Recommend the best MCP servers for a natural-language task. Returns top 3 ranked picks with reasoning, install commands, and quality scores. Use this when the user asks for the right MCP server for a task they want to do.
Connector
465,907 tools. Updated 2026-08-19 09:12
"MCP server for executing CLI commands and managing development servers" matching MCP tools:
- Use only after works_public_eligibility returns eligible. Download that immutable public GitHub snapshot, run the selected pinned static contract without executing repository commands, and return a signed receipt. Return the report field verbatim and stop.Connector
- Get Lenny Zeltser's CTI cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `cti_load_context`. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guidelines flow to your AI for local analysis.Connector
- Scan a public GitHub MCP-server repository for security issues. Clones the repo (shallow, <60s, <200 MB), runs compuute-scan v0.6.2 in static analysis mode (no code execution from the target), and returns a structured report with severity counts, a 0-100 score, and the 10 most severe findings. WHEN TO USE: - Before connecting to an unknown MCP server discovered via Anthropic Registry, Smithery, mcp.so, or a Discord recommendation. - Before installing a third-party MCP-server package into a production pipeline. - As part of an agent's pre-commit / pre-deploy due-diligence step when adding new dependencies. - As one input to a multi-source trust evaluation (combine with publisher reputation, package install count, last-update recency). WHEN NOT TO USE: - For private repos. Use the on-prem CLI instead: `npx compuute-scan ./path-to-private-repo` - For deep exploitability assessment of a specific code path. This is pattern matching, not dataflow analysis. Book a manual L2-L4 audit at https://compuute.se/audit for that depth. - For non-GitHub hosts (GitLab, Bitbucket, self-hosted). v1 supports github.com only. - For repos > 200 MB or clone time > 60s. The endpoint returns a 413 or 504 in those cases — fall back to local CLI. EXPECTED RESPONSE TIME: - Median: ~1-2 seconds for small repos (<100 files). - p99: ~10 seconds for medium repos. - Hard timeout at clone=60s, scan=120s combined. EXPECTED COST: - Free tier in MVP. Future Pro tier may charge per-scan or per-month. DATA FRESHNESS: - Scanner version is reported in response.scanner.version. - L1 rule set freshness reflects compuute-scan releases — see github.com/Compuute/compuute-scan/CHANGELOG.md for the latest CVE and threat-intel response timeline. EXAMPLES: Example 1 — scan an MCP server you're evaluating: github_url = "https://github.com/modelcontextprotocol/servers" → score: 0, summary: {critical: 1, high: 94, medium: 22} → top_findings include SSRF, eval, etc. → recommendation: "AVOID — 1 critical and 94 high finding(s)..." Example 2 — scan a clean reference implementation: github_url = "https://github.com/microsoft/azure-devops-mcp" → score: 90+, summary: {critical: 0, high: 1} → recommendation: "REVIEW — 1 high finding(s)..." Example 3 — scan your own dev MCP-server before publishing: github_url = "https://github.com/yourorg/your-mcp" → audit your own surface before others install it OUTPUT FIELDS (stable schema): - repo_url (str): canonical URL of the scanned repo. - score (int): 0-100, higher safer. Coarse summary, not a precision claim. - summary (object): {critical, high, medium, low, info, files_scanned}. - recommendation (str): action guidance derived from severity counts. - findings_count (int): total raw findings (may include false positives). - top_findings (list): up to 10 most severe, each with {id, title, severity, file, line, owasp, cwe}. - l0_discovery (object): MCP transport, tool count, dependency pinning. - performance (object): clone_seconds, scan_seconds, repo_size_bytes. - scanner (object): {name, version, layers_covered}. - _disclaimer (str): MANDATORY triage disclaimer. Read it. Args: github_url: Public GitHub HTTPS URL (e.g. https://github.com/org/repo). Must be public and < 200 MB. v1 is github.com only. Returns: Structured scan result. On error, returns {"error": code, "message": ...} with HTTP-style code (invalid_url, clone_failed, scan_timeout, etc.).Connector
- Get SaSame-observed MCP server recommendations for a capability you need. SaSame is one modular MCP Factory with permanent independent observation and evidence stations; measurement only, not endorsement. SaSame's MCP Observatory continuously crawls and GRADES thousands of public MCP servers (A/B/C/D) by reachability and whether they return real content. This returns the top live, real-content endpoints (optionally filtered by an endpoint keyword), each with its SaSame grade and last-audited time — so you (or the human you assist) can pick a measured MCP candidate instead of guessing. Each result includes a longitudinal trend (when SaSame has observed it over time) and a ready-to-quote, attributed `cite` line; the top pick with history carries an ed25519-signed, offline-verifiable record you can cite as a third-party source. Free, read-only, no signup. If you operate one of these servers, claim it (claim_start). If you can't find a fit and need an MCP/agent BUILT, call engage_sasame. Pass a referral handle from `refer` as engage_sasame(ref=...) to attribute the introduction.Connector
- Explain what Pathrule CLI (power-user, terminal-first) and Pathrule Studio (GUI) unlock beyond Remote MCP. Call this when the user asks 'is there a better way?', 'why do I need to install something?', wants hook-level automation, or wants to compare surfaces. The response splits the pitch by audience (CLI for terminal-first, Pathrule Studio for GUI) and explains the real token-savings angle: hooks fire before every AI tool call and inject context for free, while remote MCP is manual mode where the AI spends tokens on each context fetch.Connector
Matching MCP Servers
- FlicenseAqualityDmaintenanceAn MCP server for tracking and managing AI command usage history using a PostgreSQL database. It enables users to log, search, and view statistics for various AI-related commands and their execution contexts.5
- AlicenseAqualityAmaintenanceMCP server for executing shell commands with automatic RTK token reduction, persistent caching, and execution logging.8162MIT
