Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 151 to 200 of 1,860 MCP, Grade C entries. Page 4 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
src/context_diamond/repo.py:95 completed = subprocess.run(Context Diamond (MCP server)
Compatibility: Not stated.
> Stop pasting the same messy context into every LLM.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
ch01/javascript/ollama-local-basic/ollama-local-basic.js:29 const response = await fetch(`${ollamaHost}/api/geContext Engineering (MCP server)
Compatibility: Not stated.
**Context engineering** can be defined as the practice of designing systems that provide a Large Language Model (LLM) and AI agents with all the necessary information to complete a task effectively.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
src/git-hook-manager.ts:107 fs.unlinkSync(hookPath);Context Sync (MCP server)
Compatibility: Not stated.
Local-first project memory for AI coding tools over MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
bin/contextburn:334 r = subprocess.run(["python3", "-"] + args, input=src, capture_output=True, text=True, timcontextburn (MCP server)
Compatibility: Not stated.
Run efficiency for coding agents: share of paid tokens that became output, not context re-reading.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK
src/indexer.ts:124 fs.rmSync(lockPath, { force: true });Contextful (MCP server)
Compatibility: Not stated.
⚠️ This is in early alpha.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
packages/cli/src/commands/server.ts:125 await fs.unlink(pidFile);ContextPods (MCP server)
Compatibility: Not stated.
> _The comprehensive MCP development suite with advanced protocol features_
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:8 id_rsaCoralSwarm Connect (MCP server)
Compatibility: Not stated.
Search and save your coding work in a CoralSwarm ocean: sessions, decisions, meetings.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugin/mcp/countbean_mcp/hosted.py:345 with urllib.request.urlopen(req, timeout=self.cfg.timeout) as resp:Countbean Plugin (MCP server)
Compatibility: Not stated.
Hosted plain-text accounting in Claude Code: a git-backed [Beancount](https://beancount.github.io/) ledger, AI ingestion of statements and receipts into validated double-entry, and HTML/Excel reports.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
plugins/creative-claw/skills/creativeclaw-render-html/references/project-packaging.md:25 4. When files change,Creative Claw (MCP server)
Compatibility: Not stated.
On-brand creative studio for AI agents: images, video, audio, and 3D.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/creator_seo_mcp/onpage.py:35 resp = httpx.get(Creator SEO MCP (MCP server)
Compatibility: Not stated.
An MCP server for content creators that connects Google Search Console to your page content and ranks every SEO opportunity by estimated revenue, not vanity clicks.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:17 prepareCred 1 (MCP server)
Compatibility: Not stated.
Look up domain credibility scores using the CRED-1 open dataset.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:39 prepareCrystallize MCP (MCP server)
Compatibility: Not stated.
MCP server for [Crystallize](https://crystallize.com) headless commerce.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL
cursor_notebook_mcp/sftp_manager.py:668 os.remove(op_path)Cursor Notebook Mcp (MCP server)
Compatibility: Not stated.
This directory contains a Model Context Protocol (MCP) server designed to allow AI agents **within Cursor** to interact with Jupyter Notebook (`.ipynb`) files.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
Benchmarks/stream_gaps.py:99 response = urllib.request.urlopen(request, timeout=600)Daisy App (MCP server)
Compatibility: Not stated.
A Mac app that records your meetings and transcribes them on-device, with a local MCP server so Claude can read your calls.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
infra/aws_runner/batch_deploy.py:265 subprocess.run(Darwin Agentic Cloud (MCP server)
Compatibility: Not stated.
**Paper:** [Bounded Execution and the Containment of Agent Traps](docs/bounded-execution.pdf) (preprint, SSRN under review)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/datasentry/client.py:394 shutil.rmtree(target)DataSentry (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Jackxiaozhiren/datasentry -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
internal/cli/auth.go:72 c = exec.Command("open", url)DATPAQ (MCP server)
Compatibility: Not stated.
34 production API tools over one hosted MCP endpoint.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
crates/mysql/src/tools/list_functions.rs:251 .fetch(dbmcp (MCP server)
Compatibility: Not stated.
