Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 601 to 650 of 1,860 MCP, Grade C entries. Page 13 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/device-flow.ts:188 response = await this.fetch(`${this.apiBaseUrl}/api/mcp/install/start`, {Pixapi (MCP server)
Compatibility: Not stated.
Use Pixapi image and video generation tools from MCP clients.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
plugin/hooks/plexarm_credential.py:192 completed = subprocess.run( # noqa: S603 - absolute path, no shell, fixPlexarm (MCP server)
Compatibility: Not stated.
The operating system for self-organised AI agent teams.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
ai-agents/apollo.io/apolloio_mcp_tool.py:99 subprocess.run(plumoai (MCP server)
Compatibility: Not stated.
<img width="1024" height="388" alt="PlumoAIlogo" src="https://github.com/user-attachments/assets/43d692bd-912c-44eb-b13b-0a2ed0a1ce6e" />
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:10 preinstallPostman Mcp Server (MCP server)
Compatibility: Not stated.
Postman MCP Server , connect AI agents (Claude Code, Cursor, VS Code Copilot, Gemini CLI) to your Postman collections, OpenAPI specs, and environments via Model Context Protocol (MCP)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:16 preparePostproxy (MCP server)
Compatibility: Not stated.
MCP (Model Context Protocol) server for integrating [Postproxy](https://postproxy.dev/) API with Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/tools/upload_media.ts:62 await axios.put(url, buffer, {PostPulse (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that connects AI assistants to [PostPulse](https://post-pulse.com) , a social media management platform.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
cmd/completion.go:64 PS> pplx completion powershell | Out-String | Invoke-Expressionpplx (MCP server)
Compatibility: Not stated.
It's an unofficial CLI program to query/chat with the [perplexity API](https://www.perplexity.ai/).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
scripts/benchmark.js:35 await fs.rm(temp,{recursive:true,force:true});PREFLIGHT URL Routing for AI Agents (MCP server)
Compatibility: Not stated.
**Before your AI agent visits a URL, ask us how to get there.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
docs/RUNTIME_EVIDENCE.md:163 configuration. Bourne does not parse or reimplement `~/.ssh/config`.Project Bourne (MCP server)
Compatibility: Not stated.
Project Bourne is open-source execution and provenance infrastructure for reproducible scientific and engineering workloads.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
memory_module/cli.py:58 run=subprocess.run(python_args('memory_module.cli')+['servProject Memory (MCP server)
Compatibility: Not stated.
Project Memory keeps the plan, the evidence, the decisions, the outcomes and the accepted lessons of one project in a local SQLite database.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
src/mcp_server_pronunciation/recorder.py:136 return subprocess.run(Pronunciation & Voice Coach (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.JuhongPark/pronunciation -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:34 prepareProton Mail Bridge Client (MCP server)
Compatibility: Not stated.
``` ____ ____ ___ _____ ___ _ _ __ __ _ ___ _ | _ \| _ \ / _ \_ _/ _ \| \ | | | \/ | / \ |_ _| | | |_) | |_) | | | || || | | | \| | | |\/| | / _ \ | || | | __/| _ <| |_| || || |_| | |\ | | | | |/ ___ \ | || |___ |_| |_| \_\\___/ |_| \___/|_| \_| |_| |_/_/ \_\___|_____| Bridge Cli
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
scripts/construction-contract-validate.cjs:365 if (fs.existsSync(outPath)) fs.unlinkSync(outPath);Provar MCP Server (MCP server)
Compatibility: Not stated.
The Provar DX CLI is a Salesforce CLI plugin for Provar customers who want to automate the execution of tests using Provar Automation, and the reporting of test results and other quality-related metrics to Provar Quality Hub.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
scripts/check_pypi_publication.py:20 def fetch(url: str) -> bytes:Proxmoxmcp Plus (MCP server)
Compatibility: Not stated.
Use MCP and OpenAPI to safely control Proxmox VE VMs, LXCs, backups, and snapshots from LLMs and AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
python/publicbrowser/client.py:133 with urllib.request.urlopen(req, timeout=timeout) as resp:Public Browser (MCP server)
Compatibility: Not stated.
Lets Claude Code, Cursor and any MCP client drive Chrome.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
scripts/build-preview.mjs:12 _confirmed==='on'};const response=await fetch('/api/v2/research/feedback',{methodRasczak Knowledge Commons (MCP server)
Compatibility: Not stated.
