Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 301 to 350 of 1,860 MCP, Grade C entries. Page 7 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST OBFUSCATION_MINIFIED_PAYLOAD
api/agent/sweep.ts:75 const res = await fetch(`${ESTATE_URL}/${path}`, {io.github.Bahamas1717/aibvf-mcp (MCP server)
Compatibility: Not stated.
Turn an AI proposal into a decision brief: the verdict, the evidence gaps and the next action for the person who owns the work.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED SECRETS_PATH_CREDENTIAL
package.json:55 @modelcontextprotocol/sdkio.github.Baneado98/cloud-pathfinder (MCP server)
Compatibility: Not stated.
**Attack-path auditor for Infrastructure-as-Code , Terraform, CloudFormation, Kubernetes, CDK, Pulumi, Bicep/ARM.** Not a linter.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
package.json:18 prepareio.github.Berckan/bugherd-mcp (MCP server)
Compatibility: Not stated.
> **Note:** This is an unofficial, community-maintained, open-source (MIT) BugHerd MCP server.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:18 prepareio.github.BitmapAsset/dear-agent (MCP server)
Compatibility: Not stated.
Keep the user's personal life diary for them.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:42 prepareio.github.BlazingCDN/blazingcdn-mcp (MCP server)
Compatibility: Not stated.
Official [Model Context Protocol](https://modelcontextprotocol.io) server for [BlazingCDN](https://blazingcdn.com).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
docs/DESIGN.md:208 | **Tool poisoning / line-jumping / rug pull** | Tool descriptions enter LLM context at `toio.github.Blite-HQ/qnexus-mcp (MCP server)
Compatibility: Not stated.
A community [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server for **Quantinuum Nexus**, wrapping the official [`qnexus`](https://github.com/Quantinuum/qnexus) Python SDK so any MCP-speaking agent (Claude Code, Cursor, VS Code, Codex, …) can inspect Nexus and,
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
hashnode-post-4074524-building-an-ai-shopping-agent-that-actually-buys-things-11b.md:86 result = subprocess.ruio.github.BuyWhere/buywhere-mcp (MCP server)
Compatibility: Not stated.
> **AI agents use BuyWhere to search products, compare prices, and discover deals across Singapore and US merchants in real time.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:15 prepareio.github.Coinversaa/mcp-server (MCP server)
Compatibility: Not stated.
Read-only crypto intelligence for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:53 credentials.jsonio.github.Combjellyshen/zotero-bridge (MCP server)
Compatibility: Not stated.
<p align="right"> <b>🇨🇳 简体中文</b> | <a href="README-en.md">🇬🇧 English</a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:19 prepareio.github.Coolver/home-assistant-mcp (MCP server)
Compatibility: Not stated.
> ⚙️ This MCP server works together with the > [Home Assistant Vibecode Agent](https://github.com/Coolver/home-assistant-vibecode-agent), > installed as a Home Assistant add-on.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:23 postinstallio.github.Creed-Space/creedspace-mcp-server (MCP server)
Compatibility: Not stated.
Universal MCP server for Creed Space - AI safety guardrails in 10 seconds.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
src/windows_mcp/__main__.py:894 mkcert = subprocess.run(["where", "mkcert"], capture_output=True).returncode =io.github.CursorTouch/Windows-MCP (MCP server)
Compatibility: Not stated.
<div align="center"> <h1>🪟 Windows-MCP</h1>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
benchmark/bootstrapbench/cleanup.mjs:87 if (apply) fs.rmSync(dir, { recursive: true, force: true });io.github.DanielBlomma/cortex (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/logo.png" alt="Cortex" width="600" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
scripts/metrics.py:82 out = subprocess.run(io.github.DanielTomaro13/sportsdata-mcp (MCP server)
Compatibility: Not stated.
**Ask your AI which bookmaker is paying more , and get a real answer.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:13 prepareio.github.DeanWard/HAL (MCP server)
Compatibility: Not stated.
HAL is a Model Context Protocol (MCP) server that provides HTTP API capabilities to Large Language Models.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/server.e2e.spec.ts:306 fs.rmSync(tempDir, { recursive: true, force: true });io.github.Digital-Defiance/mcp-screenshot (MCP server)
Compatibility: Not stated.
**Give AI agents visual superpowers to see, analyze, and document your applications like senior UX designers.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
docs/demo/record-demo.sh:6 # curl -sSL -o ~/.local/bin/agg \io.github.Doucs91/hivelore (MCP server)
Compatibility: Not stated.
