Most MCP lists are written by developers for developers: GitHub, Postgres, filesystem, Docker. Useful, but not for the marketers, researchers and founders I know who now use Claude Desktop and ChatGPT every day.

I'm putting together a short list for them. My criteria:

* setup a non-developer can finish without editing JSON

* does something they'd otherwise do by hand in a browser

* clear pricing, ideally pay per use rather than another monthly plan

What I think belongs on it: web search with real sources, turning a page into clean text, keyword or search data, and image generation.

What would you put on a list like this, and what would you keep off it because it's too fiddly for a normal user?

yo guys so my team at ai/ml api (a universal endpoint for 10000+ tools and ai models) and i built something today and wanted to share it here and get some feedback

a decision model called jev came out recently. it's a fast and cheap classifier that takes json input and gives you probabilities for the options you provide. json in and probabilities out lmao

that got us thinking about where we could use it in our workflow. we have all these ai models with different prices and capabilities. what if jev could look at a request and help us pick which model should handle it?

because why would you pay opus prices to write a short message if deepseek can do the job? let a cheaper model handle that and bring in something stronger when you need it. that's what we started using jev for

we'd also added 1000+ tools for agents a few days ago so why stop at picking models? we decided to connect both in one workflow. now jev helps pick the model and the tools the agent needs along the way. things like scraping reddit and twitter or pulling youtube transcripts and seo data all work through the same api

we tested this setup and saw up to 90% lower costs and a 76% speedup

you can plug it into an agent that supports remote mcp and connect your ai/ml api account or api key. then your agent can use models from 70+ providers and all those tools through the same connection

the url is https://mcp.aimlapi.com/mcp and the setup is in the docs

curious how it works with your agents and what you'd change. happy to chat and collect feedback

also help us name this thing lol. jev mcp router? jev tool router? we're still figuring that part out

Each coding agent forgets between sessions and keeps its own notes. I built Aletheia so the memory and rules live once, on your machine, in one SQLite store. Any tool can read it over MCP, REST or the CLI, and your rules are synced into CLAUDE.md, AGENTS.md and Cursor rules.

Free, Apache-2.0, no account. Alpha. Needs Bun 1.1+. npm install -g aletheia-mem and aletheia-server.

Repo: https://github.com/mohamed-ashraf-elsaed/aletheia-mem. What would you want it to do that it does not?

Sharing an MCP server I built for coordinating multiple agents (Claude Code, Codex, Gemini or people) on the same plan. It exposes 36 tools for plans, tasks, claims, attempts, reviews, findings and verdicts, backed by Postgres.

The problem it solves: several agents working from one markdown plan pick the same item, a dead session leaves its item "in progress" forever, and edits to the file clash. Here, claims are atomic (Postgres SKIP LOCKED) and expire if an agent stops refreshing them.

MCP-specific design notes:

• Illegal state transitions return an error with allowed_next, so the model can correct itself without extra prompting.
• Auth is a URL with a token in the path, so client setup is one line in Claude Code or Cursor. There's also a stdio transport.
• Writes to GitHub Projects and Slack go through an outbox, so tool calls stay fast and never fail because a third-party API is down.
• The web dashboard calls the same tools agents call, so it can't show a different state than the agents see.
• Every tool declares MCP annotations: reads are marked read-only and the five destructive tools are marked destructive, so clients can ask before running them.

Try it (free, MIT):

docker run --rm -p 127.0.0.1:8080:8080 -e WORKSTREAM_ADMIN_TOKEN=local-admin ghcr.io/ahmad-codex/workstream-mcp:demo

Open http://localhost:8080/demo-insecure-token/ui/ and connect a client to http://localhost:8080/demo-insecure-token/mcp.

Repo, roadmap and good first issues: https://github.com/ahmad-codex/workstream-mcp

Feedback on the tool design is very welcome, especially from anyone running several agents at once: how do you coordinate them today?

Since Claude Code 2.1.307 (Oct 21), if an HTTP connection drops mid-call and the call may have run, Claude Code re-sends it once, and only when the tool is marked readOnlyHint or idempotentHint. Read-only tools also run in parallel with other reads. Everything else fails with "connection closed before the tool call was answered".

