Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1701 to 1750 of 1,860 MCP, Grade C entries. Page 35 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +2 more
requirements.txt:1 agent-connector-sdk[mcp]>=0.4.1,<1.0.0Owncast Agent (MCP server)
Compatibility: Not stated.
*Version: 2.3.3*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.claude/skills/parselbox/SKILL.md:62 Requires Deno (`curl -fsSL https://deno.land/install.sh | sh`) and `pip iParselbox (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.thesanjeetc/parselbox -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
config/mcp-tools.json:57 "description": "Number of recent commits to fetch (default: 5, max: 20)"Pipeline Assistant (MCP server)
Compatibility: Not stated.
**Automated CI/CD failure root-cause analysis powered by GitHub Copilot via ACP (Agent Client Protocol).**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
.agents/skills/pd-extract-python/SKILL.md:253 - `requests.get/post/put/delete(url)`, `requests.Session().get(upizza_doc (MCP server)
Compatibility: Not stated.
**File-based architecture-as-code for systems that are too big to hold in your head but too small to deserve a wiki.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:19 preparePlunk Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol server for [Plunk](https://useplunk.com), the open-source self-hosted email platform.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
r3call-cli/source/api.ts:27 const response = await axios.get(`${API_BASE}/memories`, {r3 (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.n3wth/r3 -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
docs/LOCAL_AI_INTEGRATION.md:266 `http_request` - likely influenced by Python's `requests.post(data=...)`.Raven Nest Mcp (MCP server)
Compatibility: Not stated.
A pentesting toolkit that runs as an [MCP](https://modelcontextprotocol.io/) server, giving AI assistants structured access to industry-standard security tools through a safety-hardened interface.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
apps/desktop/src/components/RequestPane.tsx:188 label: t('Copy as curl without secrets'),Resolvr (MCP server)
Compatibility: Not stated.
**Resolvr is a free desktop GraphQL client for macOS, Linux and Windows that never loses your state , and that an AI agent can drive through the same engine you use.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
frontend/src/lib/api.js:15 const res = await fetch(`${API_BASE}${path}`, {Revora- (MCP server)
Compatibility: Not stated.
> A failed payment is not lost revenue.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
logics/libraries-frameworks/rokit.md:51 curl -sSf https://raw.githubusercontent.com/rojo-rbx/rokit/main/scriptRoblox Logics Mcp (MCP server)
Compatibility: Not stated.
<p align="center"><img src="assets/logo.svg" width="96" alt="Brickwise logo"></p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
lib/engine.mjs:96 res = await fetch(url, {Saferico Cli (MCP server)
Compatibility: Not stated.
Solidity security scanning with **201 detectors that run on your machine**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
sciagent/code_tracker.py:72 result = subprocess.run(sciagent (MCP server)
Compatibility: Not stated.
Welcome to SciAgent!
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
seoagent/pages_run.py:128 with urllib.request.urlopen(req, timeout=timeout) as r:Seo Agent (MCP server)
Compatibility: Not stated.
<!-- Social preview: docs/assets/img/og-seo-agent.png (1280x640).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/index.ts:847 fetch(request: Request, env: Env, ctx: ExecutionContext) {servereverything.dev (MCP server)
Compatibility: Not stated.
A stateless reference [Model Context Protocol](https://modelcontextprotocol.io) server running on Cloudflare Workers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
comparer-mcp/install.sh:33 curl -LsSf https://astral.sh/uv/install.sh | shSheet Music Mcp (MCP server)
Compatibility: Not stated.
Six MCP servers that let an AI assistant work with sheet music: read a photo of a score, render it, play single voice parts, edit it as text, compare editions and follow a singer in real time.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:26 prepareshipboard (MCP server)
Compatibility: Not stated.
**Know what needs to happen next across your repositories.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:25 prepareSih Br Mcp (MCP server)
Compatibility: Not stated.
Servidor MCP (Model Context Protocol) que responde perguntas sobre as **internações hospitalares do SUS** , o SIH/SUS do DATASUS, AIH reduzida , dentro do assistente de IA, sem TabNet, sem baixar `.dbc` do FTP e sem escrever SQL.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:23 prepareSonarr Mcp (MCP server)
Compatibility: Not stated.
