Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1251 to 1300 of 1,860 MCP, Grade C entries. Page 26 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED SECRETS_PATH_UNCONFIRMED
package.json:20 prepareTaskwarrior Mcp (MCP server)
Compatibility: Not stated.
MCP server that wraps TaskWarrior command-line tool.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:30 prepareTauri Plugin Mcp (MCP server)
Compatibility: Not stated.
A Tauri plugin and MCP server that allow AI agents such as Cursor and Claude Code to interact with and debug your Tauri application through screenshots, DOM access, input simulation, and more.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
api/src/analytics/meta-capi.service.ts:116 await axios.post(textbee (MCP server)
Compatibility: Not stated.
Send and receive SMS messages using your own Android phone - no Twilio, no per-message fees.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
package.json:11 preparetgcli (MCP server)
Compatibility: Not stated.
Telegram CLI for reading/searching messages, syncing archives, and sending or downloading files.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
README.md:89 2. If a default credential file (`USER_HOME/.tsurugidb/credentials.json`) exists, use it for authTsurugi Mcp Server (MCP server)
Compatibility: Not stated.
[Model Context Protocol](https://github.com/modelcontextprotocol) server to access [Tsurugi](https://github.com/project-tsurugi/tsurugidb).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
Build/post-llm-stats.php:110 fwrite(STDERR, "curl error: $err\n");Typo3 Mcp Server (MCP server)
Compatibility: Not stated.
This extension provides a Model Context Protocol (MCP) server implementation for TYPO3 that allows AI assistants to safely view and manipulate TYPO3 pages and records through TYPO3's workspace system.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
.claude/skills/unity-bridge/scripts/wait_compile.py:48 r = subprocess.run(cmd, capture_output=True, text=True,Unity AI Bridge (MCP server)
Compatibility: Not stated.
**[English](README.md)** | **[中文](README.zh-CN.md)**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
cli/src/lib/clean-plugin.ts:88 fs.rmSync(intermediate, { recursive: true, force: true });Unreal Mcp (MCP server)
Compatibility: Not stated.
<div align="center" width="100%">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
mcp-db/src/seeds/scripts/seed-runner.ts:197 const response = await fetch(urlObj.toString())Us Census Bureau Data Api Mcp (MCP server)
Compatibility: Not stated.
Bringing _official_ Census Bureau statistics to AI assistants everywhere.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:59 @base-ui/reactVecmo (MCP server)
Compatibility: Not stated.
A browser vector-motion editor that exports dependency-free runtime code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:21 prepareVectorize Mcp Server (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server implementation that integrates with [Vectorize](https://vectorize.io/) for advanced Vector retrieval and text extraction.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
src/tools/filesystem-tools.ts:1291 await fs.rm(item.validPath!, {Vulcan File Ops (MCP server)
Compatibility: Not stated.
# Vulcan File Ops MCP Server
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.ide/Dockerfile:15 curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -swhois (MCP server)
Compatibility: Not stated.
[English](README_EN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
.gitignore:9 .envWwise Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="images/wwise_mcp_banner.png" width="100%" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.claude/hooks/session-start.sh:14 echo "session-start: mise is not installed. Add 'curl https://mise.run | sh'Zammad Mcp (MCP server)
Compatibility: Not stated.
An MCP server that connects AI assistants to Zammad, providing tools for managing tickets, users, organizations, attachments, and knowledge base content.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/zendesk_mcp_server/zendesk_client.py:282 with urllib.request.urlopen(req) as response:Zendesk Mcp Server (MCP server)
Compatibility: Not stated.
A Model Context Protocol server for Zendesk.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
src/ZYC.Framework/Tab/TabItemViewFaultedEvent.cs:1 using ZYC.Framework.Abstractions.Tab;ZYC.Framework (MCP server)
Compatibility: Not stated.
<p align="center"> <a href="./README.md">English</a> | <a href="./README.ja.md">日本語</a> | <a href="./README.zh-CN.md">简体中文</a> | <a href="./README.zh-TW.md">繁體中文</a> | <a href="./README.ko.md">한국어</a> | </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
src/Anonymizer/Dumper.php:45 $process = proc_open($argv, [agent (MCP server)
Compatibility: Not stated.