Ten free, source-linked decision methods, three optional decision packs, REST, static pages, a stateless MCP endpoint, and an offline Agent Skill.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
scripts/build_windows.py:10 subprocess.run([rawmem (MCP server)
Compatibility: Not stated.
[English](README.md) | [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
reaper_mcp/reaper_client.py:69 os.remove(entry.path)Reaper Mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.xDarkzx/reaper-mcp --> <h1 align="center">ReaperMCP</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:58 prepareRebuild Dossier (MCP server)
Compatibility: Not stated.
An MCP server that reverse-engineers a trustworthy **rebuild spec** , a locked `CLAUDE.md`, `.claude/` config, and a mutation-tested test suite , out of an existing app, so any coding agent can rebuild it cleanly against that spec instead of guessing.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
src/server.js:16 ipt>async function load(){const r=await fetch('/v1/activity');const d=await r.json();rRECOVER Decide Safely After a Failed Machine Action (MCP server)
Compatibility: Not stated.
**A failed machine action happened.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
functions/brc-edu-resource-processor/src/brcEduYouTubeSyncTimer.ts:28 const response = await fetch(endpoint, {Red by Big Red Cloud (MCP server)
Compatibility: Not stated.
Red is an open-source [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that connects AI assistants and MCP clients to [Big Red Cloud](https://www.bigredcloud.com) accounting data through a set of controlled MCP tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/tools.ts:303 const put = await fetch(slot.uploadUrl, {Reel Estate MCP (MCP server)
Compatibility: Not stated.
**Turn real-estate listing photos into cinematic property videos from your AI assistant.** `reel-estate-mcp` is a [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server that connects **Claude, Cursor, and other AI assistants** to your [**Reel Estate**](https://try
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
scripts/release_workflow.py:49 result = subprocess.run(reflect (MCP server)
Compatibility: Not stated.
<p align="center"> <a href="https://reflect.o11y.dev/"> <img src="docs/favicon.svg" width="72" height="72" alt="Reflect logo"> </a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST OBFUSCATION_MINIFIED_PAYLOAD
stdio.mjs:29 const res = await worker.fetch(req, env, ctx);Regulatory Intel MCP (MCP server)
Compatibility: Not stated.
US Federal Register for AI agents: rules, notices, executive orders, agency lookup.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
remarkable_mcp/extract.py:2277 response = requests.post(url, json=payload, timeout=60)reMarkable MCP Server (MCP server)
Compatibility: Not stated.
>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
install.sh:43 for cmd in curl tar awk sed; doremindb (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/logo.png" alt="remindb logo" width="400" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/index-readiness.mjs:32 const response = await fetch(`${origin}${path}`, {RepoRelay (MCP server)
Compatibility: Not stated.
<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="docs/assets/reporelay-logo-dark.png"> <img src="docs/assets/reporelay-logo.png" width="440" alt="RepoRelay"> </picture> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
requirements.txt:1 mcp>=1.0.0Report Needs MCP Server (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.JarvisOnM4/report-needs -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
cli/e2e/helpers/cli-runner.ts:36 fs.rmSync(_tempHome, { recursive: true, force: true });reshapr (MCP server)
Compatibility: Not stated.
[**Website**](https://reshapr.io/) | [**About**](https://reshapr.io/about) | [**Docs**](https://reshapr.io/docs/) | [**Blog**](https://reshapr.io/blog) | [**Community**](https://reshapr.io/community)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
requirements.txt:2 mcp>=1.0.0revula (MCP server)
Compatibility: Not stated.
**Production-grade MCP server for universal reverse engineering automation.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:40 prepareRis Mcp Ts (MCP server)
Compatibility: Not stated.
An [MCP (Model Context Protocol)](https://modelcontextprotocol.io/) server that gives AI assistants access to Austria's official legal database , the **Rechtsinformationssystem (RIS)**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED SECRETS_PATH_UNCONFIRMED OBFUSCATION_MINIFIED_PAYLOAD
package.json:3 terserRod Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
endpoint/rest/rest_test.go:730 code, body := fetch("http://" + addr + "/static/index.html")rulego (MCP server)
Compatibility: Not stated.
