M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
COMPARE UP TO 4 SERVERS

Compare MCP servers

Compare scores, permissions, risks, and fit in one decision-focused table.

DimensionAgent ScanSecurity scanner for AI agents, MCP servers and agent skills to detect prompt injections and vulnerabilities.NPM Sentinel MCP ServerAI-powered NPM package analysis MCP server
FMRS58 / 100 · C79 / 100 · B
Reliability7 / 2012 / 20
Security and permissions12 / 2016 / 20
Maintenance16 / 2018 / 20
Documentation15 / 2018 / 20
Setup experience8 / 2015 / 20
Best for
  • Security teams to monitor company-wide agent supply chain risk
  • Developers to quickly assess security of their MCP servers and skills
  • Evaluating third-party MCP configs in sandboxed environments
  • Developers auditing NPM dependencies within AI workflows
  • Teams performing supply chain security assessments
  • Users of Claude Desktop, Cursor, or VS Code
Not for
  • Users needing stable programmatic output (CLI output is experimental and may change)
  • Production workflows depending on specific CLI output fields
  • Scanning non-stdio MCP servers (only stdio is supported)
  • Projects outside the NPM ecosystem (e.g., pure Python/Go)
  • Environments without network access to deps.dev, OSV.dev, and the npm registry
  • Scenarios requiring maintenance by an official upstream vendor
Required permissions
  • Requires SNYK_TOKEN environment variable to call Snyk API
  • Executes commands defined in MCP configurations (stdio server startup)
  • Reads local agent configuration files (e.g., ~/.claude/skills)
  • Network access to the NPM registry and external services (deps.dev, OSV.dev, OpenSSF, npms.io, GitHub)
  • Read access to workspace lockfiles (pnpm-lock.yaml, package-lock., yarn.lock) for cache invalidation
Risks and side effects
  • Scanning MCP configurations executes their commands, posing risk of malicious code execution
  • Skills, app names, and tool descriptions are shared with Snyk (usage implies consent)
  • CLI output is experimental and subject to change
  • Large-scale API usage may result in account blocking
  • Third-party READMEs and changelogs are untrusted external content; they are wrapped in tags with _meta flags but should still be handled cautiously
  • Depends on availability and accuracy of external services
  • Batch requests are capped at 25 packages to prevent registry enumeration; larger sets require batching
  • Third-party open source project, not officially maintained by NPM or Anthropic
Supported clientsClaude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI, Amazon Q, Amp, Kiro, OpenCode, Antigravity, Codex, OpenClawClaude Desktop, VS Code, Cursor
Tools019