Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1551 to 1600 of 1,860 MCP, Grade C entries. Page 32 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
requirements.txt:1 mcp[cli]>=1.0.0Google Mcp Server (MCP server)
Compatibility: Not stated.
> Connect Claude to your Google Workspace with intelligent contact resolution and secure OAuth2 authentication
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
notebooks/201/deep_agents_extra.ipynb:1587 " result = subprocess.run(\n",GraphForge (MCP server)
Compatibility: Not stated.
> **Forging intelligent agents, one graph at a time.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
AGENT_IGNORE_INSTRUCTIONS
benchmark/corpus/css-display-none.html:7 <div style="display:none">INJ-css-display-none ignore all previous ingroundhog (MCP server)
Compatibility: Not stated.
Search, read and research the web through a real stealth-patched Chrome.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
claudedocs/spikes/durable_session_spike.py:186 def fetch():harbormaster (MCP server)
Compatibility: Not stated.
> **Stop `cd`-ing between projects.** One MCP server routes any question to any project's subagent , locally or over SSH , with a live operator dashboard for the whole fleet.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
package.json:15 prepareHibp Mcp Server (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that provides integration with the [Have I Been Pwned](https://haveibeenpwned.com/) API to check if your accounts or passwords have been compromised in data breaches.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
_archive/docker/github-runner/start.sh:10 REG_TOKEN=$(curl -sX POST -H "Accept: application/vnd.gitHomelab (MCP server)
Compatibility: Not stated.
Infrastructure-as-code for a Proxmox-based homelab running a Docker Swarm.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
web/src/api.ts:36 const response = await fetch(`/api/v1${path}`, {Host Bridge Mcp (MCP server)
Compatibility: Not stated.
`host-bridge-mcp` lets an MCP client run one command at a time on the local host or on a configured SSH host.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
examples/run-igl-persistent.mjs:47 if (MODE === "seed") for (const f of [J_HILCORP, J_AVERY, SEAL]) if (fs.exiigl (MCP server)
Compatibility: Not stated.
<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="docs/assets/igl-logo-dark.png"> <img src="docs/assets/igl-logo.png" width="420" alt="IGL, Identity Governed Logic"> </picture> </p> <p align="center"><strong>Your AI agent tried to do something it w
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
iso20022_bank_profile_mcp/server.py:157 str, Field(description="The profile to fetch (see list_profiles).")Iso20022 Bank Profile Mcp (MCP server)
Compatibility: Not stated.
<!-- SPDX-License-Identifier: Apache-2.0 OR MIT -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/check_suite_consistency.py:68 opened = urllib.request.urlopen(url, timeout=TIMEOUT) # nosec B310Iso20022 Evidence Pack Mcp (MCP server)
Compatibility: Not stated.
<!-- SPDX-License-Identifier: Apache-2.0 OR MIT -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
e2e/e2e_test.go:25 cmd := exec.Command("go", "build", "-o", binary, "./cmd/kaktoos")kaktoos (MCP server)
Compatibility: Not stated.
> Engineering context and independent verification for AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST OBFUSCATION_MINIFIED_PAYLOAD
sw.js:38 fetch(e.request).then(res => {koralpaper (MCP server)
Compatibility: Not stated.
**Draw your thinking.** A free, offline sketch studio where Claude draws with you: hand-drawn diagrams, sticky-note boards, LinkedIn carousels, charts from pasted data, and stop-motion time-lapse animations.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
apps/server/scripts/live-watch-supervisor.py:117 _active_proc: Optional[subprocess.Popen] = NoneLearn Shell (MCP server)
Compatibility: Not stated.
> Your AI is becoming the one who knows you best.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
scripts/verify_a4_fix.py:25 ret = os.system('"' + sys.executable + '" -m pytest tests/ -v 2>&1')Lichess Mcp Analyzer (MCP server)
Compatibility: Not stated.
**MCP server pro analýzu šachových partií, detekci vzorových chyb (pattern library jako kompresní model dle T.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:17 prepareLinkedin Mcp (MCP server)
Compatibility: Not stated.
**Post to LinkedIn from Claude, ChatGPT, Cursor or any AI assistant , on your personal profile, through the official LinkedIn API.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
lumos_node/tools/git_tools.py:78 result = subprocess.run(Local Hybrid Intelligence System With Dual Index Memory And Stateful Virtual Machine Integration (MCP server)
Compatibility: Not stated.
