Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 1751 to 1800 of 1,860 MCP, Grade C entries. Page 36 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:35 prepareCap Mcp Plugin (MCP server)
Compatibility: Not stated.
> This implementation is based on the Model Context Protocol (MCP) put forward by Anthropic.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
README.md:358 `~/.grok/mcp_credentials.json`. Then try: "List my 5 most recent unresolved Chatway conversationChatway Mcp Server (MCP server)
Compatibility: Not stated.
Manage Chatway live chat conversations, reply to customers, triage your support inbox, and search your knowledge base from Claude.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:14 prepareCline Mcp Memory Bank (MCP server)
Compatibility: Not stated.
Inspired by [roo-code-memory-bank](https://github.com/GreatScottyMac/roo-code-memory-bank)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/mcp_smoke_test.py:135 proc = subprocess.Popen(Cn Scraper Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://raw.githubusercontent.com/goesByhc/cn-scraper-mcp/master/assets/cn-scraper-mcp-icon.png" alt="CN Scraper MCP 图标" width="220"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED SECRETS_PATH_DOTENV
package.json:28 prepareCode Screenshot Mcp (MCP server)
Compatibility: Not stated.
> MCP server for generating beautiful code screenshots directly from Claude
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
src/codedebrief/cli.py:948 shutil.rmtree(action.path, ignore_errors=True)CodeDebrief (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/codedebrief-wordmark.svg" alt="CodeDebrief" width="420"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
detection-db/opengrep-rules/security-baseline/ssrf.yaml:17 - pattern: fetch($U + ..., ...)codeinspectus (MCP server)
Compatibility: Not stated.
**A local-first, privacy-preserving security MCP server and CLI.** Any AI coding agent (Claude Code, Cursor, Codex, Windsurf, Cline, Aider) can invoke CodeInspectus to scan AI-generated / "vibe-coded" code for real vulnerabilities, map findings to compliance frameworks as honest
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.planning/phases/01-critical-safety/01-02-PLAN.md:313 "/root/.ssh/id_rsa",codeTree (MCP server)
Compatibility: Not stated.
**Stop feeding entire files to your AI agent.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
scripts/ingest/url-fetcher.ts:30 const response = await fetch(url, {Company Docs Mcp (MCP server)
Compatibility: Not stated.
Turn any documentation into an AI-searchable knowledge base.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/mcp-server.js:497 const screenshotResponse = await fetch(result.data.screenshot_url);Crawlbase Mcp (MCP server)
Compatibility: Not stated.
Crawlbase MCP is a Model Context Protocol (MCP) server that bridges AI agents and the live web.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/install.mjs:206 spawnSync("sh", ["-c", "curl -LsSf https://astral.sh/uv/install.sh | sh"], { stdio: "icrowbar (MCP server)
Compatibility: Not stated.
Retrieve CVEs and index them inside your codebase: a local SQLite index of CVEs, exploits and advisories that any tool in your repo can query.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
CLAUDE.md:137 curl http://localhost:8000/health # Control planedeepsecure (MCP server)
Compatibility: Not stated.
<!-- # DeepSecure: Zero-Trust Security Control Plane for AI Agents -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
package.json:22 preparedevcontext (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://i.postimg.cc/sghKLKf6/Dev-Context-banner.png" alt="DevContext Banner" width="100%" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
package.json:36 prepareDevWebUI (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
.github/workflows/release.yml:51 printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/id_ed25519Dexsql Release (MCP server)
Compatibility: Not stated.
English | [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
sandbox/python/wrong_import_order.py:13 response = requests.get(url)dictator (MCP server)
Compatibility: Not stated.
**Fast structural enforcement, before the linters.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/digikala_mcp/catalog.py:105 data = (await fetch("/v1/search/", params))["data"]Digikala Mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.sepehr071/digikala-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
distill_kura/mcp.py:106 with urllib.request.urlopen(req, timeout=timeout) as r:Distill Kura (MCP server)
Compatibility: Not stated.
**A long-term memory for agents that is distilled, not accumulated.** Recall works by *meaning*, writing is gated by *evidence*, and one server can hold several separate memories , one per agent mode , so switching mode switches what the agent remembers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:35 prepareDiy Tools Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that allows you to create custom tools/functions at runtime in any programming language and expose them to Claude or other MCP clients.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +1 more
dna.py:127 result = subprocess.run(Dna Memory (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
scripts/benchmark-logger.mjs:132 fs.unlinkSync(logFile);Fast Filesystem Mcp (MCP server)
Compatibility: Not stated.