<h1 align="center">Cipi Agent for Laravel</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
package.json:16 prepareAgent Loom (MCP server)
Compatibility: Not stated.
Durable local mail and advisory coordination between coding-agent sessions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
package.json:24 postinstallAgent Passport Mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.agent-passport-system/agent-passport-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:33 prepareagentaos (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
packages/cli/src/bridge.ts:44 const response = await fetch(`${this.localBase}${request.path}`, {agenthop (MCP server)
Compatibility: Not stated.
**Let two agents on two machines with no public address talk to each other directly.** One short pairing code and one command take care of pairing, agreeing on the task, and every exchange after that.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
src/semantic_engine/manage_semantics.py:143 shutil.rmtree(PROJECT_DIR)Agentic Analytics System (MCP server)
Compatibility: Not stated.
A local, open-source stack for building conversational data agents and semantic reasoning workflows over an Iceberg Lakehouse.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
install.sh:24 if command -v curl >/dev/null 2>&1; thenAgentic Dns (MCP server)
Compatibility: Not stated.
**Agentic AI-Native DNS Routing, Diagnostics & Telemetry.** Manages a complete DNS resolution chain (Pi-hole -> CoreDNS -> dnsdist -> Unbound/Stubby/DNSCrypt -> VPN DNS) with CLI, REST API, stdio MCP, and a Rust DoT/mTLS proxy server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
README.md:218 If an agent attempts to access `/etc/passwd` or `../../../../ssh/id_rsa` while the server was reAgentic Filesystem Mcp (MCP server)
Compatibility: Not stated.
**Agentic Filesystem MCP Server** is a secure, highly capable Model Context Protocol (MCP) server written in Rust.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
references/research/02-troubleshooting-guide.md:234 subprocess.check_call([sys.executable, '-m', 'pip', 'instaAgentic Kaggle Skill (MCP server)
Compatibility: Not stated.
|
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/floeAgent.ts:386 async fetch(input: string | X402FetchInput): Promise<FetchResult> {Agentkit Actions (MCP server)
Compatibility: Not stated.
**The TypeScript SDK for Floe , know what every AI call really costs.** Floe costs each call the moment it ends across every vendor , telephony, STT, LLM, TTS, search, data , on one ledger, ties the spend to the client and campaign, and shows your margin per contract; then you
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
plugin/scripts/recipes.py:89 os.remove(p)Ai Crew Sync (MCP server)
Compatibility: Not stated.
*Read this in [Spanish](README.es.md).*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/setup-dev.sh:12 echo " curl -LsSf https://astral.sh/uv/install.sh | sh"aiochainscan (MCP server)
Compatibility: Not stated.
`aiochainscan` reads on-chain history from public block explorers across 85 chains through one async client , and hands it back usable, not raw.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
examples/external_agent_trace_demo.py:33 def _send(proc: subprocess.Popen[str], request: dict[str, Any]) -> diAlr Tw (MCP server)
Compatibility: Not stated.
連接 AI 代理與台灣官方法律來源，提供研究流程、來源查證、證據綁定與答案驗證。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
scripts/agents_smoke.py:67 self.process = subprocess.Popen(assemblash (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/assemblash-mark.svg" width="112" alt="Assemblash logo"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/fixtures/fake-agent.mjs:130 fs.rmSync(statePath, { force: true });Ast Mcp Server (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/header.jpg" alt="Abstract network of connected code symbols with the text AST MCP Server." width="100%" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
docs/SECURITY.md:45 * SSH keys: `id_rsa*`, `id_ed25519*`, `id_dsa*`, `id_ecdsa*`ASTral (MCP server)
Compatibility: Not stated.
Most AI agents explore repositories the expensive way: open entire files > skim thousands of irrelevant lines > repeat.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
src/bad_ass_mcp/backend/base.py:291 proc = subprocess.Popen(Bad Ass Mcp (MCP server)
Compatibility: Not stated.
