{
  "version": "1.0.0",
  "license": "CC0-1.0 (original catalog annotations only; linked projects retain their licenses)",
  "last_verified": "2026-10-24",
  "verification_note": "Maintainer documentation checked live on 2026-10-24. This is not an installation audit, vulnerability scan, runtime test, or security certification. Scope summarizes capabilities rather than enumerating OAuth scope strings. Confidence measures documentation evidence, not server safety.",
  "servers": [
    {
      "id": "filesystem",
      "name": "Filesystem",
      "scope": "Read and modify files in configured directories",
      "transport": "stdio (reference launch)",
      "notes": "Restrict allowed directories and apply OS isolation. Root README verified; subdirectory retrieval was blocked, so detailed tool permissions were not individually audited.",
      "sources": [
        "https://github.com/modelcontextprotocol/servers"
      ],
      "confidence": 0.65,
      "last_verified": "2026-10-24"
    },
    {
      "id": "fetch",
      "name": "Fetch",
      "scope": "Fetch and convert URL content",
      "transport": "stdio (reference launch)",
      "notes": "Remote content is untrusted; enforce outbound network policy separately. Root README verified; subdirectory retrieval was blocked, so detailed tool permissions were not individually audited.",
      "sources": [
        "https://github.com/modelcontextprotocol/servers"
      ],
      "confidence": 0.65,
      "last_verified": "2026-10-24"
    },
    {
      "id": "git",
      "name": "Git",
      "scope": "Read, search and modify Git repositories",
      "transport": "stdio (reference launch)",
      "notes": "Isolate the repository working directory and mutation permissions. Root README verified; subdirectory retrieval was blocked, so detailed tool permissions were not individually audited.",
      "sources": [
        "https://github.com/modelcontextprotocol/servers"
      ],
      "confidence": 0.65,
      "last_verified": "2026-10-24"
    },
    {
      "id": "memory",
      "name": "Memory",
      "scope": "Read and write a persistent knowledge graph",
      "transport": "stdio (reference launch)",
      "notes": "Stored context can contain sensitive user data. Root README verified; subdirectory retrieval was blocked, so detailed tool permissions were not individually audited.",
      "sources": [
        "https://github.com/modelcontextprotocol/servers"
      ],
      "confidence": 0.65,
      "last_verified": "2026-10-24"
    },
    {
      "id": "sequential-thinking",
      "name": "Sequential Thinking",
      "scope": "Process structured reasoning steps",
      "transport": "stdio (reference launch)",
      "notes": "No third-party account authorization is required. Root README verified; subdirectory retrieval was blocked, so detailed tool permissions were not individually audited.",
      "sources": [
        "https://github.com/modelcontextprotocol/servers"
      ],
      "confidence": 0.65,
      "last_verified": "2026-10-24"
    },
    {
      "id": "everything",
      "name": "Everything",
      "scope": "Demonstrate prompts, resources and tools",
      "transport": "stdio (reference launch)",
      "notes": "Reference and test implementation; not a production default. Root README verified; subdirectory retrieval was blocked, so detailed tool permissions were not individually audited.",
      "sources": [
        "https://github.com/modelcontextprotocol/servers"
      ],
      "confidence": 0.65,
      "last_verified": "2026-10-24"
    },
    {
      "id": "time",
      "name": "Time",
      "scope": "Time and timezone conversion",
      "transport": "stdio (reference launch)",
      "notes": "Small capability surface; review package dependencies separately. Root README verified; subdirectory retrieval was blocked, so detailed tool permissions were not individually audited.",
      "sources": [
        "https://github.com/modelcontextprotocol/servers"
      ],
      "confidence": 0.65,
      "last_verified": "2026-10-24"
    },
    {
      "id": "playwright",
      "name": "Playwright",
      "scope": "Browser control, page interaction and downloads",
      "transport": "stdio / HTTP",
      "notes": "A browser session may expose authenticated state. The maintainer says this is not a security boundary.",
      "sources": [
        "https://github.com/microsoft/playwright-mcp"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "chrome-devtools",
      "name": "Chrome DevTools",
      "scope": "Inspect and control Chrome pages",
      "transport": "Local process (stdio)",
      "notes": "Browser debugging exposes page and debugging data; product description and installation entry point checked.",
      "sources": [
        "https://github.com/ChromeDevTools/chrome-devtools-mcp"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "github",
      "name": "GitHub",
      "scope": "Token-accessible repositories, issues, PRs and enabled toolsets",
      "transport": "stdio / remote HTTP",
      "notes": "Use least-privilege tokens, explicit tool allowlists and --read-only. Tool filtering does not replace credential restrictions.",
      "sources": [
        "https://github.com/github/github-mcp-server"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "stripe",