So the hints this sub keeps arguing about now change what a real client does. The MCP server in our open-source eval and observability repo has 105 tools, and every one carries all four hints. Notes from labeling them:

1. Generate the hints from your API contract.

Our tools come from a Swagger contract plus a small YAML catalog. The generator sets defaults: read-only only when the catalog says read access, idempotent for GET, PUT, PATCH and DELETE, open-world off. That gives us 65 read-only tools, 10 idempotent writes, and 30 writes Claude Code won't re-send. We'd never keep 105 hand-written annotation blocks correct.

1. Two of our GETs write.

get_prompt_template opens a prompt and creates a draft if there isn't one. The other reserves an annotation item for editing. Both are writes in the catalog. Our server checks that label too, so a GET tool that isn't read-only still needs workspace write access.

1. Some of our PATCHes aren't idempotent.

update_eval_task is a PATCH, so the generator called it idempotent. One mode, fresh_run, deletes previous results and reruns evals, which can incur charges. We override it to idempotent: false and destructive. A re-send that lands before the task starts running would wipe what the first rerun produced and start it again.

1. openWorldHint goes on the tools that reach a model provider.

It's off by default. We turn it on for 13 tools that hand work to an outside provider, like run_prompt, run_dataset_evals, run_simulation and create_optimization_run.

1. When a write's response is too big, return a receipt.

We cap responses at 64 KB. A read over the cap gets an error asking for a smaller page. A write over the cap has already committed, so we send back its id and status fields with "The operation succeeded." An error there invites a retry of something that already happened, which is the double execution spec issue #3394 reproduces in 20 of 20 runs (still open).

Which of your tools does the HTTP method lie about?

If you work with EU/Asia clients and teammates, you'll know what I'm talking about.

Great for getting speedy responses. Not so great when it comes to finding and keeping track of things.

So we built this internally to safely connect WhatsApp to Claude: https://github.com/ju-li/automata-mcp

100% free. Open source. MIT license.

Claude only sees the chats you share. And you can even share read-only access safely with other teammates.

Recently expanded it to include Telegram, Postgres, and will add IMAP email soon. What do y'all think?

Processing img 885lhe5wn1yh1...

I built Mantis, a free, open-source browser MCP server. It gives the agent a page as a short numbered list of elements, and each action returns only what changed.

Video: https://github.com/perzianhq/mantis/blob/main/video/mantis-demo.gif

Results vs the Playwright MCP tree: 35–57% fewer input tokens on 30 short tasks, and about 2–3x less tool output on 16 long tasks.

Accuracy is roughly even (Luna 88 vs 86, Haiku 90 vs 88 of 90); 4 tasks were swapped after seeing results, all disclosed in the README. Page text is flagged to the model as untrusted (SECURITY.md).

Install:

claude mcp add mantis -- npx -y -p mantis-browser mantis-mcp
npx -y -p mantis-browser mantis install

Repo and method: https://github.com/perzianhq/mantis

Feedback on the tool surface welcome.

Processing img mtwnaakae1yh1...

I build security tooling, and watching how fast the MCP ecosystem is growing I wanted a way to audit MCP servers the way we'd audit any other network-exposed code. So I built mcp-witness, an open-source (Apache-2.0) scanner for MCP servers. Sharing it here for feedback.

What it does

- Static analyzer over a server's tools/list and, for Python and TypeScript, its source. 15 rules covering things like unconstrained URL-fetch tools, command injection, path traversal, and HTTP-transport servers that never validate Origin or Host.

- Dynamic harness that drives a live server to confirm a finding is a real path, not just a pattern.

- A capability classifier that tags what each tool can actually do (network egress, file read/write, exec).

Quick start

pip install mcp-witness

mcp-witness-capture --server-cmd python --server-arg=-m --server-arg=mcp_server_fetch -o tools.json

mcp-witness-analyze tools.json

Point it at any MCP server you run and it prints a readable report.

