Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 51 to 100 of 646 MCP, Grade D entries. Page 2 of 13.
Listed A to Z by name.
No entries match that filter.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
SKILL.md:302 fetch({ "url": "https://nodejs.org/en/blog", "force_refresh": true })io.github.KnockOutEZ/wigolo (MCP server)
Compatibility: Not stated.
Local-first web intelligence MCP server for AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
ARCHITECTURE.md:318 | **stdio** | `StdioClient` | `child_process.spawn` with piped stdio; newline-delimited JSio.github.KryptosAI/mcp-seatbelt (MCP server)
Compatibility: Not stated.
**Block dangerous MCP tool calls at the protocol layer.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +3 more
docs/multi-exchange-monitor.ts:130 const res = await fetch(url, {io.github.LembaGang/headless-oracle (MCP server)
Compatibility: Not stated.
Real-time, cryptographically signed (Ed25519) market status for 23 global exchanges.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
package.json:81 prepareio.github.NANDI-Services/nandi-proxmox-mcp (MCP server)
Compatibility: Not stated.
> Turn your Proxmox cluster into an AI-driven platform with 140+ tools for automation, monitoring, and controlled execution.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +2 more
AGENTS.md:186 rtk proxy curl -sS https://wmcp.sh/sitemap.xml > /tmp/x.xml # uncorruptedio.github.New1Direction/trust-oracle (MCP server)
Compatibility: Not stated.
**Add any website to Claude, Cursor, or Codex as agent-callable MCP tools , in one line of config.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
package.json:30 postinstallio.github.NickCirv/engram (MCP server)
Compatibility: Not stated.
A local structural code graph and context toolkit for AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
package.json:16 prepareio.github.RapierCraft/perplexity-comet-mcp (MCP server)
Compatibility: Not stated.
A production-grade MCP (Model Context Protocol) server that bridges Claude Code with Perplexity's Comet browser for autonomous web browsing, research, and multi-tab workflow management.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
src/runner/sandbox.ts:49 * pass dynamic values, and the default `child_process.exec` is aio.github.SPerekrestova/interactive-leetcode-mcp (MCP server)
Compatibility: Not stated.
Interactive LeetCode practice with learning-guided hints, solution submission, and AI-driven authentication via MCP server
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +1 more
contracts/base/lib/forge-std/scripts/vm.py:103 res = subprocess.run(forge_fmt)io.github.WayforthOfficial/wayforth (MCP server)
Compatibility: Not stated.
**The runtime that keeps AI agents running in production.**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
packages/create-gh-app/create-gh-app.mjs:207 fs.rmSync(dir, { recursive: true, force: true });janee (MCP server)
Compatibility: Not stated.
>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:14 prepareJitsu (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://github.com/jitsucom/jitsu/blob/newjitsu/.readme-assets/github-hero-light-mode.png?raw=true#gh-light-mode-only" /> <img src="https://github.com/jitsucom/jitsu/blob/newjitsu/.readme-assets/github-hero-dark-mode.png?raw=true#gh-dark-mode-only" />
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +3 more
shared-infrastructure-e2e.test.ts:631 if (fs.existsSync(p)) fs.rmSync(p, { recursive: true, force: true });KIAgent (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/icon.png" alt="KIAgent logo" width="112"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
README.md:64 curl -fsSL https://raw.githubusercontent.com/moulwyse/lattice/main/scripts/install.sh | bashlattice (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/lattice-mark.png" alt="Lattice mark: a bounded repository slice ending in a verified result" width="128"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:10 preparelife. scored. (MCP server)
Compatibility: Not stated.
**You are already a number.**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_HIDDEN_STEP
skills/setup-scenario/SKILL.md:49 Do not launch the test, and do not tell the user a test is running. The launLoadster (MCP server)
Compatibility: Not stated.
Loadster load testing and synthetic monitoring integration.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
parity/record.py:49 p = subprocess.run([sys.executable, "-m", "loci.cli", *args],loci (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.3M1RY33T/loci -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
apps/api/src/embedding.ts:177 const response = await fetch(`${this.config.baseUrl}/v1/embeddings`, {Lore Context (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
package.json:15 prepareMaasy AI Marketing Copilot (MCP server)
Compatibility: Not stated.