Connect AI agents to [Sonarr](https://sonarr.tv/).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST
law_sync.py:53 with urllib.request.urlopen(req, timeout=30) as resp:Startup Law Mcp (MCP server)
Compatibility: Not stated.
**Claude에 URL 하나만 등록하면, 창업 법령 50개·8,191개 조문과 K-Startup 지원사업을 실제 원문을 근거로 답합니다.** LLM이 지어내는 "○○법 제N조" 환각 대신, 인덱스에서 대조한 진짜 조문만.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
backend/mcp_ops.py:611 "reason must not be empty - say what refused the fetch (a 403, a "tailored (MCP server)
Compatibility: Not stated.
Tailored is a local web app that turns job-posting URLs into customized, well-structured resumes and cover letters.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
examples/drive-claude.mjs:43 fs.rmSync(cwd, { recursive: true, force: true });termmirror (MCP server)
Compatibility: Not stated.
An MCP server that gives AI agents real interactive terminal sessions , and a live web view where a human can watch those sessions and type into them.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
scripts/fixtures-record.ts:30 * `globalThis.fetch(...)` directly and offers no per-call injection point, soTiktok Mcp (MCP server)
Compatibility: Not stated.
Drive TikTok from your AI assistant , 11 tools over the Display API and Content Posting API, with OAuth 2.0 (PKCE) and plan-then-execute write safety.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:22 prepareTossinvest Openapi Mcp (MCP server)
Compatibility: Not stated.
> **토스증권 Open API**를 개발자와 AI 에이전트가 쉽게 탐색·연동할 수 있도록 돕는 [MCP](https://modelcontextprotocol.io)(Model Context Protocol) 서버.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST OBFUSCATION_ENCODED_BLOB
scripts/domain-sweep.ts:84 const res = await fetch("https://data.iana.org/rdap/dns.json", {veritap (MCP server)
Compatibility: Not stated.
Check whether a real-world fact can be verified before an agent acts on it.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
tools/comment-vocabulary.py:40 run = subprocess.run(vivac (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
controllers/mcp_bridge/mcp_bridge.py:532 os.remove(path)webotMCP (MCP server)
Compatibility: Not stated.
Full-access MCP server for the [Webots](https://cyberbotics.com) robot simulator.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/vendor_copy.py:14 shutil.rmtree(p)Wsl Port Unified (MCP server)
Compatibility: Not stated.
# wsl-port-unified , WSL + Internet en 1 clic
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
bin/whoami.mjs:75 const r = await fetch(url, {X402 Trinity (MCP server)
Compatibility: Not stated.
**A drop-in `fetch` replacement that lets an AI agent pay for things by itself , with hard spending limits, no hosted wallet service, and no changes to the agent's own code.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/youtube_pub_mcp/auth.py:114 shutil.rmtree(path)Youtube Pub Mcp (MCP server)
Compatibility: Not stated.
Servidor MCP para publicação de vídeos no YouTube, com suporte a múltiplos canais e fila de agendamento em JSON.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
setup.sh:74 curl -LsSf https://astral.sh/uv/install.sh | shAgent Library (MCP server)
Compatibility: Not stated.
A personal knowledge library for AI agents, built on [Arcade](https://arcade.dev) for the Model Context Protocol (MCP).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
Dockerfile:9 && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \Agentic Developer Mcp (MCP server)
Compatibility: Not stated.
This project wraps OpenAI's Codex CLI as an MCP (Model Context Protocol) server, making it accessible through the TeaBranch/open-responses-server middleware.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
apps/cli/scripts/snapshot-models.ts:48 const response = await fetch(url, { signal: controller.signal });agentmako (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="apps/web/public/agentmako.png" alt="agentmako logo" width="180" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:26 prepareAgy Bridge (MCP server)
Compatibility: Not stated.
Use when analyzing large files (>200 lines), more than 3 files at once, deep git/grep searches, web lookups, or adversarial reviews - delegates to the Antigravity CLI via agy-bridge MCP tools to save context.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
opencode/run_opencode_docker.py:38 bytes = subprocess.check_output(cmd, shell=True)Ai Suite (MCP server)
Compatibility: Not stated.
**AI-Suite** is intended to provide an **end-to-end path from zero to working AI workflows and agents** for developers and those who want to enable a local, private **AI solution**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
cmd/aletheia/main.go:417 return exec.Command("git", "-C", root, "check-ignore", "-q", "--", name).Run() == nilaletheia (MCP server)
Compatibility: Not stated.