      "name": "Stripe",
      "scope": "Stripe account operations granted through OAuth",
      "transport": "Remote HTTP",
      "notes": "Official hosted service verified; review exact requested scopes in the authorization flow.",
      "sources": [
        "https://github.com/stripe/ai"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "supabase",
      "name": "Supabase",
      "scope": "Database, documentation and enabled project or account tools",
      "transport": "HTTP",
      "notes": "Restrict project_ref, read_only=true and features.",
      "sources": [
        "https://github.com/supabase/mcp"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "redis",
      "name": "Redis",
      "scope": "Read and update Redis data accessible to the credential",
      "transport": "stdio",
      "notes": "Tools include writes; restrict keys and commands with Redis ACLs.",
      "sources": [
        "https://github.com/redis/mcp-redis"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "mongodb",
      "name": "MongoDB",
      "scope": "MongoDB data and Atlas management, depending on credentials",
      "transport": "stdio / HTTP",
      "notes": "--readOnly disables create/update/delete. Examples enable it, but the option defaults to false.",
      "sources": [
        "https://github.com/mongodb-js/mongodb-mcp-server"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "elasticsearch",
      "name": "Elasticsearch",
      "scope": "Queries against indices accessible to the credential",
      "transport": "stdio / Streamable HTTP",
      "notes": "Use read-only credentials restricted to required indices.",
      "sources": [
        "https://github.com/elastic/mcp-server-elasticsearch"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "grafana",
      "name": "Grafana",
      "scope": "Grafana, enabled data sources and configuration tools",
      "transport": "stdio / Streamable HTTP / legacy SSE",
      "notes": "Constrain service-account roles and enabled tools; verify deployment-specific permissions.",
      "sources": [
        "https://github.com/grafana/mcp-grafana"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "sentry",
      "name": "Sentry",
      "scope": "Sentry errors, traces and developer debugging data",
      "transport": "Remote HTTP",
      "notes": "Upstream tokens or OAuth determine access; tools target human-supervised developer workflows.",
      "sources": [
        "https://github.com/getsentry/toolkit"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "clickhouse",
      "name": "ClickHouse",
      "scope": "ClickHouse data accessible to the database account",
      "transport": "stdio / Streamable HTTP / legacy SSE",
      "notes": "Use a dedicated restricted database account; transport does not authorize database queries.",
      "sources": [
        "https://github.com/ClickHouse/mcp-clickhouse"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "qdrant",
      "name": "Qdrant",
      "scope": "Store and retrieve information in vector collections",
      "transport": "stdio / Streamable HTTP / legacy SSE",
      "notes": "Can persist data; restrict API keys and target collections.",
      "sources": [
        "https://github.com/qdrant/mcp-server-qdrant"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "neo4j-cypher",
      "name": "Neo4j Cypher",
      "scope": "Configured database schema and read/write Cypher",
      "transport": "Local process / HTTP",
      "notes": "Restrict database-user write privileges and graph access.",
      "sources": [
        "https://github.com/neo4j-contrib/mcp-neo4j"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "motherduck",
      "name": "DuckDB / MotherDuck",
      "scope": "Local or hosted database queries, with optional writes",
      "transport": "stdio / HTTP",
      "notes": "Local files default to read-only. The maintainer warns that this does not isolate local files or settings.",
      "sources": [
        "https://github.com/motherduckdb/mcp-server-motherduck"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "brave-search",
      "name": "Brave Search",
      "scope": "Search using a Brave API key",
      "transport": "stdio / HTTP",
      "notes": "Configure enabled-tools; queries are transmitted to the search provider.",
      "sources": [
        "https://github.com/brave/brave-search-mcp-server"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "firecrawl",
      "name": "Firecrawl",
      "scope": "Search, scrape and parse; additional tools with credentials",
      "transport": "Local process / remote HTTP",
      "notes": "The keyless endpoint has three tool types and rate limits; other capabilities need credentials.",
      "sources": [
        "https://github.com/firecrawl/firecrawl-mcp-server"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "tavily",
      "name": "Tavily",
      "scope": "Web search, extraction, mapping and crawling",
      "transport": "Remote HTTP",
      "notes": "Supports OAuth; avoid putting API keys in URLs that may be logged.",
      "sources": [
        "https://github.com/tavily-ai/tavily-mcp"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "exa",
      "name": "Exa",
      "scope": "Search, fetch content and optional research agents",
      "transport": "Streamable HTTP",