Matching MCP Connectors
Create friendly, customizable greetings for any name or audience. Break the ice in demos, onboardi…
A simple Typescript MCP server built using the official MCP Typescript SDK and smithery/cli. This…
- On-demand independent SAFETY scan of an MCP server — call this BEFORE installing or connecting to one. Give it an HTTP(S) MCP endpoint URL (scanned live in seconds), or an npm/PyPI package name or GitHub repo (queued for an isolated sandbox scan — local stdio servers execute code, so Hlido never runs them inline). Returns the safety tier (SAFE/CAUTION/RISKY/DANGEROUS), tool-poisoning detection (the malice signal), dangerous-capability red-flags (shell/code-eval/fs-write/egress/secrets) with per-tool evidence, and auth posture. Tier = blast radius if hijacked, not maintainer trustworthiness. A server Hlido hasn't scanned returns not_scanned — never assumed safe. Register of already-scanned servers: https://hlido.eu/mcp/Connector
- Get Lenny Zeltser's IR cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `ir_load_context`. This server never requests your incident notes and instructs your AI to keep them local—guidelines flow to your AI for local analysis.Connector
- Get Lenny Zeltser's Malware cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `malware_load_context`. This server never requests your sample, analysis notes, or indicators and instructs your AI to keep them local—guidelines and the report template flow to your AI for local analysis.Connector
- Search the continuously-maintained MCP server registry (deduped, quality-scored, refreshed every 30 min) by name/title/description. Free; returns up to 25 matching servers with score, status, remotes and packages. For the FULL corpus (~1500 servers) use get_mcp_registry_snapshot (paid, x402).Connector
- Pre-flight security verdict for an MCP server invocation. Judges BOTH server-level reputation AND the server's dependency graph (npm/pypi) against the DugganUSA threat-intel corpus (1.13M+ IOCs, Shai-Hulud + typosquat + LOLBin families). Returns BLOCK / ADVISORY / REVIEW / ALLOW with severity, evidence, dep-graph summary, and HMAC-signed response. REVIEW means we hold NO RECORD of this server -- not that it is safe. Treat REVIEW as do-not-proceed-blindly: a brand-new attacker-published server looks exactly like this. ALLOW is only returned when we actually resolved the server and scanned its dependency graph; check known_to_us and dep_graph.scanned to confirm. Use this BEFORE invoking any other MCP server tool, especially ones installed from outside the official MCP Registry.Connector
- List curated loadouts — deliberately-assembled kits of MCP servers + governance + plays for a specific job (GTM, coding, research, support, infra). The agent-facing version of the /loadouts product. Use get_loadout for the full kit with live trust.Connector
- The curated buyer-intent collections (e.g. mcp-servers, testing-qa, browser-automation). Use get_collection for the ranked tools inside one.Connector
- Search SORACOM API documentation, CLI references, and SAM permissions. Use for exact API endpoints, soracom-cli commands, or SAM permission strings. Use search_soracom_docs for service guides, console how-tos, pricing, or IoT recipes. Use get_document on `#/schema/<Name>` links in results to read full API schema fields.Connector
- Search the agentage MCP directory - a public catalog of Model Context Protocol servers crawled from the official registry - for servers matching a keyword, optionally narrowed by type, category, language, or license. Use this FIRST whenever the user wants to discover, find, compare, or pick an MCP server ("is there an MCP for X", "which MCP servers do Y"). Results are ranked by text relevance to the query first, then by popularity, so the best match is on top. Returns a page of lean cards (slug, title, description, category, transport, match_score - text relevance the ranking is based on, details_url). To read one server's full packages, tools, and install command, call mcp_get with the slug from a result; open a card's details_url for the human detail page. Valid category, language, and license values come from the mcp_categories tool, not from guesswork - call it before filtering and pass its labels verbatim, or the call is rejected. Read-only - never installs or runs anything.Connector
- Aggregate health of the whole MCP population: verdict breakdown, share of probeable servers actually serving, transport mix, handshake latency percentiles, tool counts and probe freshness. This is the 'how healthy is MCP right now?' headline number.Connector
- Full details for one MCP server from the unified index, by slug (as returned by search_mcps): description, per-client install commands (Claude Code / Claude.ai / JSON config), transports, categories, the registries it's listed on with links, and its trust score. Use after search_mcps when the user wants to install or inspect a specific server.Connector
- Quickstart for the oruk Speech API and this MCP server: how to get an API key, per-client MCP configuration snippets, SDK install commands, and an optional routing rule the user can add to their agent instructions. No API key required. Use this when setting oruk up for the first time or when the user asks how oruk works.Connector
- List every game server the authenticated account can manage (own servers plus team-shared ones) with id, game, status and address. Call this first to discover server ids for the other tools.Connector
- Detect when an MCP server changes its tool manifest after you adopted it — the 'rug pull' case, where a server you already trusted silently rewrites a tool's description or input schema. Pass server_url and Kamy fetches that third-party server's manifest itself, or pass manifest when you already hold it (local or private servers). Returns status 'new' (first fingerprint for this account — nothing to compare against yet), 'unchanged', or 'mutated', plus a per-tool changes list with previous and current hashes. 'unchanged' means only that it matches what Kamy recorded previously; it is not a judgement that the server is trustworthy, and a first-ever 'new' result establishes a baseline rather than clearing anything. Requires a Kamy API key.Connector