Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1101 to 1150 of 1,860 MCP, Grade C entries. Page 23 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/deploy.sh:20 curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \io.github.bitsandtea/postking-mcp (MCP server)
Compatibility: Not stated.
The official [Model Context Protocol](https://modelcontextprotocol.io) server for [PostKing](https://postking.app) , an AI-powered content platform for social media scheduling, blog publishing, and brand management.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:15 prepareio.github.bluwork/mongo-scout-mcp (MCP server)
Compatibility: Not stated.
Scout your MongoDB databases with AI - A production-ready Model Context Protocol server with built-in safety features, live monitoring, and data quality tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:15 prepareio.github.bluwork/postgres-scout-mcp (MCP server)
Compatibility: Not stated.
Scout your PostgreSQL databases with AI - A production-ready Model Context Protocol server with built-in safety features, monitoring, and data quality tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
apps/docs/src/components/ai/page-actions.tsx:32 "text/plain": fetch(markdownUrl).then(async (res) => {io.github.bobybarack/sovseal-memory (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="./brand/sovseal/social/github-banner.png" alt="sovseal , AI memory that never leaves your machine"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:21 prepareio.github.boostuagency/boostu-teamleader-mcp (MCP server)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:34 prepareio.github.bounded-systems/bounded-tools-mcp (MCP server)
Compatibility: Not stated.
A **local, read-only [MCP](https://modelcontextprotocol.io) server** (and a matching CLI) over [bounded.tools](https://bounded.tools)' **signed static API**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:34 prepareio.github.bounded-systems/site-mcp (MCP server)
Compatibility: Not stated.
A **local, read-only [MCP](https://modelcontextprotocol.io) server** (and a matching CLI) over [robertdelanghe.dev](https://robertdelanghe.dev)'s **signed static API**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
benchmark.py:57 with urllib.request.urlopen(req, timeout=15) as resp:io.github.brownglasses/dotplot-mcp (MCP server)
Compatibility: Not stated.
> See individual users, not aggregate charts.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
provider/runcmd.go:23 cmd := exec.CommandContext(ctx, bin, args...)io.github.bryanjbelanger/desktop-hypervisor-mcp (MCP server)
Compatibility: Not stated.
One provider-neutral MCP server for the desktop hypervisors: **VirtualBox**, **VMware Fusion**, and **VMware Workstation**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
main.go:47 cmd := exec.CommandContext(ctx, bin, args...)io.github.bryanjbelanger/talos-mcp-server (MCP server)
Compatibility: Not stated.
A Model Context Protocol server for [Talos Linux](https://www.talos.dev) cluster operations , one thin tool, typed actions, zero runtime dependencies.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
app/honest_delivery_refusal.py:219 curl = remedy.get("contact_url")Kairos Relationship Memory (MCP server)
Compatibility: Not stated.
Service HTTP et MCP **x402** sur **https://x402.agentindex.world** , **services payants uniquement**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.harness/orgs/default/projects/laravel_mcp_companion/pipelines/ci.yaml:53 curl -LsSf --retry 3 --retry-delay 2Laravel MCP Companion (MCP server)
Compatibility: Not stated.
*formerly Laravel Docs MCP Server*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
linear_mcp/linear_exec.py:328 proc = subprocess.run(Linear MCP (multi-workspace, PAT auth) (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.adelaidasofia/linear-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
finance_mcp/keychain.py:33 proc = subprocess.run(Local-first personal finance MCP (MCP server)
Compatibility: Not stated.
Local-first personal finance MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
applescript_send.py:163 proc = subprocess.run(macOS-only MCP server that exposes iMessage chat (MCP server)
Compatibility: Not stated.
macOS-only MCP server that exposes iMessage history to Claude and exports per-chat conversations into an Obsidian vault.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED OBFUSCATION_MINIFIED_PAYLOAD
bench/worker-intelligence.mjs:13 const mf = new Miniflare({ modules: true, script: 'export default {fetch(){reMail Index (MCP server)
Compatibility: Not stated.
mail-index downloads a **preview of your whole inbox** to your machine, then smartly fetches the full text of the messages that matter as you use it.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
MCP Browser/Storage/ActionLog.swift:72 const r = await fetch(endpoint, {MCP Browser (MCP server)
Compatibility: Not stated.
A native macOS web browser that exposes itself as a [Model Context Protocol](https://modelcontextprotocol.io) server, so AI agents can drive a real WKWebView the same way a person would , navigate, click, fill forms, read the DOM, take screenshots, run JavaScript, and capture ne
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/opencode.yaml:43 curl -fsSL https://opencode.ai/install | bashMCP Server for Binge-watch (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.aahl/mcp-vods -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV +1 more
src/utils/audio.ts:53 fs.unlinkSync(tempFile);Minimax Mcp Js (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/services/webhooks.ts:174 // Default to the global fetch (Node 20+). Bound so `this` is preserved.Mob (MCP server)
Compatibility: Not stated.
<h1><img src="docs/assets/logo.png" alt="Mob" height="64"></h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:53 preparemulewatch (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="https://raw.githubusercontent.com/brbousnguar/mulewatch/main/docs/logo.png" width="72" alt="mulewatch" /> <h1>mulewatch</h1> <p><strong>Read-only observability for MuleSoft Anypoint Platform, over MCP.</strong><br/>Application logs, historical archi
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
accounts.py:176 subprocess.run(Multi-account MCP for Gmail, Calendar, Drive, Docs, and Sheets 61 tools, token (MCP server)
Compatibility: Not stated.
Multi-account, token-efficient MCP for Gmail + Calendar + Drive + Docs + Sheets.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
evaluations/mvr-bench-selection-v0.1/run_openai_selection_track.py:120 with urllib.request.urlopen(request, tiMVR API - Minimum Viable Relationships (MCP server)
Compatibility: Not stated.