      "notes": "Anonymous access is limited. Agent requires OAuth or an API key; restrict tools with the tools parameter.",
      "sources": [
        "https://github.com/exa-labs/exa-mcp-server"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "cloudflare-api",
      "name": "Cloudflare API",
      "scope": "Broad Cloudflare API access and code execution",
      "transport": "Streamable HTTP",
      "notes": "Official directory checked; account operations depend on OAuth grants.",
      "sources": [
        "https://github.com/cloudflare/mcp-server-cloudflare"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "cloudflare-docs",
      "name": "Cloudflare Documentation",
      "scope": "Read public Cloudflare documentation",
      "transport": "Streamable HTTP",
      "notes": "Official server directory checked.",
      "sources": [
        "https://github.com/cloudflare/mcp-server-cloudflare"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "cloudflare-containers",
      "name": "Cloudflare Container",
      "scope": "Create sandbox development environments",
      "transport": "Streamable HTTP",
      "notes": "Official directory checked; account operations depend on OAuth grants.",
      "sources": [
        "https://github.com/cloudflare/mcp-server-cloudflare"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "cloudflare-browser",
      "name": "Cloudflare Browser Run",
      "scope": "Fetch web pages and screenshots",
      "transport": "Streamable HTTP",
      "notes": "Official directory checked; account operations depend on OAuth grants.",
      "sources": [
        "https://github.com/cloudflare/mcp-server-cloudflare"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "cloudflare-dex",
      "name": "Cloudflare DEX",
      "scope": "Organization application experience monitoring",
      "transport": "Streamable HTTP",
      "notes": "Official directory checked; account operations depend on OAuth grants.",
      "sources": [
        "https://github.com/cloudflare/mcp-server-cloudflare"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "cloudflare-casb",
      "name": "Cloudflare CASB",
      "scope": "Inspect SaaS security configuration",
      "transport": "Streamable HTTP",
      "notes": "Official directory checked; account operations depend on OAuth grants.",
      "sources": [
        "https://github.com/cloudflare/mcp-server-cloudflare"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    },
    {
      "id": "cloudflare-blog",
      "name": "Cloudflare Blog",
      "scope": "Read public Cloudflare blog content",
      "transport": "Streamable HTTP",
      "notes": "Official server directory checked.",
      "sources": [
        "https://github.com/cloudflare/mcp-server-cloudflare"
      ],
      "confidence": 0.9,
      "last_verified": "2026-10-24"
    }
  ],
  "crosswalk": [
    {
      "title": "Stable specification baseline",
      "before": "2025-06-18",
      "after": "2025-11-25, then 2026-07-28; latest currently redirects to the latter",
      "action": "Pin a protocol version and test interoperability. Do not label 2025-11-25 as the current stable revision.",
      "sources": [
        "https://modelcontextprotocol.io/specification/latest",
        "https://modelcontextprotocol.io/specification/2025-11-25/changelog",
        "https://modelcontextprotocol.io/specification/2026-07-28/changelog"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    },
    {
      "title": "Authorization discovery and incremental consent",
      "before": "2025-06-18 authorization model",
      "after": "2025-11-25 adds OIDC discovery support and incremental scope consent",
      "action": "Handle incremental authorization through WWW-Authenticate and validate authorization-server metadata.",
      "sources": [
        "https://modelcontextprotocol.io/specification/2025-11-25/changelog"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    },
    {
      "title": "Client registration and issuer binding",
      "before": "Earlier client-registration mechanisms",
      "after": "2025-11-25 recommends Client ID Metadata Documents; 2026-07-28 deprecates DCR while retaining compatibility",
      "action": "Prefer metadata documents. Key credentials by issuer and validate any authorization-response iss parameter.",
      "sources": [
        "https://modelcontextprotocol.io/specification/2025-11-25/changelog",
        "https://modelcontextprotocol.io/specification/2026-07-28/changelog"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    },
    {
      "title": "Handshake and version negotiation",
      "before": "initialize / initialized handshake",
      "after": "2026-07-28 removes the handshake; request _meta carries version and capabilities; server/discover is added",
      "action": "Implement discovery and per-request metadata; retain explicit compatibility paths for older revisions.",
      "sources": [
        "https://modelcontextprotocol.io/specification/2026-07-28/changelog"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    },
    {
      "title": "Sessions and subscriptions",
      "before": "Optional HTTP protocol sessions, GET streams and resource subscriptions",
      "after": "2026-07-28 removes Mcp-Session-Id and introduces subscriptions/listen",