<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="assets/brand/aletheia-lockup-dark.svg"> <img src="assets/brand/aletheia-lockup.svg" alt="aletheia" width="300"> </picture> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/ISSUE_TEMPLATE/target-request.yml:37 Install: `brew install flyctl` (or `curl -L https://fly.io/instalAll Deploy (MCP server)
Compatibility: Not stated.
>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
internal/bootstrapapply/bootstrap_test.go:210 git := exec.Command("git", "init", "-q")Aoci Code (MCP server)
Compatibility: Not stated.
**A persistent, Git-versioned map of your entire codebase , written by your coding agent, governed by a local MCP server.** Agents read it once and know the system, instead of re-reading the repo on every task.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
scripts/package-smoke.py:81 result = subprocess.run(Apple Health Ai Bridge (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="assets/brand/health-bridge-mark-512.png" alt="" width="80"> <h1>Apple Health AI Bridge</h1> <p>Bring Apple Health into your AI workflow.</p> <p> <a href="https://github.com/roian6/apple-health-ai-bridge/releases"><img src="https://img.shields.io/git
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +1 more
aseprite_mcp/core/commands.py:54 result = subprocess.run(cmd, check=True, capture_output=True, text=True)Aseprite Mcp (MCP server)
Compatibility: Not stated.
A Python MCP server that gives AI assistants full control over [Aseprite](https://www.aseprite.org/) for creating pixel art and animated sprites.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
install.sh:4 # curl -fsSL https://raw.githubusercontent.com/mgorabbani/askdb/main/install.sh | sudo bashaskdb (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/site/assets/logo.png" alt="AskDB" height="48" align="middle" /><strong>AskDB</strong> — Give AI agents safe access to your database.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
agentloop/mcp_server.py:59 proc = subprocess.run(Athena Loops (MCP server)
Compatibility: Not stated.
**agentloop** is a lightweight Python framework for multi-agent orchestration.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
crates/barbacane-control/src/api/router.rs:106 /// WebSocket (`/ws/data-plane`), which authenticates with itsbarbacane (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/img/barbacane_logo_transparent_bg.png" alt="Barbacane" width="200"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
scripts/build-skills-vault.mjs:2123 fs.unlinkSync(dest);Basecoat Ui Mcp (MCP server)
Compatibility: Not stated.
Offline MCP server for Basecoat UI (shadcn/ui look without React): 4-Stage Intent-Driven Tooling Layer, Kanso design direction, and WCAG 2.1/APCA quality inspection.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
beemcp/bee.py:16 response = requests.get(beemcp (MCP server)
Compatibility: Not stated.
**Unofficial** Model Context Protocol (MCP) server for interacting with your [Bee wearable](https://bee.computer/) lifelogging data.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:39 prepareBitcoin Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
examples/notion-electron-bridge/electron-bridge.js:23 await fetch("/api/v1/clipboard/blocks");bla (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
dev.sh:121 text="$("${COMPOSE[@]}" exec -T web curl -sS -m 20 http://127.0.0.1:8000/readyz 2>/dev/null || truebrainoutside (MCP server)
Compatibility: Not stated.
**Your brain, kept outside your head , where your agents can read it.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/bringClient.ts:112 const res = await fetch(`https://api.getbring.com/rest/v2/bringlists/${listUuid}`, {Bring Mcp (MCP server)
Compatibility: Not stated.
This project implements a local Model Context Protocol (MCP) server in TypeScript that exposes the functionalities of the Bring!
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
linux/android-app/setup-toolchain.sh:19 curl -fsSL -o "$tmp/bt.zip" https://dl.google.com/android/repository/bBuddy Android (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/banner.png" alt="Buddy: Claude Code, Codex, OpenCode, Antigravity and Grok in a bubble on your Android phone" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
cli/src/api.ts:41 const res = await fetch(new URL(path, baseUrl), {Callsign Server (MCP server)
Compatibility: Not stated.
<a href="https://devhunt.org/tool/callsign" target="_blank" title="callsign on DevHunt"><img src="https://devhunt.org/badge/callsign.svg" alt="callsign - Featured on DevHunt" width="220" height="54" /></a>
This grade is a hygiene screen, not proof of safety.