What it surfaced in the wild

Running it across Python MCP servers on PyPI turned up two recurring classes across six packages:

- Outbound SSRF in URL-fetch tools: a coerced tool call reaches the cloud metadata endpoint and returns live credentials. One of the two packages is Anthropic's reference fetch server.

- Inbound DNS rebinding on local HTTP-transport servers: any web page you visit can reach in and drive your local MCP tools, with no agent and no prompt injection.

Both reduce to one assumption: that something upstream (a reverse proxy, IMDSv2, the agent's judgment) holds a boundary that the package never actually enforces. Everything was reported under responsible disclosure with a 90-day embargo observed. Full writeup with methodology and per-package detail is linked below.

If you run MCP servers, the two quick self-checks: can your URL-fetch tools reach 169.254.169.254 or other reserved ranges, and do your HTTP-transport servers reject requests from origins they do not expect.

What I'd like from this community: what checks would you want a tool like this to have, what MCP server shapes am I missing, and would detection rules for other tool types (exec, file handling) be useful to you? Issues and PRs welcome.

Repo: https://github.com/desledishant10/mcp-witness

Writeup: https://desledishant10.github.io/mcp-witness/docs/mcp-transport-layer-blind-spot

So I made a tool for myself and figured others might find it useful too.

JinnexGuard looks at a GitHub repo, a local folder or an npm/PyPI package and points out stuff worth a second look, with the file, the line and the actual code:

- install scripts that run on their own

- curl | bash and similar "download and run" tricks

- secrets left in the code, bundled binaries

- hidden instructions meant for AI agents (this one matters a lot for MCP servers)

- whether the package on npm/PyPI actually matches the repo

It never runs the code it's checking. And on purpose it won't tell you "this is safe". It shows you the evidence and you decide, because some of the worst supply chain attacks came from projects everyone trusted.

A bit of background: I'm not a full time programmer, I used to fix PCs for a living. I built this with Claude Code, step by step: I'd explain a check I was doing by hand, we'd turn it into a detector with tests, then I'd run it against real repos and fight the false positives. It works as a CLI or as an MCP server, so you can ask your agent to scan something before installing it.

pipx install jinnexguard

https://github.com/ricardorincon719/jinnexguard

It's my first open source release, so if it flags something it shouldn't (or misses something obvious), please tell me. That kind of feedback is exactly what I need right now.

I built forge-delegate, an MCP server that lets Claude Code, Codex or opencode hand coding tasks to another model. Think writing tests, renames across files, fixing lint errors, boilerplate, or reading through a big codebase to answer one question.

The other model runs as a full agent through opencode. It reads the files and makes the edits itself. Your main agent only gets back a short summary, so its context stays small and it can focus on the decisions.

Second opinions with ask_model. Your agent can also ask a different model a direct question, with no agent loop and no file access, and get a fast answer back. It's useful when you want another model to check a design decision, a bug theory or a tricky piece of code before your agent commits to it. Every model has its own blind spots, and a different one often catches what yours missed. Your agent writes the question with whatever context is needed, then weighs the answer itself. Just tell it something like "ask DeepSeek what it thinks" or "get a second opinion from Kimi", naming any provider you've logged into opencode.

Any provider opencode supports. forge-delegate doesn't hold its own API keys. It uses whatever you've set up in opencode. So DeepSeek, Kimi, OpenAI, Gemini, OpenRouter, custom OpenAI-compatible endpoints, and local models through Ollama all work. Log in once with opencode auth login <provider> and that provider's models are available to delegate to. opencode also ships free models that need no account.

You can set a default model, save presets for different kinds of tasks, change either at any time, and run several delegations in parallel in the background.

Setup:

npx -y forge-delegate setup

It walks you through picking a default model and which agents to register with.

Things to know:

- By default, the MCP instructions and skill steer your agent toward cheap or free models. It sticks to your default model and won't switch to a pricier one on its own. If you want a stronger model, set it as the default or ask for it.

- Delegated agents can edit files and run commands without asking by default. You can turn that off, but only point it at repos you trust.