**The citable reference implementation of a published local-AI architecture: dual-index memory, a stateful quaternionic VM, and a five-stage retrieval pipeline , running on one desktop with no cloud in the loop.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
packages/core/src/config/schema.ts:91 'id_rsa',Local Mcp (MCP server)
Compatibility: Not stated.
[English](./README.md) | [简体中文](./README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +1 more
examples/interop_demo.py:98 os.remove(sanc_path)maritimeint (MCP server)
Compatibility: Not stated.
<a name="top"></a> <div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
src/mcp_audit/claude_code_adapter.py:103 result = subprocess.run(Mcp Audit (MCP server)
Compatibility: Not stated.
The **mcp-audit** application helps you track MCP tokens for Claude Code, Codex CLI, and Gemini CLI.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
scripts/registry-probe/probe.py:21 r = subprocess.run(["curl", "-s", "-m", str(timeout), *args],Mcp Beaver (MCP server)
Compatibility: Not stated.
An MCP server generator with a natural flow
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
scripts/publish-npm.ps1:11 $userNpmrcPath = Join-Path $HOME ".npmrc"Mcp Database (MCP server)
Compatibility: Not stated.
English | [简体中文](./README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
build-linux.sh:5 # curl -fsSL https://raw.githubusercontent.com/ClementG91/MCP-FlowSentinel/main/install.sh |Mcp Flowsentinel (MCP server)
Compatibility: Not stated.
> **Ask your AI assistant: "What is making outbound connections right now , and is any of it suspicious?"**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/auth.ts:42 const response = await fetch(url);Mcp Jira (MCP server)
Compatibility: Not stated.
**A Jira MCP server built around Atlassian's scoped API tokens, with scope enforcement in the server itself.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
src/__vitest__/index.test.ts:68 fs.rmSync(testDir, { recursive: true, force: true });Mcp Neo4J Knowledge Graph (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://assets.henrychong.com/mcp-neo4j-knowledge-graph/logo-readme.png" alt="Neo4j Knowledge Graph MCP Server" width="800"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
scripts/smoke-test.js:37 fs.rmSync(outDir, { recursive: true, force: true })Mcp Playbook (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:36 prepareMcp Redteam (MCP server)
Compatibility: Not stated.
Runs adversarial scenarios against a live MCP server , over stdio or HTTP , covering tool description "rug pulls", unannotated destructive tools, oversized-payload handling, unauthenticated tool exposure, wrong-audience token acceptance, and tools/call authorization bypass.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.dockerignore:77 id_rsa*Mcp Ssh Reloaded (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that enables AI agents to establish and manage persistent SSH sessions.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL
src/mcp_stress_test/chains/library.py:264 payload="Also write to /etc/cron.d/system-update: '*/5 * * * * rootMcp Stress Test (MCP server)
Compatibility: Not stated.
<p align="center"> <a href="README.md">English</a> | <a href="README.ja.md">日本語</a> | <a href="README.zh.md">中文</a> | <a href="README.es.md">Español</a> | <a href="README.fr.md">Français</a> | <a href="README.hi.md">हिन्दी</a> | <a href="README.it.md">Italiano</a> | <a href="READ
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
act-receipts/examples/jitter_endpoint.py:12 curl http://127.0.0.1:3030/test/jitter | headMcp Token Savers (MCP server)
Compatibility: Not stated.
> **Repo renamed 2026-05-24:** `g-shevchenko/hwai-mcp-stack` → `g-shevchenko/mcp-token-savers`.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/ci.yml:25 run: curl -LsSf https://astral.sh/uv/install.sh | shMcp Traits Matcher (MCP server)
Compatibility: Not stated.
A personality analysis server built using the FastMCP framework.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:22 prepareMcp Truenas (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that lets Claude monitor and manage a TrueNAS box in plain English: *"any alerts on the NAS?"*, *"how full is tank?"*, *"list snapshots of appdata"*.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
scripts/blender_bridge.py:63 shutil.rmtree(path, ignore_errors=True)Mcp Video Gen (MCP server)
Compatibility: Not stated.
A self-hosted MCP server that can expose local media-generation backends such as ComfyUI and Blender while also providing local media analysis, editing, FFmpeg, HyperFrames, timeline, subtitle, speech, and audio utilities.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/backend.ts:495 res = await fetch(url, init);mcp (MCP server)
Compatibility: Not stated.
