibility: Not stated.
> Transform justfiles into AI-accessible automation tools through the Model Context Protocol
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/cursor.yml:33 curl https://cursor.com/install -fsS | bashKafka Mcp Server (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server for Apache Kafka implemented in Go, leveraging [franz-go](https://github.com/twmb/franz-go) and [mcp-go](https://github.com/mark3labs/mcp-go).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/biocontext_kb/core/alphafold/_get_alphafold_info_by_uniprot_id.py:28 response = requests.get(url)Knowledgebase Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server for biomedical research that provides a standardized connection layer between artificial intelligence systems and biomedical resources.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
mcp-servers/lingxing-openapi/deploy/install_tailscale_on_ubuntu.sh:40 curl -fsSL https://tailscale.com/installLingxing Mcp (MCP server)
Compatibility: Not stated.
> **作者**：[Zach](https://github.com/zach22-1999) ｜ 公众号「Zach的进化笔记」 > > 把领星 ERP 的读取能力整理成可复用、可共享、可被 Claude Code / Codex / Cursor 直接调用的只读 MCP 基础设施，重点服务技术型卖家和 AI 协作用户。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED OBFUSCATION_MINIFIED_PAYLOAD
src/get-pat.py:99 r = requests.get(Linux Do Mcp (MCP server)
Compatibility: Not stated.
[中文](README_zh.md) / English
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
Dockerfile:22 RUN curl -fsSL https://deb.nodesource.com/setup_18.x | bash - && \Llama Mcp Streamlit (MCP server)
Compatibility: Not stated.
This project is an interactive AI assistant built with **Streamlit**, **NVIDIA NIM's API (LLaMa 3.3:70b)/Ollama**, and **Model Control Protocol (MCP)**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT SECRETS_PATH_UNCONFIRMED
src/llm_wiki_kit/core/extractors.py:262 # youtube-transcript-api v1.0+ uses instance method .fetch() instead oLlm Wiki Kit (MCP server)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
bin/citation_graph.py:67 with urllib.request.urlopen(req, timeout=15) as resp:Llm Wiki (MCP server)
Compatibility: Not stated.
LLM-powered personal wiki , autonomous knowledge base with research-on-miss, ingestion, search, a browsable web UI, and universal data gravity.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
src/modules/openrouter/index.ts:1220 await fs.unlink(TRACKING_FILE_PATH).catch(() => {});Locallama Mcp (MCP server)
Compatibility: Not stated.
Local-first, provider-neutral Model Context Protocol server for coding-agent workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:313 <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALoAAAC6CAIAAACWbMCmAAADVElEQVR42u3dPXLmaitaiyi (MCP server)
Compatibility: Not stated.
>-
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:9 credentials.jsonMcd Cn Assistant (MCP server)
Compatibility: Not stated.
麦当劳中国官方 MCP 智能助手。当用户提到麦当劳、金拱门、麦乐送、到店取餐、麦咖啡、麦麦省、优惠券、领券、活动日历、麦当劳活动、品牌联名、联名款、联名周边、限定、IP合作、积分、麦麦商城、抽奖、点餐、下单、比价、怎么点最划算、拼单、群点、聚餐点餐、办公室下午茶、夜宵拼单、多人点餐、分摊等，优先使用本 skill。四大能力：①获取最新活动推送（查询当月营销活动日历并摘要推送）；②联名关注推送（盯联名/限定活动：按 config/keywords.json 中的关键词筛选活动并推送，默认关键词「联名」+ 同义词扩展，支持对话增删关键词）；③最优惠点餐（门店
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/mcp_audit_tool/rules/supply_chain.py:66 """MAT-004: curl/wget piped into a shell - arbitrary remote code eMcp Audit Tool (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:17 prepareMcp Config (MCP server)
Compatibility: Not stated.
A CLI tool for managing MCP servers configurations for MCP clients.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
README.md:366 | 79 | 2025‑07‑21 | [CVE‑2025‑53832](cves/CVE-2025-53832.md) | MCP05 - Command Injection & ExecuMcp Cve Project (MCP server)
Compatibility: Not stated.