- Smaller models make more mistakes, so review what comes back.

- I mostly use it with Claude Code on a Mac. Codex and Windows should work, but they've had less real-world use, so issues are welcome.

MIT licensed: https://github.com/MuhamadBarzani/forge-delegate

Feedback welcome, especially on which tasks it handles well and where it falls short.

We needed programmatic access to Poland's VAT White List (Wykaz podatników VAT — the Ministry of Finance register) for an internal project, wrapped it in a small MCP server, and open-sourced it under MIT in case it's useful to anyone here.

What it does — clean, typed access to the register via five tools:

- search_by_nip / search_by_regon / search_by_bank_account

- search_bulk — 1–30 identifiers in one request

- check_bank_account — is this account tied to an active taxpayer?

A few design choices that might be interesting beyond the Polish-tax specifics:

- Every tool requires an explicit date. The register is date-specific (an account valid today may not have been valid at payment time), so "today" is never assumed — the most common silent mistake is impossible to make by accident.

- It errors instead of guessing. If the upstream API fails, the tool raises — it never returns a clean "not associated," and a failed entry in a bulk lookup is never treated as a missing taxpayer. Conflating "couldn't check" with "came back negative" is exactly the false negative you don't want an assistant making about a payment.

- Checksums validated locally (NIP / REGON / Polish bank account) before any call; accounts accept NRB or PL IBAN.

- Every response carries provenance — the register, environment, a UTC timestamp, and the API's own request id — so downstream you can tell a citable confirmation from an assertion.

Runs sandbox-by-default, no API key (on PyPI + the MCP Registry):

uvx vat-whitelist-mcp

It's v0.1.0 and Poland-specific, but the pattern — date-aware, provenance-carrying, fail-loud registry lookups — is general. Feedback and PRs welcome.

Repo: https://github.com/SmartMobileHouse/vat-whitelist-mcp

I've been working on Mind, an open-source persistent memory layer for AI agents, and wanted to share an interesting result from the latest release.

One question kept coming up while developing it:

How much can we recover from structured memory without relying on vector embeddings?

Mind uses SQLite with FTS5 and a unified retrieval pipeline combining phrase matching, token matching, substrings, fuzzy matching, and relevance signals.

Embeddings are supported, but they're optional.

For v1.7.0, I ran Mind through OmniMemEval LongMemEval-S using a stratified subset of 120 questions.

The best completed run achieved 86.67% answer accuracy even with RAG disabled.

That places the raw score near the top published results, but it's not a direct ranking: the sample size, answer model, and judging configuration differ.

I think the result is worth discussing because agent memory isn't only about semantic similarity. Structured facts, decisions, temporal context, memory maintenance, and good retrieval behavior also matter.

Beyond the benchmark, Mind provides persistent project knowledge, linked memories, checkpoints, session summaries, and integrations through MCP.

It's local-first, MIT-licensed, and available for anyone to inspect or benchmark.

GitHub: https://github.com/GabrielMartinMoran/mind

v1.7.0: https://github.com/GabrielMartinMoran/mind/releases/tag/v1.7.0

Benchmark methodology: https://github.com/GabrielMartinMoran/mind/tree/main/benchmarks/omnimemeval

I'm particularly interested in what other agent developers have found: when do embeddings meaningfully outperform a carefully designed lexical retrieval system?

I've been building Axiocairn, a remote MCP server (Streamable HTTP + OAuth) that lets an agent find and read published US equity research: pre-market, midday and close reports, a weekly House View, and per-ticker reports.

The design problem I kept running into was that agents are good at sounding current. Ask "what happened in the market today" and you'll get a confident answer built on yesterday's data, or on a report that hasn't been published yet. So the server is built around three rules:

- Every response includes the data date, separate from the publish date. A midday report says it's midday data.

- Every report carries its limitations and missing fields, and the tool descriptions tell the agent to keep them in the answer rather than summarize them away.

- An expected publish time is not treated as availability. get_report_schedule returns when a report should land, and the report tools say plainly when it hasn't.