<p align="center"> <a href="https://github.com/Doucs91/hivelore"> <img src="https://raw.githubusercontent.com/Doucs91/hivelore/main/packages/vscode/media/logo.svg" alt="Hivelore logo" width="96" /> </a> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/tools.test.ts:5 // Mock child_process.spawnio.github.DownAtTheBottomOfTheMoleHole/infracost (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.downatthebottomofthemolehole/infracost -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:13 prepareio.github.DynamicDeals/gunsnation (MCP server)
Compatibility: Not stated.
The Gunsnation MCP Server is a lightweight integration layer that exposes the Gunsnation firearms catalog to AI assistants through the Model Context Protocol (MCP).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/whitelist.ts:237 template: 'timeout 3 curl -sS -o /dev/null -w "HTTP:%{http_code}" {probe} 2>&1; echo " EXio.github.Easton-OU/rootpilot-ssh-diagnose (MCP server)
Compatibility: Not stated.
> This is the open-source, bring-your-own-LLM taste of [RootPilot](https://rootpilotx.com).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:30 postinstallio.github.EthanAckerman-git/preflight-ios-mcp (MCP server)
Compatibility: Not stated.
The most comprehensive MCP (Model Context Protocol) server for iOS Simulator automation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
clients/typescript/src/index.ts:43 /** Override fetch (e.g. node-fetch in older Node, MSW in tests). */io.github.EvidInvest/aether-developer (MCP server)
Compatibility: Not stated.
The search engine whose user is an agent.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
scripts/verify-python-package.py:117 return subprocess.run(command, cwd=ROOT, capture_output=True, text=True)io.github.Evilander/audrey (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="docs/assets/audrey-wordmark.png" alt="Audrey" width="720">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
REGISTRY_PUBLISH.md:77 rm -f ~/.config/mcp-publisher/credentials.json 2>/dev/nullio.github.Fabio662/yieldagentx402 (MCP server)
Compatibility: Not stated.
> **Policy-gated, receipt-backed x402 execution for AI agents** , ShadeGuard before funds move, TEE-attested runs, verifiable proof.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:17 prepareio.github.FastAlertNow/mcp-server (MCP server)
Compatibility: Not stated.
Official Model Context Protocol (MCP) server for [FastAlert](https://fastalert.now).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
go-server/main.go:183 cmd := exec.CommandContext(ctx, cfg.cliPath, "sts", "get-caller-identity", "--output", "io.github.FerhatDundar/aws-mcp-connector (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
go-server/main.go:201 cmd := exec.CommandContext(ctx, cfg.cliPath, "auth", "status")io.github.FerhatDundar/ghcli-mcp-connector (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
test-subjective.cjs:372 const req = https.request({io.github.Finanzgoblin/spectra-mcp-server (MCP server)
Compatibility: Not stated.
Multi-protocol yield intelligence for AI agents , covering [Spectra Finance](https://spectra.finance), [Pendle](https://pendle.finance), and [Morpho](https://morpho.org) via the [Model Context Protocol](https://modelcontextprotocol.io).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
calibratge/calibra.py:94 r = subprocess.run(io.github.FixemBCN/mcp-bifrost (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.FixemBCN/mcp-bifrost -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_UNCONFIRMED OBFUSCATION_ENCODED_BLOB
local-docs/src/plesk_local_docs_mcp/database.py:200 shutil.rmtree(child)io.github.FlayedOne/plesk-mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.FlayedOne/plesk-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:42 prepareio.github.Flightradar24/fr24api-mcp (MCP server)
Compatibility: Not stated.
This [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server provides access to the Flightradar24 API for real-time and historical flight data.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:20 prepareio.github.FlywheelStudio/ulink (MCP server)
Compatibility: Not stated.
> Connect your Ulinkly deep linking projects to Claude Code, Cursor, Windsurf, and other AI assistants.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:34 prepareio.github.Forge-Space/branding-mcp (MCP server)
Compatibility: Not stated.
<div align="center"> <a href="https://forgespace.co"> <img src="https://brand.forgespace.co/logos/wordmark.svg" alt="Forge Space" height="48"> </a> <h1>@forgespace/branding-mcp</h1> <p>AI-powered brand identity generation via MCP , part of the <a href="https://github.com/Forge-S
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:52 prepareio.github.Goingparabolic/oak-longevity-mcp-server (MCP server)
Compatibility: Not stated.
