Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 351 to 400 of 1,860 MCP, Grade C entries. Page 8 of 38.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:23 prepareio.github.JustinBeckwith/linkinator-mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that provides link checking capabilities using [linkinator](https://github.com/JustinBeckwith/linkinator).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:27 prepareio.github.JustinBeckwith/pylon-mcp (MCP server)
Compatibility: Not stated.
<img src="https://raw.githubusercontent.com/justinbeckwith/pylon-mcp/main/pylon-mcp.png" alt="pylon-mcp" width="400" />
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:45 postinstallio.github.JXUE0/opencut-controller (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/logo.png" width="150" alt="OpenCut Controller Logo"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
mcp_google_forms.py:45 CREDENTIALS_PATH = CONFIG_DIR / "credentials.json"io.github.KamaruSama/mcp-google-forms (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.KamaruSama/mcp-google-forms -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
mcp_screenshot.py:51 geometry = subprocess.check_output(["slurp"], text=True).strip()io.github.KamaruSama/mcp-screenshot (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.KamaruSama/mcp-screenshot -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
mcp_sudo.py:93 result = subprocess.run(io.github.KamaruSama/mcp-sudo (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.KamaruSama/mcp-sudo -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
weboperator-bridge/bridge.js:33 fs.unlinkSync(PID_FILE);io.github.KazKozDev/weboperator (MCP server)
Compatibility: Not stated.
Tell Chrome what you want done, in plain English, and let the agent do it.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:55 credentials.jsonio.github.KmOnBeIbI31/verifactu-mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.KmOnBeIbI31/verifactu-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
test.js:344 try { fs.unlinkSync(mcpScript); } catch (_) {}io.github.KryptosAI/agent-observability (MCP server)
Compatibility: Not stated.
> Open source agent observability , see what your agents did, why they failed, and what it cost.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
README.md:85 io/kryptosai/mcp-observatory:latest` · `curl -fsSL https://raw.githubusercontent.com/KryptosAI/mcio.github.KryptosAI/mcp-observatory (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/mcp-observatory-logo.png" alt="MCP Observatory" width="482"/> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:46 prepareio.github.Libres-coder/parseflow (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
MicroPython/cleanup.py:12 os.remove(fp)io.github.LofiFren/picocalc-mcp (MCP server)
Compatibility: Not stated.
A MicroPython firmware and script collection for the Clockwork Pi PicoCalc handheld device, powered by the **Raspberry Pi Pico 2W**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:38 prepareio.github.Lyellr88/buddy-mcp (MCP server)
Compatibility: Not stated.
> **Status: Archived / Historical** > > The official Claude Code `/buddy` feature was a limited-time April Fools Easter egg (April 1-7, 2026).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:26 prepareio.github.MarvelNwachukwu/mcp-pear (MCP server)
Compatibility: Not stated.
**The Pear Protocol MCP server for Hyperliquid pair trading** , connect Claude, Cursor, or any AI agent to on-chain perps: browse pair markets, read positions and portfolio, and (opt-in) execute pair trades.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
packages/node/src/config.ts:114 fs.unlinkSync(file);io.github.Massed-Compute/mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Massed-Compute/mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:9 postinstallio.github.MastadoonPrime/agent-memory (MCP server)
Compatibility: Not stated.
Persistent, encrypted memory service for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:15 prepareio.github.MetaBrain-Labs/comfyui-mcp-server (MCP server)
Compatibility: Not stated.
<p align="center"> [<a href="./README.md">简体中文</a>] [<a href="./README-en.md">ENGLISH</a>] </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
benchmarks/run_benchmarks.py:61 subprocess.run(io.github.Mibayy/token-savior (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Mibayy/token-savior -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV +1 more
app/page.tsx:323 const res = await fetch('/api/waitlist', {io.github.MintwareDevelopers/mcp-server (MCP server)
Compatibility: Not stated.
Public repository mintwaredevelopers/mintware-beta.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/auth.ts:103 const res = await fetch(url, {io.github.MK3Core/flickr-mcp (MCP server)
Compatibility: Not stated.
An MCP server that gives AI assistants authenticated access to your Flickr photo library.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:6 preinstallio.github.Mnymann/nordic-data (MCP server)
Compatibility: Not stated.
A [Model Context Protocol](https://modelcontextprotocol.io/) server that gives AI agents (Claude, Cursor, Claude Code, ChatGPT, Copilot, etc.) direct access to **official European business data** across **15 European countries**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/anti-slop-e2e.mjs:147 fs.rmSync(fixtureDir, { recursive: true, force: true });io.github.ModelBound/modelbound-mcp (MCP server)
Compatibility: Not stated.
> Local-first MCP server for agent skills.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:33 postinstallio.github.Mogacode-ma/elementor-mcp-agent (MCP server)
Compatibility: Not stated.
> **Agency-grade MCP server for WordPress Elementor.** Multi-site management, safe Elementor edits with backup + auto-rollback + CSS flush, template export/import, global widget detection, screenshots, WP-CLI escape hatch.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:67 postinstallio.github.Mogacode-ma/infomaniak-mcp-agent (MCP server)
Compatibility: Not stated.
> **Drive your entire [Infomaniak](https://www.infomaniak.com) account from [Claude](https://www.anthropic.com/claude) , agentic, two-phase commit, open-source.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:33 postinstallio.github.Morous-Dev/engram-cc (MCP server)
Compatibility: Not stated.
**Universal AI session memory substrate.** One install.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:31 prepareio.github.MUSE-CODE-SPACE/content-genie (MCP server)
Compatibility: Not stated.