**Listed in MCP Registry + Glama + RapidAPI, anchored by DOI, and callable through OpenAPI/MCP.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST
ops/editorial-sync/editorial_sync.py:315 first = json.loads(fetch(cfg.origin + "/api/v1/health"))my quant doesn’t speak english editorial discovery (MCP server)
Compatibility: Not stated.
The public editorial and advertising front door for the Liquidity Lab family: Seiche, LiquiLens, and LiquiLens, Undertow.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
scripts/installed_smoke.py:25 mcp_output = subprocess.run(OmniGlyph (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.aidi1723/omniglyph -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/release_checklist.py:31 p = subprocess.run(resolved, cwd=ROOT, capture_output=True, text=True, check=Fpgops (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.arzharch/pgops-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
src/config.test.ts:21 await fs.rm(tmpHome, { recursive: true, force: true });PushEngage (MCP server)
Compatibility: Not stated.
> Manage your [PushEngage](https://www.pushengage.com/) account from any AI assistant, in plain language.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
scripts/gen_site_stats.py:45 result = subprocess.run(Qdrant MCP (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.avaazquezz/mcp-qdrant -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.devcontainer/Dockerfile:23 RUN curl -fsSL https://aka.ms/install-azd.sh | bashRemote Mcp Functions Python (MCP server)
Compatibility: Not stated.
<!-- --- name: Remote MCP with Azure Functions (Python) description: Run a remote MCP server on Azure functions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
claudable_helper/services/filesystem.py:13 subprocess.run(["git", "init"], cwd=repo_path, check=True)roundtable (MCP server)
Compatibility: Not stated.
Stop copy-pasting between AI models.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
src/rubit_mcp_mail/claude_registration.py:38 result = subprocess.run(Rubit Mcp Mail (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.bgalmes/rubit-mcp-mail -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:39 prepareSalesforce Cloud (MCP server)
Compatibility: Not stated.
This MCP (Model Context Protocol) server provides AI-powered tools for interacting with Salesforce, featuring opportunity intelligence, conversation analysis, business case generation, and standard CRUD operations.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
server.js:26 [/(^|\/)(id_rsa|id_ed25519|id_ecdsa)$/, "SSH private key"],Secret Scan (MCP server)
Compatibility: Not stated.
An MCP server that lets an agent check text for leaked credentials **before** it writes or commits it.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
github_mcp/client.py:41 result = subprocess.run(Self-hosted GitHub MCP server (MCP server)
Compatibility: Not stated.
Self-hosted GitHub MCP server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED SECRETS_PATH_DOTENV
package.json:14 prepareServer Google News (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/api-client.ts:364 response = await fetch(`${this.baseUrl}${path}`, {Share Artifacts (MCP server)
Compatibility: Not stated.
Publish HTML reports, explainers, and presentations to shareable URLs, then update them in place and control access.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
lib/aso_offstore_mine.py:223 subprocess.run(ShipASO (MCP server)
Compatibility: Not stated.
ShipASO , the AI-native ASO loop for App Store AND Google Play.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
apps/worker/src/crawl.ts:197 res = await fetch(current, {Site Spec (MCP server)
Compatibility: Not stated.
> **The invisible foundation your website is missing.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:15 prepareSMSPM MCP Server (MCP server)
Compatibility: Not stated.
> MCP server for the [SMSPM](https://smspm.com) SMS API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
deploy/cloudflare-worker.js:11 async fetch(request, env) {Social Perks (MCP server)
Compatibility: Not stated.
**The Marketing Value Protocol** , AI-powered marketing infrastructure for every business.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
examples/x402-demo.ts:278 const res = await fetch(`${cfg.horizonUrl}/accounts/${account}`);Stellar Agent Search (MCP server)
Compatibility: Not stated.
> **A read-only discovery layer on top of the [stellar-8004](https://stellar8004.com) registry , the ERC-8004-style Identity/Reputation/Validation contracts on Stellar mainnet.** > It adds no contracts and forks nothing: it exposes the existing on-chain registry to MCP clients,
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
dev.py:39 return subprocess.call(cmd, cwd=ROOT, env=_env())Talamus (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.ampres-ai/talamus -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/publish.yml:25 curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -yTerminal MCP Server (MCP server)
Compatibility: Not stated.
MCP server enabling AI agents to interact with terminal applications through structured Terminal State Tree representation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
package.json:24 postinstallThoth (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/install.sh:12 # curl -fsSL https://cli.tigerdata.com | shTiger Cli (MCP server)
Compatibility: Not stated.
Tiger CLI is the command-line interface for Tiger Cloud.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/browser-issue-guard.mjs:168 fs.rmSync(tempDir, { recursive: true, force: true });TokenTrace (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/tokentrace-logo.svg" alt="TokenTrace logo" width="96" height="96"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:165 credentials.jsonU2 MCP Server (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.bpamiri/u2-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
extension/extension.js:55 const r = http.request({ host: '127.0.0.1', port: p, path: '/state', method: 'GET',uisight (MCP server)
Compatibility: Not stated.
**Your AI can already see the screen.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:45 prepareUseqr Mcp (MCP server)
Compatibility: Not stated.
Static QR PNG/SVG for agents, plus a link to the UseQR designer.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
README.md:85 proc = subprocess.Popen(['./target/release/vlk-core'],Vlk MemAct (MCP server)
Compatibility: Not stated.
Vlk² gives AI agents a sense of time: what's happening now (PRESENT), what's already been tried (PAST), and what should guide future decisions (FUTURE).
This grade is a hygiene screen, not proof of safety.
