Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1151 to 1200 of 1,860 MCP, Grade C entries. Page 24 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
.agents/skills/tdd/mocking.md:44 getUser: (id) => fetch(`/users/${id}`),WebReaper (MCP server)
Compatibility: Not stated.
AI-native web scraper.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED SECRETS_PATH_CREDENTIAL
src/tools/utils.py:87 os.remove(tmp_path)Zendriver MCP (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.bituq/zendriver-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
afterpaths/cli.py:1712 result = subprocess.run(Afterpaths (MCP server)
Compatibility: Not stated.
**Smarter with every session, automatically.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
arnes/llm/ollama.py:302 "Install with: curl -fsSL https://ollama.com/install.sh | sh && ollama pull llama3.2"Agentic Harness (MCP server)
Compatibility: Not stated.
<!-- Social preview metadata.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
core/console.py:14 with urllib.request.urlopen(req,timeout=20) as response: return json.load(response)Agentic Team Mcp (MCP server)
Compatibility: Not stated.
*Live interactive Web Studio floor visualization showing Root Watchdog supervision, hierarchical reporting trees, and dynamic agent collaboration links.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_HOST_FROM_INPUT +2 more
agentline/static/agentline_relay.py:115 subprocess.run(_runtime_command(config, "gateway", "install", "--forceAgentLine (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="agentline-logo-200.png" alt="AgentLine Logo" width="120" /> <h1>AgentLine , Phone API for AI Voice Agents</h1> <p><strong>Open-source AI phone agent platform , real phone numbers, outbound & inbound voice calls, SMS, MCP, and IVR</strong></p> <p>G
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
README.md:110 curl -fsSL https://bun.sh/install | bashAha.io (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that provides seamless integration with Aha.io's product management platform.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
packages/cm360-mcp/scripts/generate-types.ts:328 await fs.unlink(SPEC_PATH);Amazon DSP MCP Server (MCP server)
Compatibility: Not stated.
Self-hostable MCP connectors for major advertising platforms.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
agent/scripts/dash.mjs:50 const res = await fetch(new URL(apiPath, OP.url), {Amh Cloudflare Ops Mcp By Wt (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/wt-walrus.png" width="360" alt="WT walrus standing in side profile with large tusks and a WT circuit badge"> <br><sub>The WT walrus, the Walrus Tusk mascot.</sub> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
anansi/__main__.py:71 result = await fetcher.fetch(args.url, proxy=args.proxy)anansi (MCP server)
Compatibility: Not stated.
<img src="https://repository-images.githubusercontent.com/1238896536/d711cc76-8358-4a4a-9160-341131498877">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/check-mcp-sdk-version.sh:40 CENTRAL_VERSION=$(curl -s --max-time 10 "$CENTRAL_URL" \api2mcp4j (MCP server)
Compatibility: Not stated.
**Turn your existing Spring Boot REST controllers into MCP (Model Context Protocol) tools , no rewrites, no `@Tool` everywhere.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/install.sh:3 # Usage: curl -sL https://gitee.com/apocdata/ApocData-skill/raw/main/scripts/install.sh |Apocdata Skill (MCP server)
Compatibility: Not stated.
A-share data service with structured announcement parsing: every announcement carries an AI summary, category, importance level and sentiment, fully traceable to source.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
scripts/generate-pet-banner.py:19 subprocess.run(args, check=True)Awesome Codex Cli (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/codex-pet-banner.gif" alt="The eight built-in Codex Pets animated together , Awesome Codex CLI" width="960"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
details/mc-server-wrapper.md:19 subprocess.run(["java", "-jar", "server.jar", "nogui"])Awesome Mcp Servers (MCP server)
Compatibility: Not stated.
Public repository ever-works/awesome-mcp-servers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:25 prepareBPE (Bitcoin Pricing Engine) (MCP server)
Compatibility: Not stated.
Cross-venue Bitcoin market intelligence , consolidated pricing, ML signals, funding-rate skew, sentiment, and natural-language briefings across 36 exchanges.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
src/auth/auth-cooldown.ts:66 await fs.unlink(this.file).catch(() => {});Brightspace Mcp Server (MCP server)
Compatibility: Not stated.