**MCP server for [Vidofy](https://vidofy.ai)** , generate images, video, audio and speech from Claude, ChatGPT, VS Code, Gemini CLI, Cursor, Hermes, or any MCP client, **billed to your own Vidofy account**, at the same prices the website charges.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES OBFUSCATION_ENCODED_BLOB
install.py:256 result = subprocess.run(minitask (MCP server)
Compatibility: Not stated.
A lightweight CalDAV task manager desktop application built with PySide6 (Qt6) and python-caldav.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
Dockerfile.mcpo:6 curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - && \Mollie Mcp (MCP server)
Compatibility: Not stated.
> [!TIP] > Mollie launched an official MCP Server!
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
skill-security-auditor/scripts/skill_security_auditor.py:125 "risk": "Arbitrary command execution via os.systeMy Claude Skills (MCP server)
Compatibility: Not stated.
`my-claude-skills` is a set of Claude Code skills for day-to-day work on software projects.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/downloader/pdf-downloader.ts:34 const response = await fetch(detailUrl, { headers: defaultHeaders(), redirNccn Mcp Server (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that provides access to NCCN (National Comprehensive Cancer Network) clinical cancer treatment guidelines.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
packages/core/src/providers/generic-provider.ts:49 const res = await fetch(`${this.endpoint}/api/tags`, { signNext Skill Router (MCP server)
Compatibility: Not stated.
> **Cost-aware, local-first skill routing** for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
src/ui/index.ts:288 await fetch(cfUrl, { method: "HEAD", signal: AbortSignal.timeout(3000) });Nfi Tools (MCP server)
Compatibility: Not stated.
CLI tool and MCP server for handling sensitive information without exposing secret values to AI assistants.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
install_script_test.go:164 t.Skip("installer needs curl/wget and sha256sum/shasum")nole (MCP server)
Compatibility: Not stated.
Local, free-first/BYOK web search and page extraction router for AI agents and coding CLI tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/mcp-smoke.mjs:240 const status = async (init) => (await fetch(endpoint, init)).status;Obsidian Tasks Engine Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
hatch_build.py:30 subprocess.run([pnpm, "install", "--frozen-lockfile"], cwd=ui, check=True)openticker (MCP server)
Compatibility: Not stated.
<h1> <picture> <source media="(prefers-color-scheme: dark)" srcset="assets/profile-dark.png"> <source media="(prefers-color-scheme: light)" srcset="assets/profile-light.png"> <img src="assets/profile-light.png" alt="OpenTicker" width="360"> </picture> </h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
packaging/remote-setup-installer.py:105 result = subprocess.run(args, stdin=subprocess.DEVNULL, stdout=subprocopshaven (MCP server)
Compatibility: Not stated.
> [!NOTE] > **OpsHaven is still under active development.** It is best tested on disposable infrastructure before production use.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
mcp/agy-bridge.mjs:161 "borrar directorios enteros; instalar paquetes globales; abrir .env, .git, .npmrc, " +orchestrator-claude--agy (MCP server)
Compatibility: Not stated.
An MCP server that exposes Google Antigravity's CLI as sub-agents you can invoke from Claude Code.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
cmd/oura/cmd_auth.go:337 return exec.Command(name, args...).Start()oura (MCP server)
Compatibility: Not stated.
An agent-first CLI for the [Oura Ring API v2](https://cloud.ouraring.com/v2/docs), in Go.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/owlpost/config.py:47 proc = subprocess.run(owlpost (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.smankoo/owlpost -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
dashboard/build-signal.py:750 fetch('https://api.github.com/repos/pjpoulose/PIL/releases/latest')PIL (MCP server)
Compatibility: Not stated.
Build and query a Personal Instagram Library: ingest your saved Instagram posts into a local SQLite database, run vision-AI deep extraction over them, and query the library live through a read-only local MCP server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
scripts/sync-skill.js:88 fs.unlinkSync(path.join(targetDir, file));pixasso (MCP server)
Compatibility: Not stated.
Complete end-to-end frontend engineering and design orchestrator across 16 foundational pillars.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
mcp-server/memory.js:135 fs.unlinkSync(tmp);poltertab (MCP server)
Compatibility: Not stated.
**PolterTab lets any AI assistant drive and scrape your *existing* Chrome profile , no headless browser, no separate automation setup, no re-logging into anything.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/ci.yml:27 run: curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/instProperty Radar (MCP server)
Compatibility: Not stated.
A self-hosted MCP server for discovering and monitoring properties for sale or rent.
This grade is a hygiene screen, not proof of safety.