A single-binary [MCP](https://modelcontextprotocol.io/) server for SQL databases.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
core/config-history.js:45 for(const f of files.slice(200)) fs.rmSync(path.join(d,f.n),{force:true});deliberation (MCP server)
Compatibility: Not stated.
Use when you want a delegated second opinion or implementation from GPT (Codex), Gemini, Grok (xAI), or OpenRouter (config-driven, 400+ models) - seven expert subagents (Architect, Plan Reviewer, Scope Analyst, Code Reviewer, Security Analyst, Researcher, Debugger) and bundled as
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
.github/workflows/validate.yml:75 code = subprocess.run(["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}"den Korean AEC knowledge, curated (MCP server)
Compatibility: Not stated.
Curated Korean AEC expertise for AI agents: KDS·KCS·KS, building law, practice, and the reasoning.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/cli.js:130 const response = await fetch(url, { ...init, headers: { Accept: "application/json", ...init.heaDeploy to Agents (MCP server)
Compatibility: Not stated.
Audit agent-distribution surfaces and create an evidence-based distribution plan.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
scripts/doctor.sh:47 ping_response=$(curl -sS -m 10 -X POST "${DAEMON_URL}/json_rpc" \DERO MCP Server (MCP server)
Compatibility: Not stated.
Query the DERO privacy blockchain and its documentation through the dero-mcp-server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:18 preparedev.ezstat/ezstat-mcp-server (MCP server)
Compatibility: Not stated.
A standalone [Model Context Protocol](https://modelcontextprotocol.io) server for [EzStat](https://ezstat.dev).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
examples/programmatic-usage.ts:34 // --- Resilient fetch (SSRF-guarded, retry, timeout) ---dev.forgesworn/402-mcp (MCP server)
Compatibility: Not stated.
**Nostr:** [`npub1mgvlrnf5hm9yf0n5mf9nqmvarhvxkc6remu5ec3vf8r0txqkuk7su0e7q2`](https://njump.me/npub1mgvlrnf5hm9yf0n5mf9nqmvarhvxkc6remu5ec3vf8r0txqkuk7su0e7q2)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
packages/core/src/ktx2.ts:106 await fs.rm(workDir, { recursive: true, force: true });dev.glbforge/glbforge (MCP server)
Compatibility: Not stated.
**glbforge.dev** · raw AI mesh in, shipped asset out
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
client/index.ts:99 const res = await fetch(`${this.baseUrl}${path}`, {dev.veritap/agent-memory (MCP server)
Compatibility: Not stated.
**Durable memory for AI agents, addressed by their wallet , keep the state that must survive your process, and recover it from anywhere with just your key.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
scripts/reset-database.js:26 fs.unlinkSync(dbPath);Devmind Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:20 postinstallDiscogs Mcp (MCP server)
Compatibility: Not stated.
A powerful **Model Context Protocol (MCP) server** that enables AI assistants to interact with your personal Discogs music collection.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +1 more
src/cli.ts:1077 fs.rmSync(path.join(npxDir, entry), { recursive: true, force: true });Discord Mcp (MCP server)
Compatibility: Not stated.
**Manage your entire Discord server from Claude Code, Claude Co-Work, Claude Desktop, Cursor, or Windsurf.** 139 admin tools across 20 categories , roles, channels, members, messages, threads, moderation, forums, stages, webhooks, events, polls, DMs, and more.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
.mcpregistry_registry_token:1 {"token":"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJtY3AtcmVnaXN0cnkiLCJleDiscrete Structures (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
cmd/decionis/governcmd.go:149 child := exec.Command(command[0], command[1:]...)docker (MCP server)
Compatibility: Not stated.
<!-- Badge sweep 2026-08-18: every URL below verified HTTP 200 (rules/discovery.rules.md Rule 1.1), with two branch-lifecycle caveats that resolve at merge: the actions.yml badge endpoint registers when the workflow reaches the default branch (this README publishes in the same me
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:21 prepareDocusign Navigator (MCP server)
Compatibility: Not stated.
Secure Docusign Navigator integration for AI assistants to access and analyze agreement data.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
package.json:20 prepareDr Mcp (MCP server)
Compatibility: Not stated.
