Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 201 to 250 of 1,860 MCP, Grade C entries. Page 5 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
.github/actions/gate-estilo/comparar.py:47 return subprocess.run(Excalidraw Icons Mcp (MCP server)
Compatibility: Not stated.
A **faster** Excalidraw MCP server built around **real vendor icons**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:15 prepareFabric Mcp Server (MCP server)
Compatibility: Not stated.
1.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:11 postinstallFacebook Ads Library Mcp (MCP server)
Compatibility: Not stated.
Public repository proxy-intell/facebook-ads-library-mcp.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:14 prepareFastmail Mcp (MCP server)
Compatibility: Not stated.
An **unofficial** Model Context Protocol (MCP) server that provides access to the Fastmail API, enabling AI assistants to interact with email, contacts, and calendar data.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
README.md:421 subprocess.run(['trivy', 'image', 'myapp:latest'])FedRAMP 20x Requirements (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.KevinRabun/FedRAMP20xMCP -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:9 prepareFigma Mcp Bridge (MCP server)
Compatibility: Not stated.
Figma Plugin & MCP server to bypass API limits
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:27 postinstallfigwright (MCP server)
Compatibility: Not stated.
Free, two-way Figma MCP server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
servers/files/scripts/build-mcpb.mjs:34 await fs.rm(out, { recursive: true, force: true });Files (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:40 prepareFileToPDF (MCP server)
Compatibility: Not stated.
A [Model Context Protocol](https://modelcontextprotocol.io) server for [FileToPDF](https://filetopdf.dev).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:32 prepareFirecrawl Mcp Server (MCP server)
Compatibility: Portable across standard formats.
π₯ Official Firecrawl MCP Server - Adds powerful web scraping and search to Cursor, Claude and any other LLM clients.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
flashloans/scripts/verify-contract.js:82 const response = await axios.post(config.apiUrl, new URLSearchParams(FlashBank (MCP server)
Compatibility: Not stated.
Non-custodial, on-chain lending where **your funds stay in your wallet until the moment they're used**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
Flint-Server/api_server.py:147 process = subprocess.run(Flint (MCP server)
Compatibility: Not stated.
FastAPI + MCP stack that turns text prompts into Blender scenes and exports USDZ files via `export_model.py`.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
test_brands.ts:8 const resp = await axios.post(`${BASE_URL}/mcp?api_key=${API_KEY}`, {Fodda Brand Intelligence (MCP server)
Compatibility: Not stated.
Brand health & trend footprint across PSFK expert graphs with citable sources, not web summaries.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
lib/foobar2000_sdk/foobar2000/SDK/commonObjects.h:104 ret.fetch();foo_ui_webview2 (MCP server)
Compatibility: Not stated.
English | [δΈζ](./README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
npm/install.js:193 else fs.unlinkSync(path.join(binDir, name));forgemax (MCP server)
Compatibility: Not stated.
**Code Mode MCP Gateway** , collapses N servers x M tools into 2 tools (~1,000 tokens).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
src/fossick/github_client.py:268 result = subprocess.run(Fossick (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="assets/logo.png" alt="Fossick" width="220" />
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/rules/database.rs:342 // SEC003-TS: Command Injection via os.system() (Python, tree-sitter)Fossil Mcp (MCP server)
Compatibility: Not stated.
**The code quality toolkit for the vibe coding era.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
agent/experimental/cups-printer-status-adapter/adapter.py:33 completed = subprocess.run(free4chat (MCP server)
Compatibility: Not stated.
Temporary rooms for Humans and AI Agents , run, supervise and steer Agent Tasks without a permanent workspace.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:20 prepareFresh Jots (MCP server)
Compatibility: Not stated.
A [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server for [Fresh Jots](https://freshjots.com).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_MINIFIED_PAYLOAD
src/dashboard-server.js:6 const proxy=(req,res)=>{const p=http.request({hostname:'127.0.0.1',port:upstreamPortFRESH Shared URL Freshness Intelligence (MCP server)
Compatibility: Not stated.
**Know whether to fetch again.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
scripts/consumer-smoke.py:57 completed = subprocess.run(command, cwd=cwd, env=environment, text=True, check=FaFsMcp (MCP server)
Compatibility: Not stated.
**FsMcp is an idiomatic F# toolkit for building [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) servers and clients.** It wraps the official [Microsoft ModelContextProtocol .NET SDK](https://github.com/modelcontextprotocol/csharp-sdk) with computation expressions
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +2 more
examples/bulk-tag-folder/bulk_tag.py:37 response = requests.post(Gemina (MCP server)
Compatibility: Not stated.
Extract, search and tag any document: invoices, receipts, contracts, templates.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:20 prepareGemini Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server for integrating Google's Gemini 3 models with Claude Code, enabling powerful collaboration between both AI systems.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/utils/chunkCache.ts:87 fs.unlinkSync(filePath);Gemini Mcp Tool (MCP server)
Compatibility: Not stated.
MCP server that enables AI assistants to interact with Google Gemini CLI, leveraging Gemini's massive token window for large file analysis and codebase understanding
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
scripts/chess-consensus/uci.go:89 cmd := exec.Command(path)Gemot Deliberation Server (MCP server)
Compatibility: Not stated.
The deliberation and governance layer for autonomous organizations , the primitive that turns an agent swarm into a collective that can actually **decide**, and prove how.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:14 prepareGenerative Ui Mcp (MCP server)
Compatibility: Not stated.
An MCP server that teaches AI models to generate interactive visualizations , charts, diagrams, mockups, and more.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
packages/gg_api_core/src/gg_api_core/tools/find_current_source_id.py:141 result = subprocess.run(ggmcp (MCP server)
Compatibility: Not stated.
