MCP servers that ship as code — a repository or a package you install and run locally (usually over stdio). They have no hosted endpoint, so we cannot probe or grade them: instead each one shows its repository, install command, license, stars and when it was last updated.
Collected from GitHub repositories and npm, PyPI, Cargo, Go, Maven, NuGet and RubyGems packages tagged as MCP servers, the official MCP Registry, Docker's MCP catalog, ModelScope, Baidu MCP World, Cline and other public directories; one entry per repository. A server that also offers a hosted endpoint is listed under Remote instead. These entries are not counted in our reachability, verification or readiness statistics.
-
MCP server for Project COR — 61 tools across 11 modules: projects, tasks, clients, contracts, time tracking, team management, messaging, and more
MIT -
mcp-http-inspectgithub.com/jeffereychown-Max/mcp-http-inspectupdated this year
5 HTTP/REST debugging tools for Claude: request (safe-by-default), compare responses, inspect CORS, decode JWT from Authorization header, explain status codes. Free, MIT.
MIT -
canva-mcp-servergithub.com/falcoschaefer99-eng/canva-mcp-serverupdated this year
Security-hardened Canva MCP server for Claude Code and AI assistants with auth middleware, XSS protection, CORS hardening, and input validation.
MIT ★ 2 -
Standalone CORS-free GraphiQL desktop app. Enables hot-reloading GraphQL schemas in Claude Desktop via mcp-remote on the fly without restarting sessions.
★ 1 -
Paste a developer error, get the real cause and the fix. Offline, zero-dependency explainers for CORS, ESM/CJS, npm ERESOLVE, ChunkLoadError, Postgres/Supabase DATABASE_URL and Next.js build errors.
MIT -
Paste an error, get a deterministic explanation and the fix. Offline, zero-dependency explainers for CORS, ESM/CommonJS, npm ERESOLVE, ChunkLoadError caching, Postgres/Supabase connection strings and connection errors, and Next.js build errors — as a libr
npm MIT -
corsauditgithub.com/cognis-digital/corsauditupdated this year
Detect permissive/misconfigured CORS from headers or a config
NOASSERTION -
Minimal implementation of an MCP sample server featuring API Key authentication, CORS support, and example server-side tools for weather and time retrieval.
MIT ★ 6 -
Analyze and score HTTP security headers (CSP, HSTS, CORS, cookies) with actionable fix recommendations. Free MCP server — A+ to F grading for any URL. Built by Shakil Ahamed.
-
shieldnet-mcpgithub.com/hhhashexe/shieldnet-mcpupdated this year
ShieldNet Security Scanner — MCP Server for AI Agent Security Governance. Scans URLs for XSS, SQLi, SSTI, CORS misconfig, missing headers, info disclosure, and more. Returns ALLOW/WARN/BLOCK governance decisions.
npm MIT -
Free dangerous goods packaging API and MCP server by Fortitude21. No key, open CORS. UN number to permitted UN packaging (ADR 2025), UN mark decoder, ADR 1.1.3.6 points, IBC inspection dates, bund and spill pallet sizing, jerry can quantities.
MIT -
x402 endpoint doctor for sellers and agent builders: point it at any paid x402 URL and get a graded list of what will break payments or Bazaar / x402scan listing (402 on GET/HEAD/POST, CORS, v2 header + v1 body, CAIP-2, USDC asset + EIP-712 domain, Solana
npm MIT -
@httpstatus/mcp-servergithub.com/httpstatus-com/httpstatus-mcp-serverupdated this year
24 AI-callable tools for API mocking, chaos engineering, security scanning, OpenAPI validation, distributed tracing, automation workflows, and monitoring.
npm MIT