> **By [Rohan Muppa](https://github.com/rohanmuppa), ECE @ Purdue**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:17 prepareCaldav Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:38 prepareCalypso Multimodal RAG MCP (MCP server)
Compatibility: Not stated.
**Hosted multimodal RAG for Claude Desktop, Cursor, and agent workflows , in one `npx` command.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:14 prepareChamber (MCP server)
Compatibility: Not stated.
**Chamber MCP** , seal / open JSON.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
internal/cli/command/ssh.go:31 flags.Var(&identities, "identity", "private key; repeat to try in order (defaulChannelTerm (MCP server)
Compatibility: Not stated.
[English](README.md) | [Deutsch](README.de.md) | [Español](README.es.md) | [Français](README.fr.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Русский](README.ru.md) | [简体中文](README.zh-CN.md) | [繁體中文](README.zh-TW.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
Dockerfile:7 (unset OS; unset SHELL; curl -fsSL https://bun.sh/install | bash)Cloudinary Asset Management (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.cloudinary/asset-management-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
bin/crbro.mjs:565 else { try { fs.rmSync(ep.stateFile(root, st.build), { force: true }); } catch { /* stale fiCrbro Memory (MCP server)
Compatibility: Not stated.
**CRBRO** is a local MCP (Model Context Protocol) server that gives your AI assistant **persistent long-term memory** across sessions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:29 credentials.jsonDakera Mcp (MCP server)
Compatibility: Not stated.
MCP server for Dakera AI.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
cmd/doc-scraper/docs_drift_test.go:86 out, err := exec.Command(bin, append(args, "-h")...).CombinedOutput()Doc Scraper (MCP server)
Compatibility: Not stated.
> A configurable, concurrent, and resumable web crawler written in Go.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
docker_mcp/tools/_cli.py:219 # before subprocess.run(timeout=timeout) below, so without this an unreachable orDocker Mcp (MCP server)
Compatibility: Not stated.
<img src="https://raw.githubusercontent.com/L337-org/docker-mcp/main/assets/icon.png" align="left" width="72" height="72" alt="">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
internal/web/handlers_automation.go:59 // a browser form always sends this; curl and scripts don't unless tolderaser (MCP server)
Compatibility: Not stated.
**Take back your privacy.** Eraser sends data removal requests to 700+ data brokers on your behalf , for free.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:94 @cyanheads/mcp-ts-coreEur Lex Mcp Server (MCP server)
Compatibility: Not stated.
Search EU legislation, CJEU case law, and treaties; traverse the CELLAR relationship graph; resolve EuroVoc concepts via MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
package.json:43 @angular/commonGalaxy UI MCP Server (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
Packages/AppCore/Sources/AppCore/HostSession.swift:798 if let value = await fetch({ try await client.listContagantry (MCP server)
Compatibility: Not stated.
**Native Docker management for your Mac.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:100 prepareGerman Legal Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
demo/web/app.js:11 const result = await WebAssembly.instantiateStreaming(fetch("qr.wasm"), go.importObject);Go Qr (MCP server)
Compatibility: Not stated.
<h1 align="center">go-qr</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
evals/scripts/cursor.sh:48 echo "Error: cursor-agent not found on PATH (install: curl -fsS https://cursor.com/io.github.buildkite/buildkite-mcp-server (MCP server)
Compatibility: Not stated.
> **[Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction) server exposing Buildkite data (pipelines, builds, jobs, tests) to AI tooling and editors.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
kicad_mcp_server/tools/operations.py:177 result = subprocess.run(io.github.bunnyf/kicad-mcp-server (MCP server)
Compatibility: Not stated.
The MCP registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
src/video_editor_mcp/server.py:1598 subprocess.Popen(io.github.burningion/video-editing-mcp (MCP server)
Compatibility: Not stated.
