MCP SERVER SECURITY DIRECTORY

→ Grade your own MCP config (browser-only, free)

Server	Ecosystem	Grade	Packages	Vulns	Findings
@0xinsider/ mcp	npm	A	—	0	0
@agentdeskai/ browser-tools-mcp	npm	A	224	0	0
@alisaitteke/ photoshop-mcp	npm	A	—	0	0
@ataraxy-labs/ sem	npm	B	—	0	1
@atlassian-dc-mcp/ bitbucket	npm	A	—	0	0
@atlassian-dc-mcp/ confluence	npm	A	—	0	0
@atlassian-dc-mcp/ jira	npm	A	—	0	0
@auth0/ auth0-mcp-server	npm	A	—	0	0
@aventurevc/ mcp-server	npm	A	—	0	0
@azure/ mcp	npm	B	7 ▲	0	1
@brave/ brave-search-mcp-server	npm	A	—	0	0
@brightdata/ mcp	npm	A	—	0	0
@browserbasehq/ mcp	npm	F	235	1	2
@browserless.io/ mcp	npm	B	—	0	1
@browserstack/ mcp-server	npm	A	—	0	0
@bytebase/ dbhub	npm	A	—	0	0
@cachly-dev/ mcp-server	npm	B	—	0	1
@cap-js/ mcp-server	npm	A	—	0	0
@cargo-ai/ cli	npm	A	—	0	0
@cloudbase/ cloudbase-mcp	npm	A	—	0	0
@cloudflare/ mcp-server-cloudflare	npm	A	26	0	1
@codescene/ codehealth-mcp	npm	A	—	0	0
@contextstream/ mcp-server	npm	A	—	0	0
@cyanheads/ mcp-ts-core	npm	A	—	0	0
@dbx-app/ mcp-server	npm	A	—	0	0
@delorenj/ mcp-server-trello	npm	A	—	0	0
@desplega.ai/ agent-swarm	npm	A	—	0	0
@discourse/ mcp	npm	A	—	0	0
@dynatrace-oss/ dynatrace-mcp-server	npm	D	—	0	1
@elastic/ mcp-server-elasticsearch	npm	D	392	0	1
@esaio/ esa-mcp-server	npm	A	—	0	0
@evan_zhong/ browser-attach	npm	B	—	0	1
@executeautomation/ playwright-mcp-server	npm	A	347	0	0
@flisk-sh/ flisk	npm	B	—	0	1
@florentine-ai/ mcp	npm	A	—	0	0
@getmarrow/ mcp	npm	A	—	0	0
@gitkraken/ gk	npm	B	—	0	1
@glittering0717/ ai-browser	npm	B	—	0	1
@gripforgeai/ mcp	npm	A	—	0	0
@growthbook/ mcp	npm	A	—	0	0
@heroku/ mcp-server	npm	A	139	0	0
@hostinger/ mcp	npm	A	—	0	0
@hypothesi/ tauri-mcp-server	npm	A	—	0	0
@imgly/ codesign-mcp	npm	A	—	0	1
@ixo/ asks-mcp	npm	B	—	0	1
@letoribo/ mcp-graphql-enhanced	npm	A	—	0	0
@mapbox/ mcp-server	npm	B	—	0	1
@microsoft/ dataverse	npm	A	—	0	0
@microsoft/ powerbi-modeling-mcp	npm	A	—	0	0
@mobilenext/ mobile-mcp	npm	A	—	0	0
@modelcontextprotocol/ server-aws-kb-retrieval	npm	D	39	0	2
@modelcontextprotocol/ server-brave-search	npm	D	15	0	2
@modelcontextprotocol/ server-everart	npm	D	94	0	2
@modelcontextprotocol/ server-everything	npm	A	94	0	0
@modelcontextprotocol/ server-filesystem	npm	A	12	0	0
@modelcontextprotocol/ server-gdrive	npm	D	67	0	2
@modelcontextprotocol/ server-github	npm	D	46	0	2
@modelcontextprotocol/ server-gitlab	npm	D	46	0	2
@modelcontextprotocol/ server-google-maps	npm	D	44	0	2
@modelcontextprotocol/ server-memory	npm	A	4	0	0
@modelcontextprotocol/ server-postgres	npm	D	29	0	2
@modelcontextprotocol/ server-puppeteer	npm	D	117	0	2
@modelcontextprotocol/ server-redis	npm	D	109	0	2
@modelcontextprotocol/ server-sequential-thinking	npm	A	21	0	0
