Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 101 to 150 of 1,860 MCP, Grade C entries. Page 3 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
.github/scripts/docs_review_agent.py:93 meta = json.loads(subprocess.check_output(CatchAll (MCP server)
Compatibility: Not stated.
Web search API for comprehensive event retrieval: find every relevant event across the open web, not just the top results.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
xbot/queue_executor.py:186 os.remove(tmp_path)cdpilot (MCP server)
Compatibility: Not stated.
> Zero-dependency browser automation from your terminal.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
conformance/harness/harness.ts:64 const res = await fetch(this.url, {chap (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +2 more
scripts/ensure_hook.py:29 result = subprocess.run(Chatgpt Web2Api (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/gws-token-wrapper.sh:39 resp = json.loads(urllib.request.urlopen(req).read())Claude Code Google Workspace (MCP server)
Compatibility: Not stated.
Give Claude Code access to Gmail, Google Drive, Calendar, Sheets, Docs, and Slack , with full support for multiple Google accounts (e.g., personal + work).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:24 id_rsa*Claude Code Vm (MCP server)
Compatibility: Not stated.
Automated deployment system for Claude Code development environments on Debian VMs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/claude_google_sheets/setup.py:93 credentials_path = os.path.join(self.credentials_dir, "credentials.json")Claude Google Sheets Mcp (MCP server)
Compatibility: Not stated.
A comprehensive Model Context Protocol (MCP) server for Google Sheets integration with Claude.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
api-security/SKILL.md:186 const r = await fetch(url);Claude Security Skills (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="./assets/banner.png" alt="Claude Code Security Skills" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
scripts/build-site.js:186 fs.rmSync(runtimeGraphPath, { force: true })claudemap (MCP server)
Compatibility: Not stated.
Welcome to...
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
assets/mcp-bridge.mjs:134 try { raw = await readFile(join(home, "credentials.json"), "utf8"); }cli (MCP server)
Compatibility: Not stated.
<p align="center"> <h1 align="center">@sandbaseai/cli</h1> <p align="center"> <strong>Give your AI agent superpowers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
cli_anything/zotero/core/discovery.py:73 process = subprocess.Popen(launch_command, stdout=subprocess.DEVNULL,Cli Anything Zotero (MCP server)
Compatibility: Not stated.
**Let AI manage your Zotero library.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:102 @cyanheads/mcp-ts-coreClinicaltrialsgov Mcp Server (MCP server)
Compatibility: Not stated.
Search ClinicalTrials.gov trials, retrieve study details and results, and match patients to candidate trials via MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
server.py:10 CREDENTIALS_FILE = os.path.join(CONFIG_DIR, "credentials.json")cloud.agentdomain/agentdomain-mcp (MCP server)
Compatibility: Not stated.
Register and manage internet domains for AI agents via AgentDomain
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
pkg/aliyun/1203_oss_bucket_only_upload_images.go:132 Request.Body.Code.ZipFile = tea.String("UEsDBBQACAAIANS6hcloudsword (MCP server)
Compatibility: Not stated.
一款帮助云租户发现和测试云上风险、增强云上防护能力的综合性开源工具
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
install.sh:50 VERSION=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name":'Clov Ai (MCP server)
Compatibility: Not stated.
</br>[](#) [](#) [](#)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:12 prepareco.churnkey/churnkey (MCP server)
Compatibility: Not stated.
Read and manage Churnkey cancel flows, retention metrics, and payment recovery
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED OBFUSCATION_ENCODED_BLOB
package.json:11 @atxp/commonCode Sandbox API (MCP server)
Compatibility: Not stated.
Execute Python, JavaScript, or SQL in a sandbox.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
benchmark/test_cli.py:52 result = subprocess.run(cmd, capture_output=True, text=True, cwd=cwd)codeindex (MCP server)
Compatibility: Not stated.
**Temporal code knowledge graph** with blast-radius impact scoring, semantic symbol search, and git-history-aware dependency analysis , for AI-assisted development.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
.cursor/rules/test-coverage-requirements.mdc:250 current_tests = int(subprocess.check_output(codeprism (MCP server)
Compatibility: Not stated.
> **⚠️ IMPORTANT: This project is entirely AI-generated.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/telemetry.ts:210 const response = await fetch(`${AXIOM_INGEST_URL}/${encodeURIComponent(dataset)}/ingest`,CodeQR (MCP server)
Compatibility: Not stated.
Remote MCP server for [CodeQR](https://codeqr.io) with OAuth 2.0 authentication.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
openclaw_codex_mcp/admin.py:113 process = subprocess.run(Codex Control Plane Mcp (MCP server)
Compatibility: Not stated.
English | [Русский](README.ru.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
src/auth/store.ts:266 fs.rmSync(file, { force: true });Codex With Chatgpt (MCP server)
Compatibility: Codex.
ChatGPT thinks.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
src/colab_mcp/server.py:17 os.environ.get("COLAB_MCP_GOOGLE_CREDENTIALS", "~/.config/colab-mcp/credentials.jsoColab Drive MCP (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.YummyTastyCode/colab-drive-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST
package.json:35 preparecom.blackwalltier/blackwall (MCP server)
Compatibility: Not stated.
API-key pre-action risk gate: any irreversible agent action (money, SQL, delete, email).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:21 preparecom.clicksend/clicksend-mcp-server (MCP server)
Compatibility: Not stated.
MCP for ClickSend.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.agents/skills/update-cli-version/SKILL.md:32 curl --proto '=https' --tlsv1.2 -fsSL \com.codescene/codescene-mcp-server (MCP server)
Compatibility: Not stated.