⛓️RuleGo is a lightweight, high-performance, embedded, next-generation component orchestration rule engine framework for Go.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
scripts/check-registry-version.py:21 with urllib.request.urlopen(REGISTRY + query, timeout=20) as r:RuSender (MCP server)
Compatibility: Not stated.
Управление email-рассылками RuSender из ассистента: статистика кампаний, база контактов, сегменты, A/B-тесты, домены и доставляемость.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
scripts/generate-docs.py:28 subprocess.run(["cargo", "build", "--release"], check=True)Rust Mcp Server (MCP server)
Compatibility: Not stated.
`rust-mcp-server` is a server that implements the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
src/sac/cli.py:349 shutil.rmtree(skill_dir)SaC Software as Content (MCP server)
Compatibility: Not stated.
Give your AI agent the ability to respond with live, interactive apps that evolve.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:29 prepareSafari DevTools MCP (MCP server)
Compatibility: Not stated.
`safari-devtools-mcp` lets your coding agent (such as Claude, Cursor, Copilot or Gemini) control and inspect a live Safari browser on macOS.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/create_demo_video_assets.py:26 proc = subprocess.run(SAGE Wrapper (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.PsYcGoD/sage -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
package.json:17 prepareSamsara MCP (MCP server)
Compatibility: Not stated.
> **Complete Samsara Fleet Management integration for Claude AI** > 21 tools | Expert knowledge built-in | Beta
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
e2e/tls_test.go:69 cmd := exec.CommandContext(t.Context(), bin, "run", "--config", configPath)sandbox (MCP server)
Compatibility: Not stated.
MicroVM sandboxes for AI agents, built on [cocoon](https://github.com/cocoonstack/cocoon): a fast-boot guest stack, an in-guest product daemon, a per-node control plane with warm pools, and SDKs for Go and Python.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
scripts/schema-sync.mjs:75 const res = await fetch(`${BASE}${path}`, { headers });Scholar Feed (MCP server)
Compatibility: Not stated.
Search 600,000+ CS/AI/ML papers with LLM novelty analysis, citation graph, full-text extraction, and BibTeX, without leaving Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
benchmarks/run_benchmark.py:52 "os.system() call",Scout Security (MCP server)
Compatibility: Not stated.
Deterministic security scanner for AI-assisted coding.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:29 prepareScrapingdog (MCP server)
Compatibility: Not stated.
A [Model Context Protocol](https://modelcontextprotocol.io) server that exposes the [Scrapingdog](https://www.scrapingdog.com) web-scraping and SERP APIs as tools any MCP-compatible client (Claude Desktop, Claude Code, Cursor, etc.) can call.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
semhood/client.py:98 subprocess.Popen(cmd, **kwargs)semhood (MCP server)
Compatibility: Not stated.
Use semantic code search before reading files.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
docs/pay/button.js:34 return fetch(API_BASE + '/v1/checkout/invoices', {Seneschal Data (MCP server)
Compatibility: Not stated.
Free, public REST + [Model Context Protocol](https://modelcontextprotocol.io) server exposing real-time and historical DeFi liquidation telemetry for Aave, Morpho, Spark and Compound on Ethereum mainnet, plus block-builder market share data from the operator's own slot-by-slot sh
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/seo_mcp/cli.py:155 with urllib.request.urlopen(req, timeout=15) as resp: # noqa: S310 (trusted user URL)Seo Monster (MCP server)
Compatibility: Not stated.
SEOMonster: a local, user-credential-driven MCP server for SEO workflows over Google Search Console, GA4, PageSpeed Insights, and Cloudflare.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
CSDN-宣传稿.md:115 "OPS_SSH_KEY": "~/.ssh/id_rsa"Server Ops MCP (MCP server)
Compatibility: Not stated.
**English** | [简体中文](./README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED SECRETS_PATH_CREDENTIAL +1 more
scripts/security_sanitizer.py:167 result = subprocess.run(Servicenow Api (MCP server)
Compatibility: Not stated.
*Version: 2.2.0*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
src/shelfmark/refresh.py:151 shutil.rmtree(self.dir)Shelfmark (MCP server)
Compatibility: Not stated.
**Give AI agents the right context, not your entire filesystem.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:26 prepareShopify Admin MCP (MCP server)
Compatibility: Not stated.
MCP server for the Shopify Admin API (GraphQL): products, orders, customers, inventory and discounts for AI agents.
This grade is a hygiene screen, not proof of safety.