> Korean-content-creator MCP that gives Claude live Naver/Daum/Google/YouTube/Zum trends, a 100+ Korean-holiday DB, and a viral-score predictor , so you stop tab-hopping between 5 trend dashboards before every post.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/cloud.ts:64 const r = await fetch(`${GEMINI}/${model}:generateContent?key=${encodeURIComponent(key)}`, {io.github.Narashiman-K/markdown-notes-mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +2 more
publish.py:5 shutil.rmtree(sdk_dir)io.github.Neurobyteio/agentrisk (MCP server)
Compatibility: Not stated.
> **Pre-Trade Security Layer for Autonomous DeFi Agents on Base.** *Stop letting your autonomous trading bots get rekt by stealth honeypots, malicious taxes, and rugpulls.*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
mcp_server.py:241 resp = requests.post(io.github.New1Direction/korg-introspect-mcp (MCP server)
Compatibility: Not stated.
**A tamper-evident, SHA-256-chained ledger for AI agents.** *Every step your agent takes is recorded in a hash chain anyone can verify , edit one event and the chain names it.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL
src/ssh-manager.ts:328 try { fs.unlinkSync(listFile); } catch { /* ignore */ }io.github.NikolaNddTesla/sshmcp (MCP server)
Compatibility: Not stated.
**[中文文档](./README.zh-CN.md)**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/archive.ts:54 const DENY_BASENAMES = new Set(['.npmrc', '.netrc', '.pgpass', '.git-credentials', '.htpasswio.github.NORTHTEKDevs/lossless-context-mcp (MCP server)
Compatibility: Not stated.
**The flight recorder for your agent's context.** A persistent, hook-fed ledger of every file version your coding agent was shown , so a compaction can't destroy the working set, a subagent fleet doesn't pay for the same files N times, and you can *prove* afterward exactly what
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST
package.json:15 prepareio.github.O-mega-Enterprise/founden-mcp (MCP server)
Compatibility: Not stated.
MCP server for [Founden](https://founden.ai).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_UNCONFIRMED
package.json:49 prepareio.github.ParkSangGwon/admob-mcp-server (MCP server)
Compatibility: Not stated.
**English** | [한국어](README.ko.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
scripts/inspector.py:42 result = subprocess.run(io.github.PCfVW/mcp-arangodb-async (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.PCfVW/mcp-arangodb-async -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
packages/cli/src/http.ts:71 res = await fetch(url, {io.github.PedramMadani/legalithm-mcp-server (MCP server)
Compatibility: Not stated.
EU AI Act risk classification, obligations and Article 50 disclosures, cited to Regulation (EU) 2024/1689.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:19 prepareio.github.PierreJanineh/tech-debt-mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="mcpb/icon.png" alt="Tech Debt MCP" width="160" height="160" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/auth.ts:47 fs.unlinkSync(CREDENTIALS_PATH);io.github.PrashantBtkl/spresh-mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/logo.png" width="72" alt="SpreshApp logo" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:28 prepareio.github.PyModel/claude-agy-mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
local_leads_mcp/fetch.py:76 def fetch(url: str, timeout: float = 20.0) -> tuple[httpx.Response, str]:io.github.Raffaele86/local-leads-mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Raffaele86/local-leads-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:29 id_rsaio.github.Raffaele86/seo-stack-mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Raffaele86/seo-stack-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:81 prepareio.github.Raistlin82/btp-sap-odata-to-mcp-server-optimized (MCP server)
Compatibility: Not stated.
This repository is an enterprise-ready MCP (Model Context Protocol) server that bridges SAP OData services with AI capabilities.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
src/instances/instance-registry.ts:61 fs.unlinkSync(this.filePath);io.github.Rheopyrin/db-access-mcp (MCP server)
Compatibility: Not stated.
MCP (Model Context Protocol) stdio server that gives AI agents (Claude Code, Claude Desktop, any MCP client) access to configured databases:
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:23 postinstallio.github.Ringer/warp (MCP server)
Compatibility: Not stated.
MCP server for the Ringer WARP platform , SIP trunking, numbers, porting, messaging, billing, and CDR analytics
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:48 prepareio.github.RobThePCGuy/rag-vault (MCP server)
Compatibility: Not stated.
**Your documents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:14 prepareio.github.RoleModel/optics-mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server for the Optics Design System, enabling LLMs to understand and work with design tokens, components, and documentation from https://docs.optics.rolemodel.design.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:37 prepareio.github.RubenGlez/devicecloud (MCP server)
Compatibility: Not stated.
**Triage failing DeviceCloud runs so your agent can fix them, without opening the dashboard.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:35 prepareio.github.Saidiibrahim/search-papers (MCP server)
Compatibility: Not stated.
Empower your agents to search, analyse, and explore academic papers from arXiv autonomouly.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:12 prepareio.github.SamuelMoraesF/mcp-nfse-nacional (MCP server)
Compatibility: Not stated.
MCP Server para consulta de Notas Fiscais de Serviço Eletrônicas (NFSe) no portal nacional ([nfse.gov.br](https://www.nfse.gov.br)).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
app/api/bank/banks/route.ts:12 const lambdaResponse = await fetch(`${API_GATEWAY_URL}/bank/banks`, {io.github.Sean-Bravo/taxformatter (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
scripts/postinstall.js:70 fs.unlinkSync(tmpFile);io.github.SecurityRonin/alaya-mcp (MCP server)
Compatibility: Not stated.
The only memory engine with neuroscience-grounded memory dynamics , Bjork dual-strength forgetting, retrieval-induced suppression, and Hebbian co-activation , in a zero-dependency embeddable Rust library.
This grade is a hygiene screen, not proof of safety.