<!-- # fast-filesystem-mcp --> <!-- <img width="1460" height="82" alt="image" src="https://github.com/user-attachments/assets/d77b4f8a-2d21-4645-9584-39ae9c7a2c26" /> --> <img width="860" height="92" alt="image" src="https://github.com/user-attachments/assets/f4a8dfea-e922-4306-b
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
clients/gemini.md:116 "GOOGLE_APPLICATION_CREDENTIALS": "/path/to/credentials.json"Finops Mcp Resources (MCP server)
Compatibility: Not stated.
> Open-source **Model Context Protocol (MCP)** resources for **Cloud FinOps**: cloud cost optimization, AI cost management, FinOps automation, tagging governance, cost anomaly detection, and budget monitoring , across AWS, Azure, and GCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
README.md:141 pd download --identity ~/.ssh/id_ed25519 https://pixeldrain.com/u/xxxxxxGo Pixeldrain (MCP server)
Compatibility: Not stated.
`pd` is a command-line interface, Model Context Protocol (MCP) server, and Go SDK for [Pixeldrain](https://pixeldrain.com/).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
package.json:44 prepareHelp Scout Mcp Server (MCP server)
Compatibility: Not stated.
An [MCP server](https://modelcontextprotocol.io) that gives AI assistants direct access to your Help Scout inboxes, conversations, customers, organizations, threads, and Docs knowledge base.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
benchmarks/run_comparison.py:281 proc = subprocess.run(hersona (MCP server)
Compatibility: Not stated.
[**English**](./README.md) · [日本語](./README.ja.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/auth.ts:118 this.fetchImpl = opts.fetch ?? ((input, init) => fetch(input, init));Heypcb Mcp (MCP server)
Compatibility: Not stated.
HeyPCB for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
scripts/dev.py:44 result = subprocess.run(cmd, check=False)Image Gen Mcp (MCP server)
Compatibility: Not stated.
**Empowering Universal Image Generation for AI Chatbots**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
setup_uv.sh:5 curl -LsSf https://astral.sh/uv/install.sh | shipybox (MCP server)
Compatibility: Not stated.
<p align="left"> <img src="docs/images/ipybox-crop-nobg.png" alt="ipybox" width="300"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
bench/baselines/common.py:109 result = await session.fetcher.fetch(url)jevcrawl (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:8 preinstalljs (MCP server)
Compatibility: Not stated.
The MCP spec [requires OAuth 2.1 and other RFCs](https://modelcontextprotocol.io/specification/latest/basic/authorization) for auth.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.dagger/main.go:27 WithExec([]string{"sh", "-c", "curl -qsSf https://just.systems/install.sh | bash -s -- --toJust Mcp (MCP server)
Compatibility: Not stated.
> Transform justfiles into AI-accessible automation tools through the Model Context Protocol
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/workflows/cursor.yml:33 curl https://cursor.com/install -fsS | bashKafka Mcp Server (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server for Apache Kafka implemented in Go, leveraging [franz-go](https://github.com/twmb/franz-go) and [mcp-go](https://github.com/mark3labs/mcp-go).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/biocontext_kb/core/alphafold/_get_alphafold_info_by_uniprot_id.py:28 response = requests.get(url)Knowledgebase Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server for biomedical research that provides a standardized connection layer between artificial intelligence systems and biomedical resources.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
mcp-servers/lingxing-openapi/deploy/install_tailscale_on_ubuntu.sh:40 curl -fsSL https://tailscale.com/installLingxing Mcp (MCP server)
Compatibility: Not stated.
> **作者**：[Zach](https://github.com/zach22-1999) ｜ 公众号「Zach的进化笔记」 > > 把领星 ERP 的读取能力整理成可复用、可共享、可被 Claude Code / Codex / Cursor 直接调用的只读 MCP 基础设施，重点服务技术型卖家和 AI 协作用户。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED OBFUSCATION_MINIFIED_PAYLOAD
src/get-pat.py:99 r = requests.get(Linux Do Mcp (MCP server)
Compatibility: Not stated.
[中文](README_zh.md) / English
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
Dockerfile:22 RUN curl -fsSL https://deb.nodesource.com/setup_18.x | bash - && \Llama Mcp Streamlit (MCP server)
Compatibility: Not stated.
