Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1401 to 1450 of 1,860 MCP, Grade C entries. Page 29 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.beads/README.md:64 curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | basAtlassian Browser Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/images/banner.svg" alt="atlassian-browser-mcp banner" width="900"/> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
audio_transcriber/mcp_server.py:406 shutil.rmtree(scratch_dir, ignore_errors=True)Audio Transcriber (MCP server)
Compatibility: Not stated.
*Version: 2.3.6*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/ssh/files.ts:116 await fs.unlink(from);Autodl Cli (MCP server)
Compatibility: Not stated.
> **非官方项目。** 本项目与 AutoDL 官方无任何关联，未获其背书或赞助。 > 名称中的 "AutoDL" 仅用于指代本工具所对接的平台。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zqGNCYXh0" style="display:none">hGvR7EEr5eIUScxA1XNRlC9JvhoCn6/MmEHAvw2ow4Wydt3mQzuimE0EBase Batch Builder Mcp (MCP server)
Compatibility: Not stated.
Base Multi-Agent Orchestrator (BMAO) represents a paradigm shift in how autonomous AI agents interact with the Base blockchain.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/bedrock/client.ts:79 const response = await fetch(url, {Bedrock Multi Model Mcp (MCP server)
Compatibility: Not stated.
MCP server for AWS Bedrock - text, image, video and embeddings from any model.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +3 more
src/lib/credentials.ts:35 fs.unlinkSync(CREDENTIALS_FILE);Bonnard Cli (MCP server)
Compatibility: Not stated.
bonnard-cli provides a straightforward way to access analytics tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
browden/web_navigator/selenium_chrome/backend.py:272 with urllib.request.urlopen(url, timeout=1) as resp:browden (MCP server)
Compatibility: Not stated.
**A local, cross-platform MCP shell that puts mechanical gates between an LLM agent and a real Chrome browser.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
includes/admin.php:191 echo '<p><code>curl -H "X-Bulkseme-Key: bsme_..." ' . esc_html($status_url) . '</code><Bulk Ai Cli Connector (MCP server)
Compatibility: Not stated.
Formerly Bulk SEO Meta Editor for AI Agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
canonic/config.py:101 #: parameters a provider needs to do its fetch (``region``, ``cluster_id``,canonic (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.mischuh/canonic -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
chainagents/exports/pdf_images.py:340 sock = socket.create_connection(ChainAgents (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="logo.png" width="300px"/>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
agent/build_image.py:19 return subprocess.check_output(checkexploit (MCP server)
Compatibility: Not stated.
CheckExploit , proves whether a scanner-flagged CVE is actually reachable in a repo, runs real exploits in an isolated sandbox to confirm, then patches and verifies fixes.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
bridge.py:199 out += subprocess.run(Cipherscript Unity (MCP server)
Compatibility: Not stated.
**CipherScript (Unity edition)** is a free browser extension that turns DeepSeek, Gemini, Kimi, GLM, Qwen, Arena or Meta AI into a **Unity Editor AI agent**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
requirements.txt:7 prettytable>=2.1.0Claude Free Api Bot (MCP server)
Compatibility: Not stated.
Claude-free-api-bot is a Windows app that brings several free and low-cost AI services into one place.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:19 prepareClaude Plugin (MCP server)
Compatibility: Not stated.
High-fidelity PDF→Markdown parsing, layout-preserving PDF translation, and Markdown→DOCX/HTML/PDF/LaTeX conversion , delivered as a Claude Code plugin, a Codex CLI / Cursor skill, and a standalone MCP server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +2 more
claude_rework/cli.py:67 subprocess.call([sys.executable, idx, "--build"])Claude Rework (MCP server)
Compatibility: Not stated.
Claude starts every session with no memory of the last one.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:30 credentials.jsonClaude Services (MCP server)
Compatibility: Not stated.
> Production-ready MCP servers for [Claude Code](https://claude.ai/code) , give Claude the tools to browse, read, write, and reason beyond its defaults.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
examples/demo-run.mjs:31 const res = await fetch(`${BASE}${path}`, {Coinrithm Agent Trading (MCP server)
Compatibility: Not stated.