**MCP server for Maasy** , connect Claude to your marketing intelligence.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
package.json:17 prepareMcp Bigquery Server (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="assets/mcp-bigquery-server-logo.png" alt="BigQuery MCP Server Logo" width="400"/> </div>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB +1 more
CLAUDE.md:265 SSH_PRIVATE_KEY_PATH=~/.ssh/mcp_deploy_key # or your key pathMcp Checklists (MCP server)
Compatibility: Not stated.
We're a team of security and AI enthusiasts building [MCP Manager](https://mcpmanager.ai), a comprehensive MCP security solution for businesses of all sizes.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
src/oauth.ts:155 await fs.unlink(this.tokenFile);Mcp Evernote (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that provides seamless integration with Evernote for note management, organization, and knowledge capture.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/verify_dataset.py:99 raw = subprocess.run(MCP Junction (MCP server)
Compatibility: Not stated.
Search a nightly-refreshed directory of MCP servers by keyword, category or topic.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
.github/scripts/chain_feed.py:1420 completed = subprocess.run(Mcp Plugin Dotnet (MCP server)
Compatibility: Not stated.
**MCP Plugin for .NET** is a comprehensive solution for integrating .NET applications with the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/).
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +2 more
scripts/publish-mcp-registry.mjs:89 ? await fetch(`https://registry.npmjs.org/mcp-searxng/${version}`, optionsMcp Searxng (MCP server)
Compatibility: Not stated.
Private web search for AI assistants via SearXNG , supports Claude, Cursor, and any MCP client
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL +2 more
scripts/benchmark.mjs:78 if (fs.existsSync(AUDIT_LOG)) fs.unlinkSync(AUDIT_LOG);Mcp Slim Guard (MCP server)
Compatibility: Not stated.
MCP Slim Guard gives a host one deliberate way to reach authorized upstream tools.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
README.md:174 > **Linux quick install:** `curl -fsSL https://install.mcpmux.com | bash`McpMux (MCP server)
Compatibility: Not stated.
**[Website](https://mcpmux.com)** · **[Download](https://mcpmux.com/download)** · **[Discover Servers](https://mcpmux.com)** · **[Features](https://mcpmux.com/features)** · **[Discord](https://discord.gg/b4RDmwAHAN)**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
docker/runner-gpu/runner.sh:21 curl -sS -m 30 -X POST -H "$AUTH" -H 'Content-Type: application/json' \MDEngine (MCP server)
Compatibility: Not stated.
MD workbench for agents: 13 analysis tools, renders, hosted GPU runs; LAMMPS + OpenMM.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
scripts/bundle.cjs:23 fs.unlinkSync(MANIFEST_DEST);Mediawiki Mcp Server (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that enables Large Language Model (LLM) clients to interact with any MediaWiki wiki.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/release_checks.py:163 result = subprocess.run(memdsl (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Liyuan1992/memdsl -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
package.json:24 preparememex (MCP server)
Compatibility: Not stated.
Zettelkasten-based agent memory system with bidirectional links
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
internal/tui/content.go:50 cmd := exec.CommandContext(m.ctx, editorCommand(), path) //nolint:gosec // the commmnemos (MCP server)
Compatibility: Not stated.
> **Local memory for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
mcp_server/multisim_mcp/com_worker_client.py:109 self._process: subprocess.Popen[str] | None = NoneMultisim Mcp (MCP server)
Compatibility: Not stated.
[中文（当前）](README.md) | [English](README.en.md)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +4 more
scripts/build-mcpb.mjs:30 fs.rmSync(trabajo, { recursive: true, force: true });Nyx5 (MCP server)
Compatibility: Not stated.
**Mail and ledger for AI agents, in a single piece.** An agent gets three things it has no other way of getting: an **address** of its own (`agent@domain`), a **mailbox** that holds while it is switched off, and a **ledger** where an agreement carries weight , payment is held un
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +2 more
cmd/open-browser-use/main.go:1051 cmd := exec.CommandContext(ctx, name, args...)Open Browser Use (MCP server)
Compatibility: Not stated.