This project is an interactive AI assistant built with **Streamlit**, **NVIDIA NIM's API (LLaMa 3.3:70b)/Ollama**, and **Model Control Protocol (MCP)**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT SECRETS_PATH_UNCONFIRMED
src/llm_wiki_kit/core/extractors.py:262 # youtube-transcript-api v1.0+ uses instance method .fetch() instead oLlm Wiki Kit (MCP server)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
bin/citation_graph.py:67 with urllib.request.urlopen(req, timeout=15) as resp:Llm Wiki (MCP server)
Compatibility: Not stated.
LLM-powered personal wiki , autonomous knowledge base with research-on-miss, ingestion, search, a browsable web UI, and universal data gravity.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
src/modules/openrouter/index.ts:1220 await fs.unlink(TRACKING_FILE_PATH).catch(() => {});Locallama Mcp (MCP server)
Compatibility: Not stated.
Local-first, provider-neutral Model Context Protocol server for coding-agent workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:313 <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALoAAAC6CAIAAACWbMCmAAADVElEQVR42u3dPXLmaitaiyi (MCP server)
Compatibility: Not stated.
>-
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:9 credentials.jsonMcd Cn Assistant (MCP server)
Compatibility: Not stated.
麦当劳中国官方 MCP 智能助手。当用户提到麦当劳、金拱门、麦乐送、到店取餐、麦咖啡、麦麦省、优惠券、领券、活动日历、麦当劳活动、品牌联名、联名款、联名周边、限定、IP合作、积分、麦麦商城、抽奖、点餐、下单、比价、怎么点最划算、拼单、群点、聚餐点餐、办公室下午茶、夜宵拼单、多人点餐、分摊等，优先使用本 skill。四大能力：①获取最新活动推送（查询当月营销活动日历并摘要推送）；②联名关注推送（盯联名/限定活动：按 config/keywords.json 中的关键词筛选活动并推送，默认关键词「联名」+ 同义词扩展，支持对话增删关键词）；③最优惠点餐（门店
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/mcp_audit_tool/rules/supply_chain.py:66 """MAT-004: curl/wget piped into a shell - arbitrary remote code eMcp Audit Tool (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:17 prepareMcp Config (MCP server)
Compatibility: Not stated.
A CLI tool for managing MCP servers configurations for MCP clients.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
README.md:366 | 79 | 2025‑07‑21 | [CVE‑2025‑53832](cves/CVE-2025-53832.md) | MCP05 - Command Injection & ExecuMcp Cve Project (MCP server)
Compatibility: Not stated.
This repository is a curated index of publicly disclosed **Common Vulnerabilities and Exposures (CVEs)** that touch the **Model Context Protocol (MCP)** ecosystem: official and third-party servers, SDKs, gateways, clients, and integrations where MCP is part of the attack surface
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:17 prepareMcp Duckdb Memory Server (MCP server)
Compatibility: Not stated.
A forked version of [the official Knowledge Graph Memory Server](https://github.com/modelcontextprotocol/servers/tree/main/src/memory).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zqk70rzB0" style="display:none">c9YKEXlDiLMwLYS0+DuAKPA8yPJQS0IrLaOn4XMckllFywYbe1PPyWlgMcp Forge Studio Bridge (MCP server)
Compatibility: Not stated.
**AI-powered scripting, terrain, assets, lighting, and bidirectional project sync for your favorite AI coding assistants.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:2 <html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><style>.DFA7Mcp Game Asset Forge (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
cmd/mcp-launcher/main.go:361 dockerCmd := exec.Command("docker", "build", "-t", "mcp-server-dev", "-f", dockerMcp Launcher (MCP server)
Compatibility: Not stated.
``` go run ./cmd/mcp-launcher https://github.com/browserbase/mcp-server-browserbase -d stagehand ```
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
banner_24fc5.svg:11 @font-face{font-family:"Inter";src:url("data:font/woff2;base64,d09GMgABAAAAADUQABEAAAAAf3AMcp Memory Server (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED OBFUSCATION_ENCODED_BLOB
cmd/mcp-nats/transport_integration_test.go:29 build := exec.Command("go", "build", "-o", out, ".")Mcp Nats (MCP server)
Compatibility: Not stated.
[<img alt="Install in VS Code" src="https://img.shields.io/badge/Install%20in%20VS%20Code-007ACC?style=for-the-badge&logo=visualstudiocode&logoColor=white&labelColor=007ACC&color=white&logoWidth=24&logoPadding=8">](https://insiders.vscode.dev/redirect?url=vscode%3Amcp%2Finstall%3
This grade is a hygiene screen, not proof of safety.