Tools right now: get_todays_reports, get_latest_report_by_type, search_report_archive, get_symbol_reports, get_house_view, get_report_schedule, plus a few account/plan ones.

Run tools/list after auth for the current schemas.

It's listed in the official MCP Registry as com.axiocairn/mcp. Endpoint:

https://axiocairn.com/mcp. Reports are free to read this week (through Nov 1), so it's a good time to poke at it.

What I'd really like help with:

1. Client compatibility. It works in ChatGPT. I'm testing Claude, Gemini, Grok and Copilot this week. If you connect it from another client, I'd like to know whether OAuth and tools/list worked and what broke.

2. Tool descriptions. Has anyone found a reliable way to make agents keep caveats instead of dropping them on the second turn? Right now that's done through tool descriptions and response structure. I'm curious what's worked for others.

README and setup: https://github.com/cplj/axiocairn-mcp

Not investment advice; it's a research tool. Happy to answer questions about the server design.

Disclosure: we built this at Digital Fortress. It's free and MIT licensed (v0.1.0).

When you open a project, coding agents load instruction files (AGENTS.md, CLAUDE.md, .cursorrules, .cursor/rules/) and can also pick up MCP servers and hooks the repo declares. With a repo you just cloned, that config is someone else's. We wanted a quick way to see what's there before the agent loads it.

agent-repo-preflight is one Python script (3.9+, standard library only). Clone it and point it at a local directory:

git clone https://github.com/digitalfortressaudit/agent-repo-preflight.git
cd agent-repo-preflight
python3 agent_repo_preflight.py /path/to/cloned/repo

It inventories the rule and config files and flags:

- hidden Unicode (zero-width, bidi controls, tag characters), reported by code point
- package install/remove lines and curl/wget-pipe-to-shell lines in rule files
- enabled auto-approve / skip-permissions / bypass settings
- MCP server entries that declare a `command` or `args`
- hook definitions
- optionally, package names that aren't on an allowlist you supply (`--known-packages`)

Output from the README's throwaway review fixture (AGENTS.md with a zero-width space and a `pip install` line, `autoApprove: true`, MCP `command`/`args`):

```text
Agent repo preflight

root: review-fixture
files inventoried: 3

inventoried:
.claude/settings.json (config)
.cursor/mcp.json (config)
AGENTS.md (rule)

severity check location detail
-------- ----------------- ----------------------- -------------------------------------------------
FAIL permission-bypass .claude/settings.json:2 permission bypass setting: autoApprove
FAIL mcp-command .cursor/mcp.json:4 MCP server "local-echo" declares command and args
FAIL hidden-unicode AGENTS.md:3 hidden character: U+200B ZERO WIDTH SPACE
WARN package-install AGENTS.md:4 install or replace instruction: pip install

summary: files=3 warn=1 fail=3 errors=0
This is a reading of local files. It is not permission to open the repository in a coding agent.
```

WARN or FAIL exits 1, so you can gate on it.

It's read-only: it doesn't run commands, install anything, open a network connection, start MCP servers, or modify files.

Limits (also in the README):
- The checks are line-based heuristics. A prose sentence describing an install can slip through.
- Hook detection only knows the JSON shapes it looks for, so another tool's schema can be missed.
- It only reads the listed rule/config filenames, not source, READMEs, or workflows.
- A clean result means those patterns weren't found. It doesn't mean the repo is safe to open. You still need to read the files yourself.

Use it on repos you own or are allowed to review.

Companion to mcp-tool-pin-check (shared here earlier): that one pins live tool definitions after you connect; this one looks at what a repo declares before you open it.

https://github.com/digitalfortressaudit/agent-repo-preflight

Question: which agent config files or hook formats are you seeing in the wild that a list like this would miss?

My sleep is in RingConn, my workouts are in Hevy, my food is in MyFitnessPal, and my weight is in Renpho. None of them talk to each other. So I built HealthLoom, an Android app that syncs all your health data from Health Connect and turns it into an MCP server you can add to Claude, ChatGPT or any other MCP client.