@modelcontextprotocol/ server-slack	npm	D	15	0	2
@mozilla/ firefox-devtools-mcp	npm	A	—	0	0
@neondatabase/ mcp-server-neon	npm	D	438	0	2
@next-ai-drawio/ mcp-server	npm	A	—	0	0
@nithin554/ code-crawler	npm	A	—	0	0
@notionhq/ notion-mcp-server	npm	A	177	0	1
@perplexity-ai/ mcp-server	npm	A	—	0	0
@piotr-agier/ google-drive-mcp	npm	A	—	0	0
@pipeshub-ai/ mcp	npm	A	—	0	1
@playwright/ mcp	npm	A	3	0	0
@postman/ postman-mcp-server	npm	B	—	0	1
@programinglive/ dev-workflow-mcp-server	npm	B	—	0	1
@putervision/ behavior-mcp	npm	A	—	0	0
@putervision/ state-memory-mcp	npm	A	—	0	0
@putervision/ world-model-mcp	npm	A	—	0	0
@qase/ mcp-server	npm	A	—	0	0
@respira/ wordpress-mcp-server	npm	A	—	0	1
@reticlehq/ server	npm	A	—	0	0
@rsdoctor/ mcp-server	npm	A	—	0	0
@sap-ux/ fiori-mcp-server	npm	A	—	0	0
@sap/ mdk-mcp-server	npm	B	—	0	1
@sbroenne/ mcp-server-excel	npm	A	—	0	0
@sendinel/ mcp-server	npm	A	—	0	0
@sentry/ mcp-server	npm	A	154	0	1
@serdnaley/ metabase-mcp	npm	A	—	0	0
@smartbear/ mcp	npm	A	—	0	0
@softeria/ ms-365-mcp-server	npm	A	—	0	0
@starreel/ mcp	npm	A	—	0	0
@storybook/ addon-mcp	npm	A	—	0	0
@stripe/ mcp	npm	A	97	0	0
@structured-world/ gitlab-mcp	npm	A	—	0	0
@supabase/ mcp-server-supabase	npm	A	17	0	0
@sveltejs/ mcp	npm	A	—	0	0
@swmansion/ argent	npm	A	—	0	0
@sylphx/ anymd	npm	A	—	0	0
@tmhs/ screencast-mcp	npm	A	—	0	0
@togglhq/ mcp	npm	A	—	0	1
@tradecanvas/ mcp	npm	B	—	0	1
@typeroll/ mcp-server	npm	A	—	0	0
@ui5/ mcp-server	npm	A	—	0	0
@unleash/ mcp	npm	A	—	0	0
@upstash/ context7-mcp	npm	A	104	0	0
@wavespeed/ mcp	npm	A	—	0	0
@wdio/ mcp	npm	A	—	0	1
@wirecat/ cli-memo	npm	C	—	0	2
@wirecat/ gcal-cli	npm	B	—	0	1
@wirecat/ max-cli	npm	C	—	0	2
@wonderwhy-er/ desktop-commander	npm	B	650	0	1
@xrpl-utilities/ mcp	npm	A	—	0	0
@yawlabs/ ctxlint	npm	A	—	0	0
@zereight/ mcp-gitlab	npm	A	—	0	0
agent-device	npm	A	—	0	0
aicodeman	npm	B	—	0	1
aigentify	npm	A	—	0	0
anneal-memory	PyPI	A	—	0	0
appium-mcp	npm	A	—	0	0
arxiv-mcp-server	PyPI	A	—	0	0
arxyne	PyPI	A	—	0	0
attio-mcp	npm	B	—	0	1
avrotize	PyPI	A	—	0	1
basic-memory	PyPI	A	—	0	0
bernstein	PyPI	A	—	0	0
bitbucket-mcp	npm	A	—	0	0
browser-devtools-mcp	npm	B	—	0	1
browser-use	PyPI	A	—	0	0
canli-markets-mcp	npm	B	—	0	1
chrome-devtools-mcp	npm	A	—	0	0
claude-flow	npm	A	—	0	0
clio-kit	PyPI	A	—	0	0
codebase-memory-mcp	npm	B	—	0	1
color-space	npm	A	—	0	0
comfyui-mcp	npm	A	—	0	0
dcc-mcp-server	PyPI	A	—	0	0
deep-agentic-core-mcp	PyPI	A	—	0	0
dembrandt	npm	A	—	0	0
docling-mcp	PyPI	A	—	0	0
dynoxide	npm	A	—	0	0
e2e	npm	A	—	0	0
edgartools	PyPI	A	—	0	0
emailmd	npm	A	—	0	0
endform	npm	A	—	0	0
exa-mcp-server	npm	A	133	0	0
excel-mcp-server	PyPI	A	—	0	0
exomem	PyPI	A	—	0	0
falcon-mcp	PyPI	A	—	0	1
figma-developer-mcp	npm	A	136	0	0
financetoolkit	PyPI	A	—	0	0
firebase-tools	npm	A	—	0	0