Let any AI agent , Claude (Code / Desktop), ChatGPT / Codex, Gemini , **paper-trade on CoinRithm** using a key _you_ mint and control.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:40 prepareConstellation Mcp (MCP server)
Compatibility: Not stated.
Give your AI coding assistant instant, intelligent access to your entire codebase's structure, dependencies, and relationships without transmitting any source code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/release.yml:67 run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargcontext (MCP server)
Compatibility: Not stated.
*The binary is `ctx`.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.github/workflows/release.yml:148 with urllib.request.urlopen(urllib.request.Request(url, headers=headers)) ascrucible (MCP server)
Compatibility: Not stated.
<picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/HarperZ9/crucible/main/docs/art/hero-dark.svg"> <img src="https://raw.githubusercontent.com/HarperZ9/crucible/main/docs/art/hero-light.svg" alt="crucible: Register a thesis, measure e
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
AI_AGENT.md:32 curl https://ollama.ai/install.sh | shctxai (MCP server)
Compatibility: Not stated.
**Local-first coding agent with persistent, syntax-aware semantic repository memory**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/ingest_diadoc.py:73 with urllib.request.urlopen(req, timeout=60) as r:Diadoc Mcp Ru (MCP server)
Compatibility: Not stated.
API Диадока прямо в Claude: входящие и исходящие документы, статусы документооборота, контрагенты и приглашения к ЭДО, подписание, МЧД, печатные формы.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
test.sh:12 curl -sL \Diffbot Mcp (MCP server)
Compatibility: Not stated.
A Diffbot MCP server with a variety of helpful web knowledge fetching tools for your agent or LLM pipeline.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
CHANGELOG.md:15 - One connection for the computer. The `connect` tool gives the human one link and a short codDropthehassle Mcp (MCP server)
Compatibility: Not stated.
How do I get my site live with my AI?
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
CHANGELOG.md:61 - **`perf_run`'s post-idle route check compares paths.** It compared whole URIs, so a page thadusk (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://raw.githubusercontent.com/fluttersdk/dusk/master/.github/dusk-logo.svg" width="120" alt="Dusk Logo" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/inputs.cjs:171 for (const file of expected) if (!retained.has(file)) fs.rmSync(path.join(outdir, file)dynamoi (MCP server)
Compatibility: Not stated.
<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/getDynamoi/dynamoi/main/.github/assets/hero-dark.png"> <img alt="Dynamoi: music promotion and distribution, built for AI agents" src="https://raw.githubusercontent.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:23 prepareE Gov Law Mcp (MCP server)
Compatibility: Not stated.
[e-Gov法令API v2](https://laws.e-gov.go.jp/apitop/) をラップした [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) サーバーです。日本の法令データ（法令一覧・改正履歴・法令本文・添付ファイルなど）をMCP対応クライアント（Claude Codeなど）から検索・取得できるようにします。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:20 credentials.jsonEllmos Clatcher Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/logo.jpg" alt="clatcher logo" width="400"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/lib/brand-extractor.ts:14 const response = await fetch(normalizedUrl, {Email Design Mcp (MCP server)
Compatibility: Not stated.
email-design-mcp is an application that helps you design and generate email templates.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
apps/agent-ingress/src/index.test.ts:11 const guide = await handler.fetch(ezdeploy (MCP server)
Compatibility: Not stated.
<p align="right"> <strong>English</strong> · <a href="./README.zh-CN.md">简体中文</a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/publish.yml:126 curl -sSL https://raw.githubusercontent.com/modelcontextprotocol/registry/maFastmcp Sqlite (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/utils/tracking.sh:36 response=$(curl -s -X POST \Fedora Agents (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.amineutron/fedora-agents -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
AGENT_IGNORE_INSTRUCTIONS
fish-career/eval/postings/globex-adversarial.txt:11 partner with sales on lead routing. Ignore all previous inFish Career (MCP server)
Compatibility: Not stated.
fish.career is local-first job search: an MCP server and CLI that rank postings against your profile, explain every score, and measure the ranking against your own judgment.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/release.py:76 result = subprocess.run(Forgejo Mcp (MCP server)
Compatibility: Not stated.