See a demo here: [https://www.youtube.com/watch?v=KG6TMLD8GmA](https://www.youtube.com/watch?v=KG6TMLD8GmA)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
debug/test-e2e-policy.js:103 fs.unlinkSync(AUDIT_PATH);io.github.bvisible/mcp-ssh-manager (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that enables **Claude Code** and **OpenAI Codex** to manage multiple SSH connections.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
src/memory/providers/dokoro-provider.ts:182 await fs.unlink(filePath);io.github.byPawel/tachibot-mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED SECRETS_PATH_CREDENTIAL +1 more
sync/github_sync.ts:301 await fs.unlink(filepath);io.github.bytewizard42i/soulsketch (MCP server)
Compatibility: Not stated.
[GitHub repository](https://github.com/bytewizard42i/soulSketch) · [npm: `@soulsketch/mcp-server`](https://www.npmjs.com/package/@soulsketch/mcp-server)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
hub/cli.mjs:1064 fs.unlinkSync(freezeFile());io.github.bzdOS/hubd (MCP server)
Compatibility: Not stated.
**The project tracker for teams of humans and AI agents , in plain files.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/api/client.ts:26 return await fetch(url, {io.github.cadlens-co/cadlens-mcp (MCP server)
Compatibility: Not stated.
A [Model Context Protocol](https://modelcontextprotocol.io) server that wraps the [Cadlens CAD parsing API](https://cadlens.co) so MCP-aware LLM clients (Claude Desktop, Claude Code, Cursor, Zed, Windsurf) can parse CAD files (`.dwg`, `.dxf`, `.dwf`, `.dwfx`, `.dgn` V7, `.pdf`, m
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
benchmarks/harvest.mjs:21 objects = (await (await fetch(url)).json()).objects ?? [];io.github.caglarbozkurt/heimdall (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
openzim_mcp/content_processor.py:2403 # Entry-content fetch (get_zim_entry / get_entries): scopeio.github.cameronrye/openzim-mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://raw.githubusercontent.com/cameronrye/openzim-mcp/main/website/public/assets/favicon.svg" alt="OpenZIM MCP Logo" width="120" height="120"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
test-mcp-helpers.mjs:36 await fs.rm(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });io.github.camgitt/memoir (MCP server)
Compatibility: Not stated.
Portable, project-scoped memory and session handoffs for coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
packages/chp-adapter-host/chp_adapter_host/bootstrap.py:157 # Docker from its OFFICIAL SIGNED repository - NOTio.github.capabilityhostprotocol/chp (MCP server)
Compatibility: Not stated.
CHP is the open protocol for declaring, **governing**, and **proving** what agents, tools, and systems do , the single signed plane where a human approval, an agent's action, and a system call become the same governed, tamper-evident, replayable event.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
isochrone-backend/index.ts:1545 fs.rmSync(osmFile, { force: true });io.github.capan/isochrone (MCP server)
Compatibility: Not stated.
**Live: [iso.huseyincapan.dev](https://iso.huseyincapan.dev)**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:47 postinstallio.github.cardmagic/messages (MCP server)
Compatibility: Not stated.
Fuzzy search Apple Messages/iMessage conversations
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:11 .npmrcio.github.cc1a2b/arabicfmt-mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/confirm/ntfy.ts:51 const resp = await this.#fetch(this.#url, {io.github.cdrn/sigil (MCP server)
Compatibility: Not stated.
> Claude can sign, but never see.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
AGENT_IGNORE_INSTRUCTIONS
docs/MCP.md:75 instructions embedded in it. A transcript line that says “ignore previousio.github.chaoz23/dmcheck (MCP server)
Compatibility: Not stated.
>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/index.ts:50 res = await fetch(`${API_BASE}${path}`, {io.github.cheevahagadog/forency (MCP server)
Compatibility: Not stated.
Let your AI assistant investigate any website's technology stack , CMS, ecommerce platform, JavaScript frameworks, analytics, CRM, marketing automation, payments, chat widgets, CDN, and hosting.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
setup.py:108 subprocess.check_call(io.github.chicogong/ffvoice (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.chicogong/ffvoice -->
This grade is a hygiene screen, not proof of safety.
