Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1351 to 1400 of 1,860 MCP, Grade C entries. Page 28 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:92 @cyanheads/mcp-ts-coreMet Museum Mcp Server (MCP server)
Compatibility: Not stated.
Search the Metropolitan Museum of Art collection, browse it by department or update date, fetch full artwork records and open-access images via MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
packages/meteoswiss-forecast-evals/src/mcp-vs-skills-bash-tool.test.ts:63 expectRejected("curl -s 'https://datMeteoswiss Llm Tools (MCP server)
Compatibility: Not stated.
Swiss weather data for AI assistants , forecasts, current conditions, stations, and pollen from MeteoSwiss Open Data.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:33 prepareMindbox Mcp (MCP server)
Compatibility: Not stated.
Если вы искали, как подключить Mindbox к нейросети, поднять профиль клиента или проверить сегмент без выгрузки в Excel , это оно.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/cherry.py:814 fetch('/set_debug')Nikita (MCP server)
Compatibility: Not stated.
**English summary.** Nikita is a service for 1C:Enterprise administrators that parses 1C event logs (the registration log, `.lgf`/`.lgp` text and `.lgd` SQLite formats) and exports them to ClickHouse for SQL analytics, with optional Solr full-text search and Redis buffering.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +3 more
lib/oauth2/mcp.rb:86 headers = request.fetch(:headers, request.fetch("headers", nil)) if request.respond_to?(:Oauth2 Mcp (MCP server)
Compatibility: Not stated.
<a href="https://discord.gg/3qme4XHNKN"><img alt="Galtzo FLOSS Logo by Aboling0, CC BY-SA 4.0" src="https://logos.galtzo.com/assets/images/galtzo-floss/avatar-128px.svg" align="right"/></a> <a href="https://ruby-toolbox.com"><img alt="ruby-lang Logo, Yukihiro Matsumoto, Ruby Visu
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/mcp_server/tools/search_engine.py:254 response = requests.get(search_url, headers=headers, timeout=15)Oh My Mcp (MCP server)
Compatibility: Not stated.
English | [中文](README.zh.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/bench_lite_nav.py:66 proc = subprocess.run([exe, *args, str(Path(UT_ROOT) / "src")],Onec Vecgraph (MCP server)
Compatibility: Not stated.
MCP-сервер для **векторизации конфигураций 1С:Предприятие** (XML-выгрузка Конфигуратора **и** проекты **1C:EDT**, база + расширения) и построения **графа зависимостей** (включая граф вызовов BSL) в **Neo4j** , граф, векторы и полнотекст в одном хранилище.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
evals/build_fixtures.py:31 subprocess.run(Open Ocr Cli Mcp (MCP server)
Compatibility: Not stated.
Agent-first OCR for images, PDFs, and public URLs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:47 prepareOpencode Mcp (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that lets any MCP host , Claude Code, Codex, Cursor, etc.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:92 @cyanheads/mcp-ts-coreOpenlibrary Mcp Server (MCP server)
Compatibility: Not stated.
Search books and authors, fetch editions, browse subjects, and resolve cover images from Open Library via MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
site/demo/assets/demo-BvsF4rn0.js:1 var e=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports);(fuopenportfolio (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
client/ormcp_client_example.py:41 self.process = subprocess.Popen(Ormcp Docs (MCP server)
Compatibility: Not stated.
Copyright (c) 2025, Software Tree
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/comment-html-format/SKILL.md:97 <pre><code>curl -X POST /api/login \P4Plan Mcp (MCP server)
Compatibility: Not stated.
<div align="center"> <h1>P4 Plan MCP Server</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
.gitignore:32 .claude/.credentials.jsonP5 Mcp Run (MCP server)
Compatibility: Not stated.
A stdio MCP server (`mcp-run-bash`) that exposes a `run` tool: it executes shell commands via `bash -c` and returns exit code, stdout, and stderr , optionally passed through 30+ command-specific filters (`ls`, `git`, `make`, `cargo`, `cpanm`, `kubectl`, `terraform`, …) so the LL
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:14 preparePhishtank Mcp Server (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that provides access to PhishTank, a collaborative clearing house for data and information about phishing on the Internet.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/setup.sh:118 curl -fsSL https://bun.sh/install | bashPierrotKnowledge2 (MCP server)
Compatibility: Not stated.
A local knowledge base that a person and an AI agent can both work in, using the same plain Markdown files as the source of truth.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
plugins/plane-workflow/cli.py:174 def _run_codex(arguments: list[str], runner: Callable[..., subprocess.ComplePlane Workflow Mcp (MCP server)
Compatibility: Not stated.
