M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
COMPARE UP TO 4 SERVERS

Compare MCP servers

Compare scores, permissions, risks, and fit in one decision-focused table.

DimensionMantishackAn autonomous vulnerability-discovery agent for authorized security testing.Hevy MCPManage your Hevy workout data from AI assistants via MCP.
FMRS49 / 100 · D77 / 100 · B
Reliability8 / 2012 / 20
Security and permissions10 / 2016 / 20
Maintenance8 / 2016 / 20
Documentation13 / 2018 / 20
Setup experience10 / 2015 / 20
Best for
  • Security researchers with explicit authorization.
  • AppSec teams combining automated detection with attacker-simulation validation.
  • Technical users comfortable with an incomplete harness and external tool dependencies.
  • Hevy PRO users who want AI assistants to directly access their workout data
  • People who prefer using MCP clients like Claude, Cursor, Codex for fitness tracking
  • Anyone needing summaries and insights from their training data
Not for
  • Testing targets without authorization.
  • Users seeking a polished, complete commercial security platform.
  • Users expecting fabricated results when external scanners are unavailable.
  • Users without a Hevy PRO subscription (API key required)
  • Users who want to use the server without an API key
  • Those needing delete workflows (Hevy API does not expose delete endpoints)
Required permissions
  • Requires access to read and analyze the target codebase.
  • Depending on enabled capabilities, may invoke local scanners, solvers, and the CodeQL CLI.
  • Authorization must be established before active or exploit testing; otherwise restrict runs to read-only static analysis.
  • Requires HEVY_API_KEY environment variable for Hevy API authentication
  • Can create, update, and replace workouts, routines, folders, templates, and body measurements via tools
  • Read operations can fetch workouts, routines, folders, templates, history, and user info
Risks and side effects
  • Gated exploitation is off by default, but active testing can still affect a target.
  • Missing underlying binaries make corresponding scanning capabilities unavailable.
  • The project describes itself as rough, with known gaps and unfinished external toolchains.
  • CodeQL in particular does not permit commercial use; licenses for all invoked components should be reviewed.
  • API key can be misused if leaked; do not expose in URLs, logs, or screenshots
  • Create operations may produce duplicates on retry; update operations replace existing records
  • The server sends data to the Hevy API and may send telemetry to external services unless disabled
Supported clientsClaude Desktop, Cursor, Codex, Antigravity
Tools1426