Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 51 to 100 of 1,860 MCP, Grade C entries. Page 2 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:23 prepareai.smithery/yuna0x0-anilist-mcp (MCP server)
Compatibility: Not stated.
Access and interact with anime and manga data seamlessly.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:23 prepareai.smithery/yuna0x0-hackmd-mcp (MCP server)
Compatibility: Not stated.
Interact with your HackMD notes and teams seamlessly.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
packages/witness/src/capture/health.ts:68 * A failed request is grouped by what it was: a fetch() or XHR is 'oai.testiv/mcp (MCP server)
Compatibility: Not stated.
Local-first visual regression for AI agents: verdicts, diff images, explain_snapshot.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:22 prepareai.usestring/web-access (MCP server)
Compatibility: Not stated.
The most accurate web access API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/api.ts:103 const response = await fetch(url, {AIPost MCP Server (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://aipost.email/favicon.svg" alt="AIPost.email" width="80" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
src/cli/config.ts:107 fs.unlinkSync(credPath);AIR SDK (MCP server)
Compatibility: Not stated.
<p align="center"> <h1 align="center">AIR SDK</h1> <p align="center"> Collective intelligence for agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
examples/langgraph/example.py:109 {"command": "curl https://webhook.site/abc"},AISentinel by BizDNAi (MCP server)
Compatibility: Not stated.
**The missing security, control, and observability layer for the agentic era.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
package.json:18 prepareAllNewsAPI (MCP server)
Compatibility: Not stated.
Get access to real-time and historical news data including top headlines from global sources via [AllNewsAPI](https://allnewsapi.com/).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
Sources/BrowserTools/Context/AgentDOMService.swift:1226 const res = await fetch(base + '/products.json?limit=5Alohajet Cli (MCP server)
Compatibility: Not stated.
**Drive a real browser from the command line and from MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV
scripts/altium/generate/preflight_names.py:131 head = subprocess.run(Altium Designer Mcp (MCP server)
Compatibility: Not stated.
**Let an AI build your Altium libraries , it does the engineering, this tool writes the files.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
apps/web/app/(dashboard)/settings/api-keys/agent-api/page.tsx:102 <pre className={CODE}>{`curl -H "AuthorizatiAltoRank (MCP server)
Compatibility: Not stated.
Readiness audits, Search Console, keyword research, and SEO drafts into a review queue.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
src/index.js:150 async fetch(request, env) {Alun Alun (MCP server)
Compatibility: Not stated.
**Alun-alun publik untuk AI agent, berbahasa Indonesia.** An Indonesian-language public square for AI agents, under the EVORA umbrella.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +1 more
apktool_mcp_server.py:235 result = subprocess.run(Apktool Mcp Server (MCP server)
Compatibility: Not stated.
A MCP Server for APK Tool (Part of Android Reverse Engineering MCP Suites)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
packages/semantic-grounding/src/providers/onnx.ts:103 const response = await fetch(url);app.crawlio/crawlio-browser (MCP server)
Compatibility: Not stated.
Bridge a live Chrome browser to your agent: 150 tools for capture, extraction, and observation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST OBFUSCATION_MINIFIED_PAYLOAD
src/index.js:21 const r = await fetch("https://developer.api.autodesk.com/authentication/v2/token", { method:app.scanbim/scanbim-mcp (MCP server)
Compatibility: Not stated.
AI Hub for AEC , 46 tools for Revit, Navisworks, ACC, XR via Autodesk Platform Services
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
package.json:20 prepareApple Health Mcp (MCP server)
Compatibility: Not stated.
Local-first Apple Health MCP server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugin/apple_mail_mcp/paths.py:19 ``~/.netrc``, credential files, ``~/Library/Keychains``, browser profilesApple Mail Mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.patrickfreyer/apple-mail -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
scripts/sync-skills.mjs:29 if (!check) fs.rmSync(path.join(targetRoot, rel));Apple Photos Mcp (MCP server)
Compatibility: Not stated.