Clean your MCPs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
skills/drawio-skill/scripts/aiicons.py:87 def fetch(url):Drawio Skill (MCP server)
Compatibility: Not stated.
Agent skill that turns natural language, code, Terraform/K8s, SQL, OpenAPI, AsyncAPI, Protobuf and GraphQL sources into editable, tested draw.io architecture diagrams: incremental sync, multi-view projection, drift diff, CI architecture tests, whiteboard derasterize, interactive
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
electron/storage/sqlite-manager.js:234 fs.unlinkSync(targetPath);drawio2go (MCP server)
Compatibility: Not stated.
<img width="250px" src="public/icon/logo.svg" align="left"/>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
lib/client.js:250 const response = await fetch(API + path, { cache: 'no-store' });Dsh Chatgpt Bridge (MCP server)
Compatibility: Not stated.
> **Let ChatGPT drive your local DSH agents.** > > 在 ChatGPT 里创建任务、继续会话、监督 Goal、处理审批并检查结果，不用在 ChatGPT 和 DSH 之间反复复制 Prompt。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:190 prepareDsh Mcp Panel (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
src/duckdb_mcp_server/config.py:28 """Named AWS profile from ~/.aws/credentials. If None, the automatic credenDuckdb Mcp Server (MCP server)
Compatibility: Not stated.
A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that gives AI assistants full access to [DuckDB](https://duckdb.org/) , query local files, S3 buckets, and in-memory data using plain SQL.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:42 prepareDynatrace Managed Mcp (MCP server)
Compatibility: Not stated.
Query logs, metrics, events, entities, problems, security vulnerabilities and SLOs from self-hosted Dynatrace Managed clusters, across one or many environments.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
scripts/fetch-docs.ts:5 const files = await fetch(e18e (MCP server)
Compatibility: Not stated.
MCP server that flags inefficient or outdated npm packages and serves migration docs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:23 prepareEasyparser Amazon Product & Seller Data (MCP server)
Compatibility: Not stated.
Real-time Amazon product, seller, and search data for AI agents across 21 marketplaces.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/edinet_mcp/_cache.py:105 shutil.rmtree(self._dir)Edinet Mcp (MCP server)
Compatibility: Not stated.
EDINET XBRL parsing library and MCP server for Japanese financial data.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
scripts/ensure-electron.mjs:49 fs.rmSync(target, { recursive: true, force: true });Electron Mcp Server (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/logo.png" alt="Electron Debug MCP" width="180" height="180" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
skills/general/text-to-speech/references/streaming.md:40 process = subprocess.Popen(ElevenLabs (MCP server)
Compatibility: Not stated.
ElevenLabs voice AI , text-to-speech, voice agents, and speech engine skills, agent management via the ElevenLabs hosted MCP server, plus Architect skills for building and iterating on ElevenLabs agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
src/cache/blob-store.ts:74 await fs.rm(temp, { force: true });Email Mcp (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server providing comprehensive email capabilities via IMAP and SMTP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/fetch-longmemeval.sh:35 if command -v curl > /dev/null 2>&1; thenEngram Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/logo.svg" alt="Engram Logo" width="180" height="180"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
src/engrim/adapters/agy.py:65 subprocess.Popen(engrim (MCP server)
Compatibility: Not stated.
**The Universal Cross-Model & Cross-Agent Episodic Memory Standard.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
requirements.txt:1 mcp>=1.2.0Entscheidsuche Schweizer Gerichtsentscheide (MCP server)
Compatibility: Not stated.
Suche in Schweizer Gerichtsentscheiden aller Instanzen (Bund, Kantone) in DE/FR/IT.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:15 prepareErpnext Mcp Server (MCP server)
Compatibility: Not stated.
A Model Context Protocol server for ERPNext integration
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
evil_winrm_py/evil_winrm_py.py:249 text that Invoke-Expression and add_script() rely on.Evil Winrm Py (MCP server)
Compatibility: Not stated.
Execute commands interactively on remote Windows machines using the WinRM protocol (just faster)
This grade is a hygiene screen, not proof of safety.
