Updated weekly · Free & open
Which MCP servers are actually maintained?
The official registry lists every Model Context Protocol server but tells you nothing about whether any of them is still alive. This index scores each one on maintenance activity, flags what deserves a second look before you install it, and shows exactly how every number was reached.
41,986
servers indexed
88
with verified activity
21.0
median score
13,104
carrying risk flags
last refreshed
The weekly report
What moved, what dropped, and what appeared — a short read every Monday. No spam, unsubscribe in one click.
Leaderboard
Activity & maintenance, not security — how this is scored| # | Server | Flags | Stars | Change | Score |
|---|---|---|---|---|---|
| 3351 | io.github.2nd1st/open-mcp-apps Persistent, interactive MCP Apps — the AI builds an app once, you both reuse it | clean | — | — | 24.0 |
| 3352 | io.github.2s-io/mcp 575+ agent tools: data, AI gateway, storage/queues/watchers. x402 USDC, no keys, usage billing. | clean | — | — | 24.0 |
| 3353 | DaVinci Resolve Lite MCP Control DaVinci Resolve, including the free Lite edition. Manual setup only — see README. | clean | — | — | 24.0 |
| 3354 | loci Scoped memory for coding agents: picks the right project, answers in scope, or abstains. | clean | — | — | 24.0 |
| 3355 | io.github.3esign/psychosynth Psychometric data marketplace: Big Five profiles, cognitive biases & behavioral data via x402. | clean | — | — | 24.0 |
| 3356 | RatchetX Forecast Arena Shared Pyth context and live Solana forecasting arena for calibration, proof, and agent ranking. | clean | — | — | 24.0 |
| 3357 | io.github.41fred/ibo Commission cinematic AI campaign films from IBO Studio, with custom scoping when needed. | clean | — | — | 24.0 |
| 3358 | io.github.47-ronn/remote-agents Control fleets of remote machines via AI agents: exec, files, git, fleet ops, map/reduce. | medium | — | — | 24.0 |
| 3359 | 47620 Solana Data Pay-per-call Solana data for AI agents over x402: token, account, tx, trending. No signup, no key. | clean | — | — | 24.0 |
| 3360 | io.github.48x-ai/marketbasketanalysis-mcp Co-purchase intelligence and merchant ops tools for AI shopping, ecommerce, and B2B agents | clean | — | — | 24.0 |
| 3361 | io.github.4DA-Systems/4da-mcp-server Upgrade intelligence for AI agents: what an upgrade changes, where it touches your code, CVE scans. | clean | — | — | 24.0 |
| 3362 | io.github.4hmetuyar/a2a-auditor Scans Agent2Agent (A2A) protocol code for webhook SSRF, missing auth, and credential exposure | clean | — | — | 24.0 |
| 3363 | io.github.4hmetuyar/agent-graph-auditor Finds transitive excessive agency across LangGraph/CrewAI/AutoGen orchestration graphs | clean | — | — | 24.0 |
| 3364 | io.github.4hmetuyar/ai-code-scanner Scans code for insecure LLM/AI integration: exposed keys, unsafe output, prompt injection | clean | — | — | 24.0 |
| 3365 | io.github.4hmetuyar/compliance-checker KVKK/GDPR/CCPA compliance checks for codebases | clean | — | — | 24.0 |
| 3366 | io.github.4hmetuyar/db-gateway KVKK/GDPR-compliant LLM-to-database gateway: PII masking, RBAC, rate limiting, audit log | clean | — | — | 24.0 |
| 3367 | io.github.4hmetuyar/dependency-auditor CVE scanning for npm/pip/cargo dependencies via OSV | clean | — | — | 24.0 |
| 3368 | io.github.4hmetuyar/dns-intelligence DNS record enumeration, misconfiguration and dangling-subdomain detection | clean | — | — | 24.0 |
| 3369 | io.github.4hmetuyar/elicitation-auditor MCP elicitation anti-patterns: secrets in forms, third-party authorize URLs, credentials in URLs | clean | — | — | 24.0 |
| 3370 | io.github.4hmetuyar/llm-redteam Active jailbreak/extraction/obfuscation red-teaming for live LLM endpoints | clean | — | — | 24.0 |
| 3371 | io.github.4hmetuyar/mcp-config-auditor Scans Cursor/Claude/Windsurf/VS Code MCP configs for unpinned versions, secrets, typosquats | clean | — | — | 24.0 |
| 3372 | io.github.4hmetuyar/mcp-server-auditor Scans MCP server tool definitions for excessive agency, injection sinks, hardcoded secrets | clean | — | — | 24.0 |
| 3373 | io.github.4hmetuyar/memory-poisoning-scanner Scans agent code for untrusted input poisoning persistent cross-session memory | clean | — | — | 24.0 |
