M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
COMPARE UP TO 4 SERVERS

Compare MCP servers

Compare scores, permissions, risks, and fit in one decision-focused table.

DimensionAgent ScanSecurity scanner for AI agents, MCP servers and agent skills to detect prompt injections and vulnerabilities.GitHub MCP ServerGitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language
FMRS58 / 100 · C76 / 100 · B
Reliability7 / 2013 / 20
Security and permissions12 / 2014 / 20
Maintenance16 / 2018 / 20
Documentation15 / 2017 / 20
Setup experience8 / 2014 / 20
Best for
  • Security teams to monitor company-wide agent supply chain risk
  • Developers to quickly assess security of their MCP servers and skills
  • Evaluating third-party MCP configs in sandboxed environments
  • Teams that want an AI assistant to directly operate on GitHub repos and collaboration workflows
  • Users already in the GitHub Copilot ecosystem who want a zero-deployment remote option
Not for
  • Users needing stable programmatic output (CLI output is experimental and may change)
  • Production workflows depending on specific CLI output fields
  • Scanning non-stdio MCP servers (only stdio is supported)
  • Scenarios where you don't want the assistant to have write access to repos (enable only read-only toolsets)
  • Environments with strict network isolation for private repos that can't reach the official remote endpoint
Required permissions
  • Requires SNYK_TOKEN environment variable to call Snyk API
  • Executes commands defined in MCP configurations (stdio server startup)
  • Reads local agent configuration files (e.g., ~/.claude/skills)
  • A personal access token (PAT) or OAuth App token; effective scope depends on the token's own permissions
  • Enabling toolsets like actions/issues/pull_requests grants write access — request tokens on a least-privilege basis
Risks and side effects
  • Scanning MCP configurations executes their commands, posing risk of malicious code execution
  • Skills, app names, and tool descriptions are shared with Snyk (usage implies consent)
  • CLI output is experimental and subject to change
  • Large-scale API usage may result in account blocking
  • Write toolsets (creating/merging PRs, triggering workflows) can cause accidental changes if the token is overscoped — try a read-only toolset first
  • In hosted mode, credentials travel via the Authorization header — make sure the client-to-api.githubcopilot.com connection is trusted
Supported clientsClaude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI, Amazon Q, Amp, Kiro, OpenCode, Antigravity, Codex, OpenClawClaude Desktop, Claude Code, VS Code, Cursor, Windsurf, JetBrains IDEs, Zed, Amp
Tools015