firecrawl-mcp	npm	A	37	0	0
gdharness	npm	A	—	0	0
gongio-mcp	npm	A	—	0	0
graphlit-mcp-server	npm	A	554	0	0
groundmail-mcp	npm	B	—	0	1
ha-mcp	PyPI	A	—	0	0
hermoso	npm	A	—	0	0
hol-guard	PyPI	A	—	0	0
igniteui-theming	npm	A	—	0	0
jcodemunch-mcp	PyPI	A	—	0	0
kinocut	PyPI	A	—	0	0
knos	PyPI	A	—	0	0
kordoc	npm	A	—	0	0
kubernetes-mcp-server	npm	A	—	0	0
lantern-works-deals-mcp	PyPI	B	—	0	1
llm-sandbox	PyPI	A	—	0	0
local-mcp	npm	B	—	0	1
loki-mode	npm	B	—	0	1
mcp-clickhouse	PyPI	A	—	0	1
mcp-gitlab	PyPI	A	—	0	0
mcp-gsc	npm	A	—	0	0
mcp-local-rag	npm	A	—	0	0
mcp-neo4j-cypher	PyPI	A	—	0	1
mcp-neo4j-memory	PyPI	A	—	0	1
mcp-proxy-for-aws	PyPI	A	—	0	1
mcp-remote	npm	A	81	0	0
mcp-searxng	npm	A	—	0	0
mcp-server-appwrite	PyPI	A	—	0	1
mcp-server-fetch	PyPI	A	46	0	0
mcp-server-git	PyPI	A	32	0	0
mcp-server-kubernetes	npm	A	407	0	0
mcp-server-motherduck	PyPI	A	—	0	1
mcp-server-sentry	PyPI	A	29	0	2
mcp-server-sqlite	PyPI	A	37	0	2
mcp-server-time	PyPI	A	31	0	0
mcp-swiss	npm	A	—	0	0
moltbridge	npm	A	—	0	0
mongodb-mcp-server	npm	A	433	0	0
nanobanana-mcp-server	PyPI	A	—	0	0
next-devtools-mcp	npm	A	—	0	0
notion-mcp-server	npm	A	—	0	0
nowaikit	npm	A	—	0	0
nx-mcp	npm	A	—	0	0
obsidian-mcp-server	npm	A	—	0	0
octocode-mcp	npm	A	—	0	0
ouroboros-ai	PyPI	A	—	0	0
oxylabs-mcp	PyPI	A	—	0	0
pagerduty-mcp	PyPI	A	—	0	1
premiere-pro-mcp	npm	A	—	0	0
pymemoryeditor	PyPI	A	—	0	0
rea-agents	npm	A	—	0	0
reddit-mcp-server	npm	A	—	0	0
repomix	npm	A	—	0	1
repowise	PyPI	A	—	0	0
run402-mcp	npm	A	—	0	0
sbuilder-mcp	npm	A	—	0	0
scrapling	PyPI	A	—	0	0
screenpipe-mcp	npm	A	—	0	1
seleniumbase	PyPI	A	—	0	0
semiotic	npm	A	—	0	0
serena-agent	PyPI	A	—	0	0
shinjuku-shield	npm	B	—	0	1
skylos	PyPI	A	—	0	0
sling	PyPI	A	—	0	0
snowflake-labs-mcp	PyPI	A	—	0	0
snyk	npm	B	—	0	1
ssh-mcp	npm	A	—	0	0
tavily-mcp	npm	A	126	0	0
telnyx	npm	A	—	0	0
threejs-devtools-mcp	npm	A	—	0	0
tooluniverse	PyPI	A	—	0	0
touchdesigner-mcp-server	npm	A	—	0	0
truthound	PyPI	A	—	0	0
unifi-network-mcp	PyPI	A	—	0	1
voice-mode	PyPI	A	—	0	0
windows-mcp	PyPI	A	—	0	0
withruntime	npm	A	—	0	0
workspace-mcp	PyPI	A	—	0	0
xcodebuildmcp	npm	A	—	0	0
zoo_mcp	PyPI	A	—	0	0
zotero-mcp-server	PyPI	A	—	0	0

▲ the package count understates what you install — most of what resolves is prebuilt binaries. Grade ? means the registry lookup failed, so nothing was assessed.
Grades derive from npm/PyPI metadata published by the package owners and from public security advisories (OSV/GHSA) — a deprecation notice or a filed CVE, not our own judgement of the code. Grades scanned 2026-11-05 · counts resolved 2026-11-02. A package fixed after that date still shows its earlier grade.
Maintainer and think a grade here is wrong or stale? Get in touch — corrections are welcome.