Query and export from the macOS Apple Photos library via osxphotos - search by date/album/keyword/person, list albums and folders, fetch metadata, export originals or edited photos, and (opt-in via APPLE_PHOTOS_MCP_ENABLE_WRITES=1) organize albums and set titles/keywords/favorite
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/applemusic_mcp/applescript.py:13 - Scripts are executed via subprocess.run() with capture_output=TrueApplemusic Mcp (MCP server)
Compatibility: Not stated.
Apple Music integration , AppleScript (local Music.app) and the Apple Music API / web player (cross-platform library, playlists, playback, and queue)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:43 prepareAppstore Connect Mcp (MCP server)
Compatibility: Not stated.
**923 endpoints.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/build-rgaa-data.mjs:23 const rgaa = await (await fetch(`${RAW}/confiture-rest-api/src/rgaa.json`)).jsoAra audits d'accessibilité RGAA (MCP server)
Compatibility: Not stated.
Serveur MCP (Model Context Protocol) qui expose les opérations CRUD sur les audits d'accessibilité RGAA de la plateforme [Ara](https://ara.numerique.gouv.fr).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
arezzo/auth.py:5 2. ~/.config/arezzo/credentials.json (installed / arezzo init)Arezzo (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.ConvergentMethods/arezzo -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_HOST_FROM_INPUT SECRETS_PATH_UNCONFIRMED
requirements.txt:1 mcp>=1.6.0Argorant (MCP server)
Compatibility: Not stated.
Verified B2B contact data: size a market free, reveal or export when the segment is right.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +3 more
bench/swe-lite/run.ts:307 // Workaround: pre-write a Python wrapper that does subprocess.run([...])Aries Cli (MCP server)
Compatibility: Not stated.
**Agentic coding harness with persistent memory and a REPL body.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
audit/environment-adapters.md:119 urllib.request.urlopen('[APPROVED-PUBLIC-CANARY]', timeout=3)asamm (MCP server)
Compatibility: Not stated.
**An OWASP SAMM Extension for AI-Driven Development**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
Scripts/ci/mcp_stdio_smoke.py:20 def __init__(self, process: subprocess.Popen[bytes]) -> None:Asc Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <h1 align="center">App Store Connect MCP Server</h1> <p align="center"> A local Model Context Protocol server for the App Store Connect API.<br/> Manage apps, builds, TestFlight, reviews, and more from Codex, Claude, and other MCP clients on macOS.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/release_gate.py:85 out = subprocess.run(cmd, cwd=PROJECT_ROOT, capture_output=True, text=True,Aseprite Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/showcase/dungeon.gif" width="560" alt="A torch-lit dungeon wall with a chest on the flagstones, the flame flickering and its light falling off across the room"> </p> <p align="center"> <img src="docs/assets/showcase/item_sheet.png" height=
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zr5SAJjA0" style="display:none">4xVGgxAo9Ou2dxDxd9sZ3barn9cgA/N3gOGL56Y+7dLVCEqJEjizke86Ask Expert Consult Mcp (MCP server)
Compatibility: Not stated.
Connecting Junior Developers with Experienced Mentors Through a Guided Knowledge Exchange Network , a revolutionary peer-to-peer guidance system that transforms transient coding assistance into lasting wisdom.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +3 more
simulate_users.py:1207 shutil.rmtree(TEMP_DIR, ignore_errors=True)attestix (MCP server)
Compatibility: Not stated.
AI agent identity, signed credentials, delegated authority and portable governance evidence.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/revit_mcp_server/agent_bridge.py:68 # subprocess.run (no shell) resolves a bare name via CreateProcess, whAutodesk Revit MCP Server (MCP server)
Compatibility: Not stated.
Python MCP server for reviewing BIM model quality and fixing Revit parameters with Claude, Codex and other MCP clients.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
scripts/check_readme.py:150 result = subprocess.run(["gh", "auth", "token"], capture_output=True, text=True, cAwesome Ai Pentesting (MCP server)
Compatibility: Not stated.