Bring GitGuardian's secret detection and incident management into your AI agent.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
manual-tests/test_sandbox.js:7 const res = UrlFetchApp.fetch(url);ggsrun (MCP server)
Compatibility: Not stated.
Antigravity CLI plugin for safe Google Apps Script development via ggsrun MCP and sandbox guardrails.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:29 prepareGistpad Mcp (MCP server)
Compatibility: Not stated.
An MCP server for managing and sharing your personal knowledge, daily notes, and reuseable prompts via GitHub Gists.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
internal/acquire/acquire.go:117 cmd := exec.CommandContext(ctx, name, args...)gitcontribute (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:9 postinstallGithub Brain (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="logo.svg" alt="GitHub Brain Logo" width="150" height="150"> <h1>GitHub Brain MCP Server</h1> </div>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
src/transports/cli/cli_transport.go:68 cmd := exec.CommandContext(ctx, cmdPath, args...)Go Utcp (MCP server)
Compatibility: Not stated.
`go-utcp` is the Go implementation of the [Universal Tool Calling Protocol (UTCP)](https://github.com/universal-tool-calling-protocol).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
server.go:261 cmd := exec.CommandContext(listCtx, "go", "list", "-f", "{{.ImportPath}}\t{{.Doc}}", importPath+Godoc Mcp (MCP server)
Compatibility: Not stated.
`godoc-mcp` is a Model Context Protocol (MCP) server that provides efficient access to Go documentation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:40 prepareGodot Mcp (MCP server)
Compatibility: Not stated.
MCP server for full Godot 4.x engine control: 157 tools for AI-driven game development (GDScript and C#/.NET).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
cli/src/lib/create-project.ts:301 fs.rmSync(filePath, { force: true });Godot Mcp (MCP server)
Compatibility: Not stated.
<div align="center" width="100%">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/install.sh:185 # This wraps curl or wget. Try curl first, if not installed,goku (MCP server)
Compatibility: Not stated.
Goku is a high-performance, scalable HTTP load-testing tool designed for benchmarking and performance analysis of web services.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/fleet_e2e_diagnostic.py:312 shutil.rmtree(diag_dir, ignore_errors=True)gomaa (MCP server)
Compatibility: Not stated.
**Production-grade, local-first hierarchical & neuro-inspired cognitive memory engine for autonomous AI agents (v4.0.0 , "Gomaa Neo").**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
backend/gonzales/static/assets/query-CSQiZfg4.js:17 t).call(this,{type:"invalidate"})}async fetch(t,s){var E,Cgonzales (MCP server)
Compatibility: Not stated.
``` βββββββ βββββββ ββββ βββββββββββ ββββββ βββ ββββββββββββββββ ββββββββ ββββββββββββββ ββββββββββββββββββββββ ββββββββββββββββ βββ βββββββ βββββββββ βββ βββββ βββββββββββ ββββββ ββββββββ βββ ββββββ βββββββββββββ βββββ βββββββββββ ββββββ ββββββββ βββββββββββββββββββββ ββββββββββ
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:13 prepareGoogle Ads (MCP server)
Compatibility: Not stated.
**MCP server for Google Ads , diagnose spend efficiency, impression share, and asset performance from Claude.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
requirements.txt:1 google-ads>=25.0.0Google Ads Mcp (MCP server)
Compatibility: Not stated.
A comprehensive Model Context Protocol (MCP) server for Google Ads API integration, enabling AI assistants like Claude, ChatGPT, and Gemini to analyze, manage, and optimize Google Ads campaigns through natural language conversations.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/services/error-reporting/resources.ts:52 const response = await fetch(apiUrl, {Google Cloud Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol server that connects to Google Cloud services to provide context and tools for interacting with your Google Cloud resources.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:26 prepareGoogle CrUX MCP (MCP server)
Compatibility: Not stated.
MCP server for Google CrUX , check real-user Core Web Vitals and compare mobile, desktop and 40-week trends
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
src/auth/accountStore.ts:289 await fs.unlink(legacyPath);Google Drive Mcp (MCP server)
Compatibility: Not stated.
Connect an MCP client to Google Drive, Docs, Sheets, Slides, and Calendar through one self-hosted server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:14 postinstallGoogle Search (MCP server)
Compatibility: Not stated.
A Playwright-based Node.js tool that bypasses search engine anti-scraping mechanisms to execute Google searches.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
pkg/api/server.go:111 cmd := exec.Command("pgrep", name)gospy (MCP server)
Compatibility: Not stated.
A tool for inspecting and analyzing running Go processes, including goroutine states, memory statistics, and binary information.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
src/index.ts:546 fs.unlinkSync(tempResponseFile);Gpt Image 1 Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="logo.png" alt="GPT Image 1 MCP Logo" width="200"/> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:32 prepareGridar (MCP server)
Compatibility: Not stated.
SEO toolkit for Quebec sites: audits, Google.ca rankings, keywords, AI-search visibility.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
src/commands/mod.rs:25 self.commands.get(name).map(|cmd| cmd.as_ref())groundhog (MCP server)
Compatibility: Not stated.
Groundhog's primary purpose is to teach people how Cursor and all these other coding agents work under the hood.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:13 prepareGuild Wars 1 Build Compiler (MCP server)
Compatibility: Not stated.
Guild Wars 1 build compiler: real skill and hero data, plus an encoder that turns a build into an official in-game template code after validating it against the game's rules.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:19 postinstallHackTricks MCP Server (MCP server)
Compatibility: Not stated.
MCP (Model Context Protocol) server for searching and querying [HackTricks](https://github.com/carlospolop/hacktricks) pentesting documentation directly from Claude.
This grade is a hygiene screen, not proof of safety.