Plane Workflow MCP is an open-source [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server for [Plane](https://plane.so/) project management.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:36 preparePortkey Admin Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
mcp-servers/src/handlers.ts:97 const res = await fetch(u, { signal: AbortSignal.timeout(15000) });project_human (MCP server)
Compatibility: Not stated.
> **9 humanity skills for AI agents** , crisis detection, accessibility auditing, empathy, cultural sensitivity, and more.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:41 prepareProton Mail Mcp (MCP server)
Compatibility: Not stated.
A [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server that gives AI assistants full access to your Proton Mail account -- send, read, search, and organize email over SMTP and IMAP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
deploy/entrypoint.sh:45 r = urllib.request.urlopen('https://api.github.com/repos/mvanhorn/last30days-skill/relReach Mcp (MCP server)
Compatibility: Not stated.
> A controllable multi-source search MCP server for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:34 prepareResolume Mcp Server (MCP server)
Compatibility: Not stated.
Control [Resolume Arena/Avenue](https://resolume.com/) from AI assistants like Claude using the [Model Context Protocol](https://modelcontextprotocol.io).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.beads/README.md:64 curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | basridge (MCP server)
Compatibility: Not stated.
An MCP server that reverse-engineers architecture from a directory tree.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
AGENT_IGNORE_INSTRUCTIONS
CHANGELOG.md:4764 - **Prompt-injection scanner** - detects adversarial patterns in file content (`ignore previSecureContext (MCP server)
Compatibility: Not stated.
Secure memory + persistent context + skill-admission gate for Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
scripts/remove-member-count.py:138 out = subprocess.run(['grep', '-rn', '484', '--include=*.md', '--include=*.Skool Api Docs (MCP server)
Compatibility: Not stated.
> **The most complete unofficial Skool API.** Read posts, comments, members, and courses.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
evaldata/harness/collect.go:55 out, err := exec.Command("gh", "auth", "token").Output()Slop Chop (MCP server)
Compatibility: Not stated.
Chop AI writing tells out of text.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
package.json:25 postinstallSpinnaker Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://raw.githubusercontent.com/GeiserX/spinnaker-mcp/main/docs/images/banner.svg" alt="spinnaker-mcp banner" width="900"/> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
release.sh:193 if command -v curl >/dev/null 2>&1; thenSsh Mcp (MCP server)
Compatibility: Not stated.
One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
stdapi/agent.py:133 res = subprocess.run(StdAPI (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
internal/web/templates/app.js:3 }){opts.headers=headers();const r=await fetch(path,opts);const txt=await r.texSynamcps Server (MCP server)
Compatibility: Not stated.
`Synamcps` is a server that provides:
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
internal/backend/mcpadapter.go:326 cmd := exec.CommandContext(ctx, entry.Command, entry.Args...) //nolint:goseToolMesh (MCP server)
Compatibility: Not stated.
> The missing control layer between AI agents and enterprise systems.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
deploy/linux_setup.sh:34 if curl -LsSf https://astral.sh/uv/install.sh | sh; thenuspto_enriched_citation_mcp (MCP server)
Compatibility: Not stated.
A high-performance Model Context Protocol (MCP) server providing access to **two USPTO patent citation APIs** , the **Enriched Citations v3** (AI-extracted passage locations, claim mapping) and the **Office Action Citations v2** (raw Form 892/1449 citation data) , with **token-
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
deploy/linux_setup.sh:56 if curl -LsSf https://astral.sh/uv/install.sh | sh; thenuspto_fpd_mcp (MCP server)
Compatibility: Not stated.
A high-performance Model Context Protocol (MCP) server for the USPTO Final Petition Decisions API with token-saving **context reduction** capabilities, user-customizable fields, and **cross-MCP integration** for complete patent lifecycle analysis.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
deploy/linux_setup.sh:34 if curl -LsSf https://astral.sh/uv/install.sh | sh; thenuspto_ptab_mcp (MCP server)
Compatibility: Not stated.
A high-performance Model Context Protocol (MCP) server for the USPTO Patent Trial and Appeal Board (PTAB) Open Data Portal API with token-saving **context reduction** capabilities, **hybrid document extraction**, and **seamless cross-MCP integration** for complete patent lifecycl
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
lib/vehicles/mcp_server.rb:174 limit = args.fetch("limit", 20).to_i.clamp(1, 100)vehicles (MCP server)
Compatibility: Not stated.