An MCP server that provides CodeScene Code Health analysis tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/oauth.ts:186 const res = await fetch(`${base}/v1.18/teamBoard/list`, {com.dragapp/mcp-server (MCP server)
Compatibility: Not stated.
AI-powered email & WhatsApp for teams , manage your shared inbox from Claude, Cursor or ChatGPT.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:33 preparecom.easyonward/mcp-server (MCP server)
Compatibility: Not stated.
Passport visa, entry & transit requirements for any country pair, with official government sources.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
lib/credentialStore.js:110 try { fs.unlinkSync(f); } catch { /* already gone */ }com.freeelatech/oneda (MCP server)
Compatibility: Not stated.
Persistent, governed institutional memory for Claude Code , specs, decisions, learnings.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
src/auth/TokenManager.ts:102 fs.unlinkSync(this.tokenFile);com.gitscrum/mcp (MCP server)
Compatibility: Not stated.
MCP server for GitScrum , manage tasks, sprints, time tracking, and client workflows via AI
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
scripts/backfill-filecoin.ts:56 const res = await fetch(url);com.hekkova/mcp (MCP server)
Compatibility: Not stated.
TPermanent memory layer for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:8 credentials.jsoncom.htagai/htag-docs (MCP server)
Compatibility: Not stated.
Public HTAG discovery for MCP tools, API endpoints, OpenAPI ops, and agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
scripts/schema_drift.py:71 raw = subprocess.run(com.longbridge/mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://raw.githubusercontent.com/longbridge/longbridge-mcp/main/docs/logo.png" alt="Longbridge" width="120" height="120"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
package.json:17 preparecom.lyrenth/lyrenth-mcp (MCP server)
Compatibility: Not stated.
Read the content of one or many public web pages through Lyrenth, as clean Markdown instead of raw HTML.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
desktop/src-tauri/icons/build_icons.py:51 os.remove(out_png)com.mangofolio/investbrain (MCP server)
Compatibility: Not stated.
> 有经验投资者的纪律自主工具，解决"知行合一"问题 > **不是投顾，不给建议，而是"镜子" + "纪律锚点"**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
mireye_earth_mcp/onboarding.py:48 home / ".config" / "mireye-mcp" / "credentials.json"com.mireye/earth (MCP server)
Compatibility: Not stated.
<!-- mcp-name: com.mireye/earth -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:36 @clerk/nextjscom.onkernel/kernel-mcp-server (MCP server)
Compatibility: Not stated.
A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that provides AI assistants with secure access to [Kernel platform](https://onkernel.com) tools and browser automation capabilities.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
being-exec/install.sh:44 curl -sSL "$BINARY_URL" -o "$TMP"com.ruddia/being-mcp-server (MCP server)
Compatibility: Not stated.
**Personality Runtime for AI** , give any AI its own personality, memory, and identity.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:25 postinstallcom.runmemento/memento (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/memento-banner.png" alt="Memento" width="540"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/intent/empty-document.test.ts:71 await fs.rm(dir, { recursive: true, force: true });com.seanwinslow/intent-engineering (MCP server)
Compatibility: Not stated.
`intent-engineering` is an MCP server that exposes three tools , `audit_intent_spec`, `generate_intent_spec_scaffold`, and `assess_retrofit_level` , letting any MCP-aware client (Claude Desktop, Cursor, Anti-Gravity) review, scaffold, and triage agent intent specs against a 9-s
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:22 preparecom.sportwizzard/sportwizzard (MCP server)
Compatibility: Not stated.
Query live sports-betting data , **odds, player props, +EV edges, arbitrage, stats and reference data** from 35+ sportsbooks and DFS apps , from any MCP-capable AI agent (Claude Code, Claude Desktop, Codex, Cursor, …).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
package.json:17 preparecom.theaslangroupllc.pulse/pulsenetwork (MCP server)
Compatibility: Not stated.
Pay-per-query access to 68 intelligence APIs via x402 (real USDC charges on Base or Solana per call, no API keys, no subscription, no refunds).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
requirements.txt:2 mcp>=1.28,<2com.vandorla/workspace-tools (MCP server)
Compatibility: Not stated.
> ## This is a research honeypot.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
requirements.txt:1 Flaskcom.wallet-connectors/wallet-verifier-mcp (MCP server)
Compatibility: Not stated.
Wallet4Agent provides the **trust layer** that AI Agents need to operate safely in the real world.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/comfy_mcp/argv.py:67 ``subprocess.Popen`` raises a bare ``ValueError: embedded null byte`` on one —Comfy Mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Comfy-Org/comfy-mcp
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
__init__.py:149 result = subprocess.run(Comfy Pilot (MCP server)
Compatibility: Not stated.
Talk to your ComfyUI workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
app/assets/javascripts/completion_kit/application.js:132 fetch(url, {CompletionKit (MCP server)
Compatibility: Not stated.
Prompt evals over MCP: run a prompt on your dataset, score each output 1-5 with an LLM judge.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
src/compoid_mcp/client.py:837 result = subprocess.run(Compoid MCP (MCP server)
Compatibility: Not stated.
A collaborative repository where AI agents and humans share research, images, videos and papers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
examples/whack-a-mole/run.sh:23 for command_name in node npm tmux curl git claude codex; doConcord Mcp (MCP server)
Compatibility: Not stated.
Live messaging for coding agents
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:17 prepareConstruct3 Mcp (MCP server)
Compatibility: Not stated.
> An MCP server that lets Claude, Cursor and other AI assistants read, analyze and safely edit Construct 3 projects , editor-faithful writes with backups and validation.
This grade is a hygiene screen, not proof of safety.
