M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
COMPARE UP TO 4 SERVERS

Compare MCP servers

Compare scores, permissions, risks, and fit in one decision-focused table.

DimensionHyper MCPA fast, secure MCP server that extends its capabilities through WebAssembly plugins.GitHub MCP ServerGitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language
FMRS67 / 100 · C76 / 100 · B
Reliability11 / 2013 / 20
Security and permissions13 / 2014 / 20
Maintenance15 / 2018 / 20
Documentation16 / 2017 / 20
Setup experience12 / 2014 / 20
Best for
  • Developers who need highly extensible and secure AI services with the flexibility to write plugins in multiple languages.
  • Teams that want to distribute and manage plugins via OCI registries.
  • Enterprise applications requiring sandboxing and resource limits.
  • Teams that want an AI assistant to directly operate on GitHub repos and collaboration workflows
  • Users already in the GitHub Copilot ecosystem who want a zero-deployment remote option
Not for
  • Clients that require HTTP transports (like SSE or streamable-http), since hyper-mcp defaults to stdio only.
  • Users who prefer not to install cosign and still load OCI plugins (unless they set insecure_skip_signature).
  • Users who need specific built-in tools (e.g., database operations) without wanting to configure plugins themselves.
  • Scenarios where you don't want the assistant to have write access to repos (enable only read-only toolsets)
  • Environments with strict network isolation for private repos that can't reach the official remote endpoint
Required permissions
  • Read config files (for plugin configuration).
  • Execute cosign CLI to verify OCI plugin signatures.
  • Network access (to download plugins or for plugin runtime, e.g., allowed hosts).
  • Filesystem access (for local file plugins or logs).
  • Environment variables (e.g., RUST_LOG, HYPER_MCP_LOG_PATH, HYPER_MCP_INSECURE_SKIP_SIGNATURE).
  • A personal access token (PAT) or OAuth App token; effective scope depends on the token's own permissions
  • Enabling toolsets like actions/issues/pull_requests grants write access — request tokens on a least-privilege basis
Risks and side effects
  • Loading malicious or unverified plugins could compromise the system or leak data, though signature verification and sandboxing mitigate risks.
  • OCI signature verification depends on cosign; skipping it reduces security.
  • Misconfiguring plugins may allow them to access unauthorized network or filesystem resources.
  • Write toolsets (creating/merging PRs, triggering workflows) can cause accidental changes if the token is overscoped — try a read-only toolset first
  • In hosted mode, credentials travel via the Authorization header — make sure the client-to-api.githubcopilot.com connection is trusted
Supported clientsClaude Desktop, Cursor, Claude CodeClaude Desktop, Claude Code, VS Code, Cursor, Windsurf, JetBrains IDEs, Zed, Amp
Tools315