This repository is a curated index of publicly disclosed **Common Vulnerabilities and Exposures (CVEs)** that touch the **Model Context Protocol (MCP)** ecosystem: official and third-party servers, SDKs, gateways, clients, and integrations where MCP is part of the attack surface
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:17 prepareMcp Duckdb Memory Server (MCP server)
Compatibility: Not stated.
A forked version of [the official Knowledge Graph Memory Server](https://github.com/modelcontextprotocol/servers/tree/main/src/memory).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zqk70rzB0" style="display:none">c9YKEXlDiLMwLYS0+DuAKPA8yPJQS0IrLaOn4XMckllFywYbe1PPyWlgMcp Forge Studio Bridge (MCP server)
Compatibility: Not stated.
**AI-powered scripting, terrain, assets, lighting, and bidirectional project sync for your favorite AI coding assistants.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:2 <html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><style>.DFA7Mcp Game Asset Forge (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
cmd/mcp-launcher/main.go:361 dockerCmd := exec.Command("docker", "build", "-t", "mcp-server-dev", "-f", dockerMcp Launcher (MCP server)
Compatibility: Not stated.
``` go run ./cmd/mcp-launcher https://github.com/browserbase/mcp-server-browserbase -d stagehand ```
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
banner_24fc5.svg:11 @font-face{font-family:"Inter";src:url("data:font/woff2;base64,d09GMgABAAAAADUQABEAAAAAf3AMcp Memory Server (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED OBFUSCATION_ENCODED_BLOB
cmd/mcp-nats/transport_integration_test.go:29 build := exec.Command("go", "build", "-o", out, ".")Mcp Nats (MCP server)
Compatibility: Not stated.
[<img alt="Install in VS Code" src="https://img.shields.io/badge/Install%20in%20VS%20Code-007ACC?style=for-the-badge&logo=visualstudiocode&logoColor=white&labelColor=007ACC&color=white&logoWidth=24&logoPadding=8">](https://insiders.vscode.dev/redirect?url=vscode%3Amcp%2Finstall%3
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
client/Dockerfile:23 RUN curl -LsSf https://astral.sh/uv/install.sh | shMcp Playground (MCP server)
Compatibility: Not stated.
A **Streamlit-based playground** that lets you chat with large language models and seamlessly plug in external **Multi-Server Command Protocol (MCP)** tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
get_d21e14.svg:12 @font-face{font-family:"Inter";src:url("data:font/woff2;base64,d09GMgABAAAAADYEABEAAAAAgLgAAMcp Roblox Profile Lens (MCP server)
Compatibility: Not stated.
> **A companion exploration engine for public Roblox profile landscapes , mapping identities, friendships, achievements, creations, and communities through a single unified surface.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
src/backupPaths.test.ts:33 await fs.rm(root, { recursive: true, force: true });Mcp Server Arangodb (MCP server)
Compatibility: Not stated.
[<img src="./assets/cover.webp" width="420" alt="ArangoDB MCP Server"/>](./assets/cover.webp)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:16 prepareMcp Server Flomo (MCP server)
Compatibility: Not stated.
write notes to Flomo.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV
v0.1/controls/MCP-AUTHZ-03-least-privilege.md:148 subprocess.run(path) # Can execute anythingMcp Server Security Standard (MCP server)
Compatibility: Not stated.
The Model Context Protocol enables AI models to interact with external systems through tools, resources, and prompts.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:38 prepareMcp Server (MCP server)
Compatibility: Not stated.
Build AI voice assistants and phone agents with [Vapi](https://vapi.ai) using the [Model Context Protocol](https://modelcontextprotocol.com/).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
src/lite.ts:42 const res = await fetch(url);mcp (MCP server)
Compatibility: Not stated.
[Русская версия](docs/README.ru.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:16 prepareMcp Vnc (MCP server)
Compatibility: Not stated.
A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction) server that enables AI agents to remotely control Windows, Linux, macOS or anything else that can run a VNC server (don't worry, it's probably fine).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
inst/mcp_app/plot-viewer.html:1 <!DOCTYPE html>MCPR (MCP server)
Compatibility: Not stated.