      "action": "Represent application state with explicit handles and process opted-in subscription types.",
      "sources": [
        "https://modelcontextprotocol.io/specification/2026-07-28/changelog"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    },
    {
      "title": "Server-initiated input",
      "before": "Server requests for sampling, elicitation and roots",
      "after": "2026-07-28 uses MRTR input_required results and request retries",
      "action": "Handle inputRequests, inputResponses and resultType. Treat older results without resultType as complete.",
      "sources": [
        "https://modelcontextprotocol.io/specification/2026-07-28/changelog"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    },
    {
      "title": "Long-running tasks",
      "before": "No experimental tasks in 2025-06-18; added in 2025-11-25",
      "after": "2026-07-28 moves redesigned tasks into an optional extension",
      "action": "Negotiate extension support explicitly; do not depend on core tasks/result.",
      "sources": [
        "https://modelcontextprotocol.io/specification/2025-11-25/changelog",
        "https://modelcontextprotocol.io/specification/2026-07-28/changelog"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    },
    {
      "title": "Response-stream recovery",
      "before": "Earlier Streamable HTTP supports SSE resumption",
      "after": "2026-07-28 removes Last-Event-ID and message redelivery",
      "action": "Retry broken requests with new request IDs; add application-level idempotency for writes.",
      "sources": [
        "https://modelcontextprotocol.io/specification/2026-07-28/changelog"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    },
    {
      "title": "Caching and HTTP request headers",
      "before": "These mandatory fields were absent in 2025-06-18",
      "after": "2026-07-28 adds ttlMs / cacheScope and Mcp-Method / Mcp-Name",
      "action": "Update clients and proxies; respect private/public cache boundaries.",
      "sources": [
        "https://modelcontextprotocol.io/specification/2026-07-28/changelog"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    },
    {
      "title": "Deprecated features",
      "before": "Roots, Sampling, Logging and legacy HTTP+SSE",
      "after": "2026-07-28 places them under the formal deprecation lifecycle",
      "action": "For new implementations use parameters/resources, direct model APIs, stderr or telemetry, and Streamable HTTP.",
      "sources": [
        "https://modelcontextprotocol.io/specification/2026-07-28/changelog"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    }
  ],
  "incidents": [
    {
      "title": "MCP Inspector unauthenticated proxy: CVE-2025-49596",
      "date": "2025-06-13",
      "kind": "Published security advisory",
      "failure": "Inspector versions below 0.14.1 lack authentication between client and proxy, allowing unauthenticated requests to launch stdio commands.",
      "fix": "This specific issue was patched in 0.14.1. Use a currently supported release and protect the local proxy.",
      "sources": [
        "https://github.com/advisories/GHSA-7f8r-222p-6f5g"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    },
    {
      "title": "mcp-remote command injection: CVE-2025-6514",
      "date": "2025-07-09",
      "kind": "Research disclosure",
      "failure": "A crafted authorization_endpoint from an untrusted server reaches command execution in versions 0.0.5–0.1.15. Windows shell command execution was demonstrated; macOS/Linux executable invocation had limited parameter control.",
      "fix": "This issue was patched in 0.1.16; that historical version is not a guarantee against later vulnerabilities. Use supported releases and trusted HTTPS servers.",
      "sources": [
        "https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability/"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    },
    {
      "title": "Inspector malicious-redirect XSS: GHSA-g9hg-qhmf-q45m",
      "date": "2025-09-06",
      "kind": "Published maintainer advisory",
      "failure": "A malicious redirect URI from an untrusted remote server triggers XSS that can interact with the Inspector proxy and execute commands. Affects versions below 0.16.6.",
      "fix": "Patched in 0.16.6 for this issue. Upgrade to a supported release and restrict untrusted connections.",
      "sources": [
        "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-g9hg-qhmf-q45m"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    },
    {
      "title": "GitHub issue steers an agent into private-repository disclosure",
      "date": "2025-05-26",
      "kind": "Published research demonstration",
      "failure": "A malicious public issue manipulates an agent with private-repository access into reading and publishing private data. This is an agent trust-boundary failure, not a confirmed flaw in GitHub server code.",
      "fix": "Separate untrusted public content from private-data access, restrict credentials and write destinations, and require explicit approval for sensitive export.",
      "sources": [
        "https://invariantlabs.ai/blog/mcp-github-vulnerability"
      ],
      "confidence": 0.95,
      "last_verified": "2026-10-24"
    }
  ],
  "current_spec": "2026-07-28"
}