M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
COMPARE UP TO 4 SERVERS

Compare MCP servers

Compare scores, permissions, risks, and fit in one decision-focused table.

DimensionGraphARCThe admission gate for agent graphs, built on LangGraphGitHub MCP ServerGitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language
FMRS61 / 100 · C76 / 100 · B
Reliability10 / 2013 / 20
Security and permissions10 / 2014 / 20
Maintenance14 / 2018 / 20
Documentation15 / 2017 / 20
Setup experience12 / 2014 / 20
Best for
  • Teams that need agent workflows under deterministic admission and policy constraints
  • Scenarios requiring worst-case pricing before execution and per-node cost attribution after
  • Compliance or investigation workflows needing one replayable audit trace where the dashboard and the audit trail are the same file
  • Organizations that want a human to press a button before execution starts, for example from Slack
  • Developers who want deterministic, reproducible demos and tests on any checkout via `--scripted`
  • Teams that want an AI assistant to directly operate on GitHub repos and collaboration workflows
  • Users already in the GitHub Copilot ecosystem who want a zero-deployment remote option
Not for
  • Those who only need an interactive single-agent loop without pre-execution authorization
  • Anyone looking for a general personal AI assistant gateway or a tool configured by allowlists
  • Users expecting node arguments to be fully validated: admission authorises a node's kind, arguments are checked only where the kind declares an args_schema, and a schema bounds their shape, not what a factory lets them reach
  • Scenarios requiring the HTTP API to use a durable session layer, or the tool plane to be governed by policy documents instead of CLI flags
  • Users who need agent nodes on the Claude CLI backend to be fully governed: by default they run under an allowlist mapped from the node's own tools, but enforcement there is Claude Code's, and the explicit bypass tier has no checks at all
  • Scenarios where you don't want the assistant to have write access to repos (enable only read-only toolsets)
  • Environments with strict network isolation for private repos that can't reach the official remote endpoint
Required permissions
  • The default backend drives the claude CLI on your PATH (a Claude subscription, no API key)
  • Node bodies come from the registry, never from a proposal; the registry is the source of the kinds a planner may propose
  • Policy decides what the planner is able to propose: a denied edge changes the shape of the graph rather than producing a refusal to retry
  • The MCP gate binds the MCP surface, not the host: an agent with its own file tools in the run directory could forge the approval decision, and the trust boundary is the working directory
  • run_command children are unconfined
  • ContainerExecutor is the real boundary; the in-process sandbox is defense in depth
  • A personal access token (PAT) or OAuth App token; effective scope depends on the token's own permissions
  • Enabling toolsets like actions/issues/pull_requests grants write access — request tokens on a least-privilege basis
Risks and side effects
  • Admission authorises a node's kind; arguments are validated only where the kind declares an args_schema, and a schema bounds their shape rather than what a factory lets them reach
  • The in-process sandbox is defense in depth, run_command children are unconfined, and ContainerExecutor is the real boundary when explicitly used
  • The HTTP API does not yet use the durable session layer
  • On the Claude CLI backend an agent node is delegated, not governed: by default it runs under an allowlist mapped from the node's own tools, but enforcement is Claude Code's, and the bypass tier has no checks at all
  • Policy documents govern planning while the tool plane still reads CLI flags
  • The MCP gate binds the MCP surface, not the host: an agent with its own file tools in the run directory could forge the approval decision; the trust boundary is the working directory, as it is for the Slack workspace
  • Write toolsets (creating/merging PRs, triggering workflows) can cause accidental changes if the token is overscoped — try a read-only toolset first
  • In hosted mode, credentials travel via the Authorization header — make sure the client-to-api.githubcopilot.com connection is trusted
Supported clientsClaude Desktop, Claude Code, VS Code, Cursor, Windsurf, JetBrains IDEs, Zed, Amp
Tools015