*Every other tool needs a browser or a vision model.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
package.json:12 postinstallBitcoin Mcp (MCP server)
Compatibility: Not stated.
> **Real-time Bitcoin blockchain data in your AI workflow.** Query addresses, transactions, blocks, and UTXOs from the mempool.space API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/server.rs:818 let bug = fetch(reference.clone()).await?;Bugboard Mcp (MCP server)
Compatibility: Not stated.
`bugboard-mcp` gives an MCP client access to projects, versions, bugs, history, subscriptions, and votes in the 1C Bugboard.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
docs/COFFEESHOP_DEMO.md:29 curl -fsSL https://tailscale.com/install.sh | shBumi Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <a href="https://github.com/casey/just"><img src="https://img.shields.io/badge/just-ready_to_go-7c5cfc?style=flat-square&logo=just&logoColor=white" alt="Just"></a> <a href="https://github.com/astral-sh/ruff"><img src="https://img.shields.io/endpoint?url=https:/
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
plans/v2-foundation-round1-wal-probe.py:148 child_result = subprocess.run( # noqa: S603 - fixed synthetic chilcairntir (MCP server)
Compatibility: Not stated.
Memory-first reasoning layer for Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/carbone/client.ts:544 response = await fetch(`${this.baseUrl}${endpoint}`, {Carbone Mcp (MCP server)
Compatibility: Not stated.
Generate PDF, Word, Excel and PowerPoint documents from templates and JSON data, and convert files across 100+ formats, with the Carbone API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
test_cascade.py:8 sys.exit(subprocess.call([sys.executable, "tests/test_gateway.py"]))CascadeGateway (MCP server)
Compatibility: Not stated.
**CascadeGateway** is an intelligent, hardware-adaptive cascading proxy that routes AI queries between local GPUs (via Ollama at **$0 token cost**) and frontier cloud models (Google Gemini, OpenAI, etc.).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
src/config.ts:145 fs.unlinkSync(envPath);Cellartracker Mcp (MCP server)
Compatibility: Not stated.
CellarTracker wine cellar management , MCP tools for inventory, drinking recommendations, purchase history, and wishlist.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
bin/todos.ts:40 const response = await fetch(`${boardOrigin()}/api/health`, {Claude Manual Todos Plugin (MCP server)
Compatibility: Not stated.
Records, orders and tracks the manual tasks only the user can do: what is left waiting in a console, a dashboard or an account Claude cannot reach.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/linux-vm-smoke.sh:69 curl -fL "$ARTIFACT_URL" -o cloche.tar.gzcloche (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/cloche-social-preview.jpg" alt="Cloche banner" width="900"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
packages/cli/src/cli.js:433 try { fs.rmSync(dir, { force: true, recursive: true }); } catch {}cloud189 (MCP server)
Compatibility: Not stated.
> **Secure, reliable, extensible, free cloud storage for AI agents, powered by Tianyi Cloud 189 / 天翼云盘.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
.github/verify.py:159 r = subprocess.run(("git", *args), capture_output=True, text=True)Code Audit Protocol (MCP server)
Compatibility: Not stated.
Audits a code change against a 54-phase failure taxonomy and reports what it did not check, not just what it found.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
benchmarks/snippet_06_hardcoded_credentials.py:24 response = requests.post(Code Review Agent Mcp (MCP server)
Compatibility: Not stated.
> AI code review agent that doesn't sugarcoat.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
codecks_cli/commands.py:498 os.remove(config.CACHE_PATH)Codecks Cli (MCP server)
Compatibility: Not stated.
Game developers should be making games, not managing task boards.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
internal/cli/app.go:449 cmd := exec.CommandContext(ctx, "go", cmdArgs...)codegraph (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/banner.svg" alt="codegraph" width="100%"/> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
requirements.txt:1 agent-connector-sdk[mcp]>=0.3.11,<1.0.0Container Manager Mcp (MCP server)
Compatibility: Not stated.
*Version: 3.3.4*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
contradiction-mcp/src/connectors/document/documentConnector.ts:197 const xml = child_process.execFileSync('unzContradiction Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