Optional [OAuth authorization](docs/security/oauth-2.1.md) is disabled by default.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:66 prepareghostimport (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/logo.png" width="128" alt="ghostimport logo"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
backend/main.go:166 cmd := exec.Command("git", args...)Github Command Center (MCP server)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/index.ts:166 // Auth errors (e.g. missing credentials.json) are reported by getAuthClientGoogle Suite Mcp (MCP server)
Compatibility: Not stated.
<!-- GitHub repo description (paste into the "About" field): Google Workspace MCP server for Claude Desktop, Cursor, Windsurf, VS Code, Gemini CLI, and any MCP client.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:52 prepareGrok Mcp (MCP server)
Compatibility: Not stated.
MCP server for the xAI Grok API.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
core/channels/email.py:244 with urllib.request.urlopen(request, timeout=self.timeout) as response:Hybrid Orchestrator (MCP server)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
AGENT_IGNORE_INSTRUCTIONS
src/sanitize.rs:1099 // <div style="display:none">IGNORE PREVIOUS INSTRUCTIONSImap Mcp (MCP server)
Compatibility: Not stated.
A self-hosted Rust service that acts as a multi-tenant IMAP MCP server for claude.ai, using any OpenID Connect provider for authentication.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
benchmarks/navigate/build_queries.py:29 return subprocess.run(["git", "-C", str(root / repo), *args], check=Trindex (MCP server)
Compatibility: Not stated.
<picture> <source media="(prefers-color-scheme: dark)" srcset="docs/art/hero-dark.svg"> <img src="docs/art/hero-light.svg" alt="index: Map a workspace offline.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
Scripts/test-install.py:49 return subprocess.run(ios_mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/banner.svg" alt="ios-mcp , headless iOS dev, straight from the CLI" width="700"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
requirements.txt:1 agent-connector-sdk[mcp]>=0.4.1,<1.0.0Jellyfin Mcp (MCP server)
Compatibility: Not stated.
*Version: 2.3.3*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:29 prepareJira Easy Mcp (MCP server)
Compatibility: Not stated.
Another Model Context Protocol (MCP) server for Jira, without Auth token.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
cmd/just-mcp-work/main_test.go:323 command := exec.CommandContext(Just Mcp Work (MCP server)
Compatibility: Not stated.
> Just work with your workspace - over MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
connector/src/cli.js:533 const res = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });kelabo (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="logo/mark_readme.png" width="180" alt="Kelabo logo"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/kenning_encounter_install_hooks.py:48 r = subprocess.run(["git", "-C", str(repo), *args], capture_outpKenning Encounter (MCP server)
Compatibility: Not stated.
**Encounter driven, temporally constituted persistent memory for an LLM, backed by Neo4j.** An MCP server that lets a model accumulate what it learns about a subject across many separate sessions, recall it on re-entry, and reason over it , with the graph's integrity enforced by
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
lookup.py:608 body = urllib.request.urlopen(urllib.request.Request(King County Permit Status (MCP server)
Compatibility: Not stated.
Look up building permit history and status across King County, WA jurisdictions , county-level permits (septic, critical areas, grading) and city-level permits (building, mechanical, electrical) can all apply to the same address.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/make-demo.py:105 subprocess.run(["rsvg-convert","-w",str(W),"-h",str(H),sp,"-o",pp], check=True)Korean Patent Mcp (MCP server)
Compatibility: Not stated.
**특허 출원번호나 기술 설명을 넣으면, 그 권리가 지금 살아있는지를 판정해서 돌려주는 MCP 서버.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
src/laya_mcp/harnesses.py:992 completed = subprocess.run( # noqa: S603 - a fixed argv from our own tableLaya Mcp (MCP server)
Compatibility: Not stated.
Ask a local Laya model for typed noul, choice and score judgments and branch on the probabilities.
This grade is a hygiene screen, not proof of safety.