> [!TIP] > **🚀 Ship your next Rails app 10x faster!** I've built **[RailsFast](https://railsfast.com/?ref=vehicles)**, a production-ready Rails boilerplate template that comes with everything you need to launch a software business in days, not weeks.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
design/support.js:158 fetch(location.href).then((res) => res.ok ? res.text() : "").then((t) => {vellum (MCP server)
Compatibility: Not stated.
> *a calm window into a folder of markdown*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/api.ts:31 const res = await fetch(`${VULK_API_BASE}${path}`, {Vulk Mcp Server (MCP server)
Compatibility: Not stated.
Create and continue apps and websites with your own VULK plan and credits, from Cursor.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:36 postinstallWarp Agent Mcp (MCP server)
Compatibility: Not stated.
**warp-agent-mcp is the first MCP server for booking real freight.** It's a Model Context Protocol server for the [Warp](https://wearewarp.com) freight network that lets an AI agent quote, book, and track LTL, FTL, cargo van, box-truck, and multi-stop shipments , straight from C
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED OBFUSCATION_ENCODED_BLOB
mcp/catalog.ts:53 const resp = await fetch(DEFAULT_CATALOG_URL, { cache: 'reload' });zx84 (MCP server)
Compatibility: Not stated.
**A browser emulator for the Sinclair ZX80, ZX81 and ZX Spectrum, Amstrad CPC (including the Plus range) and PCW, Tatung Einstein, MSX, Memotech MTX, Camputers Lynx, Jupiter Ace, and Acorn BBC Micro, with an MCP server for automated testing.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:11 prepare3Cx Mcp Server (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/header.png" alt="3CX MCP Server" width="800"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
acmt001_mcp/server.py:389 response = httpx.get(Acmt001 Mcp (MCP server)
Compatibility: Not stated.
<!-- SPDX-License-Identifier: Apache-2.0 OR MIT -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
ssh-logs-mcp/README.md:64 "known_hosts": "~/.ssh/known_hosts"Agent Safe Tools (MCP server)
Compatibility: Not stated.
Ask your AI coding agent, in natural language, to search production logs or inspect a database , safely.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.github/workflows/docs-sync.yml:27 echo "${{ secrets.STORE_DEPLOY_KEY }}" > ~/.ssh/id_ed25519agents (MCP server)
Compatibility: Not stated.
<div class="filament-hidden">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
AGENT_IGNORE_INSTRUCTIONS
skills/prompt-injection-review/SKILL.md:13 2. Look for hidden or indirect instructions: ignore previous instruAgentSkills (MCP server)
Compatibility: Not stated.
Portable agent skills, curated skillsets, MCP presets, and routing templates for AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/config.h:45 R"(/\.git/)", R"(/\.env)", R"(/id_rsa)", R"(\.pem$)"};AlxRun (MCP server)
Compatibility: Not stated.
**Extend what your machine can really compute, within limits you control.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
install.sh:53 tag="$(curl -fsSL "${API}/repos/${REPO}/releases/latest" \anacraft (MCP server)
Compatibility: Not stated.
<h1 align="center">⛏ craft</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
docs/test-plan-apcore-mcp.md:3192 PermissionError("Cannot access /root/.ssh/id_rsa"),Apcore Mcp (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="./apcore-mcp-logo.svg" alt="apcore-mcp logo" width="200"/> </div>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
packages/synology-apm-sdk/src/synology_apm/sdk/collections/_shared.py:245 return await fetch(plan_id)Apm Sdk Python (MCP server)
Compatibility: Not stated.
MCP server and workflow skills for Synology ActiveProtect Manager (APM).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
AGENT_IGNORE_INSTRUCTIONS
internal/dogfood/v0-6-0-test-plan.md:438 - [ ] **P5.1** `source_name` に `Ignore previous instructions.Apple Health Mcp Server (MCP server)
Compatibility: Not stated.
<!-- Read this in [English](README.md) / [日本語](README.ja.md) -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/atlassian_agent/confluence.py:487 response = requests.get(atlassian_agent (MCP server)
Compatibility: Not stated.
<picture> <source media="(prefers-color-scheme: dark)" srcset="docs/assets/banner-dark.svg"> <img alt="Atlassian Agent , reads your Confluence and Jira, and shows you the diff before anything is published" src="docs/assets/banner-light.svg"> </picture>
This grade is a hygiene screen, not proof of safety.