| 3374 | io.github.4hmetuyar/model-scanner Scans ML model files (PyTorch, safetensors, Keras, ONNX) for supply-chain risks | clean | — | — | 24.0 |
| 3375 | io.github.4hmetuyar/oauth-auditor Scans MCP server auth code for OAuth 2.1 anti-patterns: token passthrough, missing audience | clean | — | — | 24.0 |
| 3376 | io.github.4hmetuyar/prompt-injection-scanner Scans RAG content/scraped pages for indirect prompt injection | clean | — | — | 24.0 |
| 3377 | io.github.4hmetuyar/prompt-leak-scanner Catches leaked credentials and PII in outbound LLM prompts | clean | — | — | 24.0 |
| 3378 | io.github.4hmetuyar/rug-pull-detector Baselines an MCP server's tools and detects tool-definition changes after approval | clean | — | — | 24.0 |
| 3379 | io.github.4hmetuyar/secret-scanner Scans files for leaked secrets and API keys | clean | — | — | 24.0 |
| 3380 | io.github.4hmetuyar/security-proxy MCP gateway: many servers, one policy, lethal-trifecta blocking, PII masking, audit log | clean | — | — | 24.0 |
| 3381 | io.github.4hmetuyar/security-suite Bundle of secret-scanner, dependency-auditor, ssl-inspector, and dns-intelligence | clean | — | — | 24.0 |
| 3382 | io.github.4hmetuyar/slopsquat-scanner Checks declared npm/PyPI dependencies against real registries to catch slopsquatting | clean | — | — | 24.0 |
| 3383 | io.github.4hmetuyar/ssl-inspector TLS certificate/cipher/protocol inspection | clean | — | — | 24.0 |
| 3384 | io.github.4hmetuyar/tool-poisoning-scanner Scans MCP tool definitions for hidden instructions and confused-deputy sinks | clean | — | — | 24.0 |
| 3385 | io.github.4hmetuyar/toxic-flow-auditor Finds lethal-trifecta toxic flows in MCP tool catalogs: untrusted input, sensitive data, egress | clean | — | — | 24.0 |
| 3386 | io.github.4hmetuyar/unbounded-consumption-auditor Scans LLM/agent code for Unbounded Consumption / denial-of-wallet risks (OWASP LLM Top 10 2026 #6) | clean | — | — | 24.0 |
| 3387 | io.github.4hmetuyar/vector-store-scanner Probes vector-database endpoints for unauthenticated exposure of embeddings/RAG data | clean | — | — | 24.0 |
| 3388 | io.github.4hmetuyar/vulnerability-scanner Triggers GuardBee scans, queries findings, AI-assisted remediation guidance | clean | — | — | 24.0 |
| 3389 | Leantime MCP (Unofficial) Unofficial MCP server for Leantime: 42 agent-first tools, backup/restore, dry-run validation | clean | — | — | 24.0 |
| 3390 | Zotero MCP Search, read, annotate, and add to your Zotero research library, local or web. | clean | — | — | 24.0 |
| 3391 | io.github.55tarkun/geojp MCP server for Japan geodata: cadastral lot numbers (chiban) and reverse geocoding, for AI agents. | clean | — | — | 24.0 |
| 3392 | io.github.5dive-ai/5dive-mcp Expose the 5dive agent-fleet CLI (tasks, agents, digest) as MCP tools, over stdio or HTTP. | clean | — | — | 24.0 |
| 3393 | Parley Multi-party decisions for agents: red lines rejected in code, max-min pick, SHA-256 receipt. Stdlib. | clean | — | — | 24.0 |
| 3394 | Course Drift Oracle Signed drift reports for the ai-agents-for-beginners course. Free summary; $0.25 full report. | clean | — | — | 24.0 |
| 3395 | io.github.77777R7/octocrawl Web scraper for agents: blocked, empty and wrong pages reported as such, with an Evidence Record. | clean | — | — | 24.0 |
| 3396 | io.github.7nashinick/norwegian-data-mcp Norwegian public data: companies, statistics, exchange rates, addresses, property. Zero API keys. | clean | — | — | 24.0 |
| 3397 | Django Admin MCP Django admin models over MCP: CRUD, actions, history, autocomplete — capped by Django permissions. | clean | — | — | 24.0 |
| 3398 | framework-mcp Verified, version-pinned answers about fast-moving frameworks for coding agents. | clean | — | — | 24.0 |
| 3399 | io.github.89rat/code402 Discover machine-payable APIs, probe x402 payment terms, and run seller operations. Non-custodial. | clean | — | — | 24.0 |
| 3400 | io.github.89rat/x402-checks Machine-payable deterministic identifier checks + signed XDR-1 receipts for agents. | clean | — | — | 24.0 |
A score measures maintenance activity, not safety. A high score does not mean a server is secure, and a low one does not mean it is dangerous — see the methodology for what each signal does and does not tell you.