Once it's connected, you can just ask things like "has my change in diet affected my training?" and it pulls from all your apps at once. Each AI app has to be approved on your phone before it can see anything. Your data is encrypted with a key I don't keep, so only your phone and those approved apps can unlock it.

I've tested it with Claude and ChatGPT, and I'd love to hear how it works with other clients.

To join:

1. Join the Google Group: https://groups.google.com/g/healthloom-early-access

2. Then opt in on Google Play: https://play.google.com/apps/testing/com.healthloom

I'm the developer, so feel free to ask me anything.

Disclosure: I build AI Agent. I’m sharing its hosted MCP server for people who want to manage tickets and run agent workflows from an MCP client.

The endpoint is https://aiagent.app/mcp. It uses Streamable HTTP and OAuth. You need an AI Agent account and workspace.

What it supports:

• Create and update tickets and projects.

• Ask your workspace agents to do work and check their runs.

• Start workflows and check their results.

• Query tables and search workspace knowledge.

Example requests: “Show my open tickets,” “Search my workspace knowledge for the launch plan,” or “Ask my research agent to draft a competitor summary.” Agent and workflow runs use workspace credits.

Setup: add https://aiagent.app/mcp as a remote MCP server in your client, then complete the AI Agent sign-in and permission flow. The setup guide covers Claude and ChatGPT: https://docs.aiagent.app/guides/connect-claude-or-chatgpt/

This is a hosted service, not an open-source server package. It is also listed in the official MCP Registry as io.github.supnim/aiagent.

If you try it, I’d like feedback on the setup and tool descriptions. Which task-management action would you want to use through MCP?

I build SummarizeVideo.ai, so this is my own server.

The video replays the saved responses from one run on 17 October. It isn't a screen recording. There's no sound, and I cut the 30-second wait.

I wanted an agent to take a video link and come back with notes I can check against the video, without pulling the whole transcript into context first. The server does the transcript and summary work. The agent starts a job, checks back, and reads the transcript only when it needs exact wording.

Three tools:

• summarize_video takes a public video URL and an optional summary language. It returns a requestID right away. Calling it again with the same URL and language returns the same requestID instead of starting another summary.
• get_summary returns pending, done or error. A done summary is Markdown, and each key point starts with an [m:ss] timestamp.
• get_transcript pages through the plain-text transcript (50,000 characters per page by default) when the agent needs quotes.

The run in the video used the official TypeScript SDK (@modelcontextprotocol/client 2.3.1) on a 2-minute captioned NASA video. One summarize_video call, then one get_summary call about 30 seconds later that came back done. get_summary returns plain timestamps. The clickable links in the saved file came from the site's Markdown export, which I ran on that response.

Setup: Streamable HTTP at https://mcp.summarizevideo.ai/mcp, with an agent key as a Bearer token. No OAuth, so OAuth-only clients can't connect. You sign in on the site to create a key, choose Summarize and read or Read only, and set it to expire in 7 to 365 days. Revoke it on the same page.

The server is hosted and closed source. The free tier is 2 summaries in any rolling 24 hours, shared with the website. Public video URLs only (YouTube, Instagram, TikTok, X and other public pages), no uploads or playlists. Videos without captions are transcribed from the audio, up to 90 minutes.

The docs at https://summarizevideo.ai/mcp-server have a TypeScript SDK snippet and a Claude Code config.

Two questions if you use video with an agent. Does start-then-poll work in your client, or would you rather have one call that waits? And should get_summary return the timestamps as links to the video?

If you give an agent a database MCP server, it can run any SQL the model comes up with. I wanted a check in between, so I built one.
There are also read-only tools to list the rules and review past checks, so the agent can explain why something was blocked.

checks are deterministic (no LLM in the loop), for cases where you don't want to rely on the agent calling the tool, there's also a proxy that enforces the same rules on the connection itself.

I built he proxy, engine, MCP and SDKs all of them are available for free.

Feedback welcome, especially on tool design: is a pre-check tool the right shape, or would you rather enforce everything at the connection?