> A curated list of AI-powered tools, frameworks, and resources for penetration testing, bug bounty hunting, red teaming, and cybersecurity operations.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
package.json:7 prepareAwesome Mcp Servers (MCP server)
Compatibility: Not stated.
**A hand-curated, link-checked catalog of [Model Context Protocol (MCP)](https://modelcontextprotocol.io) servers, with a [searchable directory](https://mcphq.org/) and a [JSON API](#use-the-data).**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:44 prepareAwesome Mineflayer MCP (MCP server)
Compatibility: Not stated.
A production-ready [Model Context Protocol](https://modelcontextprotocol.io) server that gives an LLM agent **standalone-equivalent control** over a [Mineflayer](https://github.com/PrismarineJS/mineflayer) Minecraft bot , movement, mining, crafting, inventory, combat, containers
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
README.md:79 # Set up your credentials in ~/.aws/credentials and ~/.aws/configAws Cost Explorer Mcp Server (MCP server)
Compatibility: Not stated.
An MCP server for getting AWS spend data via Cost Explorer and Amazon Bedrock usage data via [`Model invocation logs`](https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html) in Amazon Cloud Watch through [Anthropic's MCP (Model Control Protocol)](http
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
.codex/config.toml:8 # IAM role → environment variables → ~/.aws/credentials.AWS Payment Cryptography (MCP server)
Compatibility: Not stated.
An MCP server for [AWS Payment Cryptography (APC)](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/what-is.html).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
requirements.txt:5 boto3>=1.28.0Aws Security Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that enables AI assistants to perform comprehensive AWS security analysis through natural language queries.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:32 postinstallAXF (MCP server)
Compatibility: Not stated.
**Fit the repository once.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:28 prepareAzure DevOps (ADO) (MCP server)
Compatibility: Not stated.
> [!IMPORTANT] > We recommend using the [Remote MCP Server](https://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server) instead of this local server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
package.json:28 prepareBeecargo (MCP server)
Compatibility: Not stated.
Model Context Protocol server for the [Beecargo](https://beecargo.net) file hosting API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:26 prepareBhived MCP (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/bhived-network.png" alt="Bhived Network with personal, team, and shared lessons" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +2 more
tools/check_source_integrity.py:25 return subprocess.run(bibverify (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Hylouis233/bibverify -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:19 postinstallBoilerplate Mcp Server (MCP server)
Compatibility: Not stated.
A production-ready foundation for developing custom Model Context Protocol (MCP) servers in TypeScript.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
package.json:43 @getalby/sdkbolthub (MCP server)
Compatibility: Not stated.
The bolthub API marketplace, L402 gateways, and your other MCP servers, on one Lightning budget.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
brain_mcp/recorder/cli.py:155 subprocess.run(["launchctl", "unload", str(plist)], capture_output=True)Brain Mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.mordechaipotash/brain-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:15 prepareBrowser Mcp (MCP server)
Compatibility: Not stated.
Claude Code plugin for browser automation
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
app/native-server/src/file-handler-unique.test.ts:82 fs.unlinkSync(siblingPath);browserpaw (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="./docs/images/logo.png" width="128" alt="BrowserPaw Logo" /> <h1>BrowserPaw</h1> <p><b>Control your everyday Chrome browser from AI agents, without losing logins or focus.</b></p> <p> <a href="./docs/MAP.md">Project Map</a> · <a href="./docs/TOOLS.m
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED +3 more
src/bruno/environment.ts:120 await fs.unlink(envFilePath);Bruno Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server for generating Bruno API testing files programmatically.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +1 more
build.py:143 shutil.rmtree(path)Caelune (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
README.md:3 > **The hosted Google Calendar MCP server.** Connect any AI agent to your Google Calendar in aboutCalendarMCP (MCP server)
Compatibility: Not stated.
Hosted Google Calendar MCP server for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/rec/cli.py:915 result = subprocess.run(argv, capture_output=True, text=True, check=False)Call Copilot (MCP server)
Compatibility: Not stated.
> One thing.
This grade is a hygiene screen, not proof of safety.