> An [MCP](https://modelcontextprotocol.io) server for **longevity & metabolic medicine** , a medication catalog, evidence-based dosing protocols, contraindication screening, drug-interaction checks, required baseline labs, ongoing monitoring plans, FDA/compounding regulatory st
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/cloud-operator/antigravity/install.sh:106 command -v curl >/dev/null 2>&1 || die "curl is needed to doio.github.GoogleCloudPlatform/gemini-cloud-assist-mcp (MCP server)
Compatibility: Not stated.
> [!IMPORTANT] > **Private Preview Notice** > The Gemini Cloud Assist MCP server APIs are currently in Private Preview and are behind an allowlist.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
README.md:266 curl -sL https://raw.githubusercontent.com/HaD0Yun/Gopeak-godot-mcp/main/install-addon.sh | bashio.github.HaD0Yun/gopeak (MCP server)
Compatibility: Not stated.
🌐 **Languages**: **English** | [한국어](README-ko.md) | [日本語](README-ja.md) | [Deutsch](README-de.md) | [Português](README-pt_BR.md) | [简体中文](README-zh.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:20 prepareio.github.HeroSizy/cucumberstudio (MCP server)
Compatibility: Not stated.
> *Vibe Coded with Claude Code and Pu-Er 🍵*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
lib/jar-runner.js:100 fs.unlinkSync(tmp);io.github.HuynhKhanh1402/dejared (MCP server)
Compatibility: Not stated.
Java decompiler and JAR analyzer.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:53 prepareio.github.HYPD-AI/openai-ads-mcp (MCP server)
Compatibility: Not stated.
A [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server for the **OpenAI Ads (Advertiser) API**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
src/db_conn_mcp/doctor.py:336 inside = subprocess.run(io.github.Idle-Sync/db-conn-mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Idle-Sync/db-conn-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:20 prepareio.github.InnarM/blank-invoice-maker (MCP server)
Compatibility: Not stated.
An [MCP](https://modelcontextprotocol.io) server that lets any AI assistant (Claude, and other MCP clients) create invoices with **[Blank Invoice Maker](https://blankinvoicemaker.com)** , the free, no-signup, no-watermark invoice generator.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
src/api/oauth2/filestore.ts:389 await fs.unlink(tmpPath).catch(() => undefined);io.github.IvanBBaev/x-mcp-ai (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
package.json:52 @clack/promptsio.github.Ivy-Innovation/cubelife (MCP server)
Compatibility: Not stated.
Give your AI agent a living pixel-art companion.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/dashboard.ts:132 function getJSON(url) { return fetch(url).then(function (r) { return r.json(); }); }io.github.JasonCZMeng/assay (MCP server)
Compatibility: Not stated.
**The quality oracle for the x402 agent economy** , [x402](https://www.x402.org/) being the open protocol that lets machines pay for HTTP APIs with stablecoin micropayments.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:43 prepareio.github.JigSawFr/eurodns-mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/simulation.py:866 subprocess.check_call([sys.executable, "-m", "pip", "install", "--user", "--break-syio.github.JKHeadley/moltbridge (MCP server)
Compatibility: Not stated.
**Professional network intelligence for AI agents.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:51 prepareio.github.JoernBerkefeld/mcp-server-mcdev (MCP server)
Compatibility: Not stated.
MCP (Model Context Protocol) server for **[Accenture SFMC DevTools](https://github.com/Accenture/sfmc-devtools)** (`mcdev`): search the project wiki offline, learn `.mcdevrc.json` concepts (markets, `marketList`, `createDeltaPkg`, validations), walk component checklists (e.g.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:39 prepareio.github.JoJoLaBagarre/france-travail-mcp (MCP server)
Compatibility: Not stated.
> Serveur **MCP (Model Context Protocol)** pour les **API officielles de France Travail** : offres d'emploi, référentiel des métiers **ROME 4.0**, prédiction **ROMEO**, et entreprises qui recrutent (**La Bonne Boîte**).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
src/chabbat.ts:120 const resp = await fetch(ANTHROPIC_URL, {io.github.JonathanB555/torah-mcp (MCP server)
Compatibility: Not stated.
**A source discipline for Claude** , never quote Torah from model memory.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:25 prepareio.github.JustinBeckwith/gongio-mcp (MCP server)
Compatibility: Not stated.
<img src="gong.png" alt="A cute red panda hitting a gong" width="300" />
This grade is a hygiene screen, not proof of safety.