<!-- README.md is generated from README.Rmd.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
payloads.py:38 '../../../../../../root/.ssh/id_rsa'Mcpwn (MCP server)
Compatibility: Not stated.
<!-- donation:eth:start --> <div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
src/utils/file-operations.js:96 await fs.unlink(filePath);Metabase Ai Assistant (MCP server)
Compatibility: Not stated.
MCP Server for Metabase - 152 tools for dbt metadata sync, reverse lineage exposures, smart question creator, and enterprise BI
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
docs/getting-started.md:140 curl -fsSL https://ollama.com/install.sh | shmie (MCP server)
Compatibility: Not stated.
<p align="center"> <h1 align="center">MIE - Memory Intelligence Engine</h1> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
SKILL.md:52 curl -fsSLO https://raw.githubusercontent.com/Da7-Tech/mind/v7.0.0/mind.pymind (MCP server)
Compatibility: Not stated.
Local project memory with recall, provenance, policy, and dreams.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:16 prepareMoneybird Mcp Server (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that connects AI assistants like Claude to Moneybird accounting software via API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:13 postinstallMoo Tasks (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://raw.githubusercontent.com/dizlexic/moo-tasks/refs/heads/main/app/assets/logo.svg" alt="Moo Tasks Logo" width="160" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/install.sh:4 # Usage: curl -sSL https://raw.githubusercontent.com/0ximu/mu/main/scripts/install.sh | smu (MCP server)
Compatibility: Not stated.
<h1 align="center">MU</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
evals/backtest/data.py:74 resp = httpx.get(url, follow_redirects=True, timeout=60)nfl_mcp (MCP server)
Compatibility: Not stated.
> **Win your draft.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
scripts/smoke.d/23-workspace.sh:156 os.remove(path)Nt8 Mcp (MCP server)
Compatibility: Not stated.
**Let Claude Code (or any MCP client) write, compile, chart-check and backtest your NinjaTrader 8 NinjaScript , by itself.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
skills/cn-stock-market-shanghai-shenzhen/SKILL.md:65 curl -v -X POST "https://agent.deepnlp.org/agent_router"Onekey Gateway (MCP server)
Compatibility: Not stated.
AI Agent Gateway to Commercial APIs, Skills, MCPs and more using just one access key for most benefits.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
core/feature_selectors.go:54 // inline fragments ("global " + "fetch()") keep their word gap.openserp (MCP server)
Compatibility: Not stated.
**OpenSERP** is a free, open-source SERP API and CLI for Google, Yandex, Baidu, Bing, DuckDuckGo, and Ecosia.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
backend/opentester/cli.py:267 _ = subprocess.run(OpenTester (MCP server)
Compatibility: Not stated.
**MCP-First Testing Execution Infrastructure**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
evals/gptzero.py:112 def fetch(_: argparse.Namespace) -> None:Paper Preflight (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.amos689/paper-preflight -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
public_release/benchmarks/entireio_cli_ranking_public60/full60/results/fff/e58e27b1ba0d_r0.json:15 "output": "pgr (MCP server)
Compatibility: Not stated.
`pgr` is an experimental, stateless MCP server for code search, built as part of research into how coding agents search repositories.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
.cursor/rules/isolation_rules/visual-maps/van-mode-map.mdc:588 Invoke-Expression $tool.Command | Out-NullPlatform Context Exporter (MCP server)
Compatibility: Not stated.
Консольное приложение для экспорта информации о контексте платформы 1С:Предприятие (BSL) из файла справки `shcntx_ru.hbk` в форматы JSON, XML, Markdown и `context` для использования с LLM.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
install.sh:5 # curl -fsSL https://raw.githubusercontent.com/jaenster/puppeteer-mcp-claude/main/install.sh | baPuppeteer Mcp Claude (MCP server)
Compatibility: Not stated.
<p align="center"> <img src=".github/banner.svg" alt="puppeteer-mcp-claude , browser automation MCP server for Claude" width="100%"/> </p>
This grade is a hygiene screen, not proof of safety.