🔮 Platform-neutral Browser Use for AI agents: real Chrome automation with a CLI + SDKs, no lock-in, dead simple.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +3 more
packages/core/src/ai/v4/patterns/defect-patterns.ts:142 'os.popen("command")',Open Code Review (MCP server)
Compatibility: Not stated.
> **The first open-source CI/CD quality gate built specifically for AI-generated code.** > Detects hallucinated imports, stale APIs, over-engineering, and security anti-patterns , powered by local LLMs and any OpenAI-compatible provider.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
tools.go:25 cmd := exec.CommandContext(ctx, argv[0], argv[1:]...)Openwrt Mcp (MCP server)
Compatibility: Not stated.
An MCP server that runs **on** an OpenWrt router, so Claude Code (or any MCP client) can inspect and change it over an SSH tunnel.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
package.json:15 postinstallospec (MCP server)
Compatibility: Not stated.
Spec-driven, agentic workflow framework for AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
iaiops/connectors/serial/ops.py:161 self._sock = socket.create_connection(OT AIops (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.industrial-aiops/iaiops -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
crates/ovecc-core/src/facts.rs:797 /// OS command execution: `child_process.exec` / `execSync` / `spawn`.ovecc (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
src/pagemap/server/robots_checker.py:88 with urllib.request.urlopen(req, timeout=_ROBOTS_FETCH_TIMEOUT) as resPageMap (MCP server)
Compatibility: Not stated.
Browse and interact with any web page at 97% fewer tokens
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
paper_search_mcp/sections.py:200 process = subprocess.Popen(_worker_command(), stdin=subprocess.PIPE, stdout=sPaper Search Mcp (MCP server)
Compatibility: Not stated.
MCP, CLI, Skills for searching and downloading academic papers from multiple sources like arXiv, PubMed, bioRxiv, etc.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:36 preparePare (MCP server)
Compatibility: Not stated.
<h1><img src="assets/logo.png" alt="" width="80" valign="middle" /> Pare</h1>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +2 more
adapters/collectors/central.py:110 result = subprocess.run(ssh_argv(config), capture_output=True, timeout=25,retinue (MCP server)
Compatibility: Not stated.
**English** · [简体中文](#众卿-retinue简体中文) · [English demo](https://jklthinking.github.io/retinue/demo-en/?lang=en) · [中文演示](https://jklthinking.github.io/retinue/demo/?lang=zh-CN)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +4 more
connectors/reddit/tools/reddit/brave/brave.py:46 result = subprocess.run(["osascript", "-e", source], capture_runx (MCP server)
Compatibility: Not stated.
The governed runtime for agent skills.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:48 postinstallSAP HANA CLI (MCP server)
Compatibility: Not stated.
> **Version 4.x introduces significant changes including Express 5 migration, refactored database connection handling, and major performance improvements.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
deploy/security/security_check.py:73 return subprocess.run(ScanMalware.com URL Scanner (MCP server)
Compatibility: Not stated.
Minimal Python MCP server that wraps the public ScanMalware.com API.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
scripts/bootstrap-mac.sh:8 # Usage: curl -fsSL https://raw.githubusercontent.com/writerslogic/scrivener-mcp/maScrivener Mcp (MCP server)
Compatibility: Not stated.
<picture><source media="(prefers-color-scheme: dark)" srcset="assets/logo-white.svg"><img align="left" width="96" src="assets/logo-black.svg" alt="Scrivener MCP logo"></picture>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
src/site.ts:21 export const WRAPPED_CMD = `curl -fsSL ${SITE_URL}/wrapped | sh`;sessions (MCP server)
Compatibility: Not stated.
<h1 align="center">sessions</h1>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
publish/ci/smoke_deep_research.py:24 def send(proc: subprocess.Popen[bytes], payload: dict[str, Any]) -> None:ShadowCrawl (MCP server)
Compatibility: Not stated.
<p> CortexScout is the Deep Research & Web Extraction module within the Cortex-Works ecosystem.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +3 more
package.json:15 @coinbase/x402Signal Nodus SEC Filings (MCP server)
Compatibility: Not stated.
Amendment-safe 10-K/10-Q section diffs, claim checks vs XBRL, 8-K events.
This grade is a hygiene screen, not proof of safety.
