Browse the directory

Memesio MCP Server is a hosted MCP endpoint for meme template discovery, captioned meme creation, share links, and AI-assisted meme generation. Public tools support anonymous/rate-limited usage, while optional developer or agent keys unlock higher-rate, premium, and AI-powered actions.

Spain Legal by Legal Fournier is a public, read-only MCP server for Spain legal route screening. It helps AI assistants explore visa options, Beckham Law eligibility, NIE/TIE steps, residency/nationality paths, EU family routes, and when to prepare a human Legal Fournier handoff.

MCP server for e-mail testing: create disposable inboxes, wait for delivery, and extract e-mail content or links - all from your AI agent or test automation workflow. Get a free API key on https://app.zyntra.app/

Source-backed rules for reviewing AI-generated endpoints and data-access code before merge for insecure direct object reference risk, covering per-request object-level authorization checks, scoped database lookups, identifier exposure, and consistent enforcement across read, write, and admin operations.

Source-backed rules for reviewing AI-generated code that deserializes data before merge for insecure deserialization risk, covering native serialization formats (pickle, PyYAML, Java Serializable) that can execute arbitrary code on untrusted input, safe data-interchange alternatives, and class allowlisting/integrity checks when native formats can't be avoided.

Source-backed rules for reviewing AI-generated code that binds request parameters to model/entity objects before merge for mass assignment risk, covering allowlist field binding, DTOs that exclude sensitive fields, and the framework-specific autobinding features that make this easy to introduce by default.

Source-backed rules for reviewing AI-generated redirect and forward logic before merge for open redirect risk, covering allowlist-based destination validation, relative-path/indexed-mapping alternatives to raw URLs, and the privilege-escalation and phishing impact of an unvalidated redirect target.

Source-backed rules for reviewing AI-generated code that builds or runs operating-system commands, shell invocations, or subprocesses before merge for command injection and argument injection risk, covering library alternatives to shelling out, array-form process APIs, allowlist input validation, and least-privilege execution.

Source-backed rules for reviewing AI-generated JavaScript/TypeScript code before merge for prototype pollution risk, covering unsafe recursive merge/clone/assign helpers on untrusted input, proto and constructor-prototype key handling, and safer alternatives like Map, Set, and Object.create(null).

Source-backed rules for reviewing AI-generated code that renders untrusted data into HTML, JavaScript, URLs, or CSS before merge for cross-site scripting risk, covering context-correct output encoding, dangerous DOM sinks, HTML sanitization, and Content-Security-Policy as defense in depth.

Remote MCP server over US SEC EDGAR filings — parsed 8-K (with body-text detection of suspected misclassifications under Item 8.01), Schedule 13D/G with activist filer tagging, and S-3 / 424B5 ATM-offering detection.

Source-backed rules for reviewing AI-generated request handlers and forms before merge for cross-site request forgery risk, covering state-changing method discipline, anti-CSRF token correctness, SameSite cookie posture, origin and referer checks, and safe handling of cookie-based sessions.

Hosted streamable-HTTP MCP server registered as ai.auteng/docs that publishes markdown documents as public AutEng share links with Mermaid diagram and KaTeX math rendering support.

Decision-assurance layer for AI agents: returns calibrated Decision Assets and an auditable action boundary (approve / review / block / seek-evidence) plus a verifiable Decision Receipt before high-stakes actions. Advisory only — never transacts or modifies identity. MCP tools: health_check and bench_query.

Source-backed rules for reviewing AI-generated file-handling code for path traversal before merge, covering canonical path validation, safe root confinement, upload filename sanitization, archive extraction limits, and privacy-safe test evidence.

Source-backed rules for reviewing AI-generated regular expressions before merge, covering catastrophic backtracking and ReDoS risk, input bounds, anchor and escaping correctness, validation versus parsing, safe engines, and privacy-safe test evidence.

Source-backed rules for reviewing AI-generated database access code for SQL injection before merge, covering parameterized queries, identifier handling, ORM safety, dynamic query construction, least-privilege access, and privacy-safe test evidence.

Source-backed rules for reviewing AI-generated code that makes server-side URL or network requests for server-side request forgery before merge, covering URL allow-lists, block-lists for internal networks, redirect handling, response isolation, and privacy-safe test evidence.

Source-backed rules for reviewing event-sourcing implementation changes, covering immutable event design, event schema evolution without breaking projections, idempotent event handlers, snapshot and replay correctness, and consistent event-store access patterns.

Source-backed rules for reviewing feature flag changes across their full lifecycle, covering flag creation, naming, default values, kill switches, targeting, rollout safety, cleanup of stale flags, and privacy-safe configuration evidence.

Source-backed rules for reviewing application logging changes, covering structured machine-readable events, consistent levels, correlation and trace context, actionable messages, log volume and cost, and keeping secrets and personal data out of logs.

Source-backed rules for reviewing test code for test-double misuse, covering over-mocking that decouples tests from real behavior, under-mocking that creates slow or flaky tests, mock-return-value drift, missing contract tests for faked dependencies, and keeping test data free of personal information.

Source-backed rules for reviewing code that calls third-party or remote APIs, covering timeouts, bounded retries with backoff and jitter, idempotency, circuit breaking, rate-limit handling, graceful degradation, and privacy-safe failure logging.

Remote Agentage Memory MCP server giving Claude one shared, portable memory across every AI you use - search, read, write, edit, list, and delete plain Markdown notes you own, over Streamable HTTP with OAuth 2.1.

Manage your Brex corporate card and banking account from Claude — expenses, cards, transactions, users, bills, vendors, travel bookings, and spend analytics — with the official Brex remote MCP server.

Manage Customer.io from Claude — create segments, inspect customer profiles, send broadcasts and campaigns, work with journeys, and access the full Journeys UI and CDP Data Pipelines APIs — with the official Customer.io remote MCP server.

Manage your Descope identity project from Claude — search users, configure auth flows, inspect audit logs, manage tenants, and search Descope documentation — with the official Descope remote MCP server hosted at mcp.descope.com.

Connect Claude to Honeycomb observability data — query traces and events, investigate alerts, manage boards and triggers, create SLOs, and cross-reference production behavior with your codebase — with the official Honeycomb hosted MCP server.

Connect Claude Code, Cursor, Copilot, Windsurf, and other MCP clients to the public Langfuse documentation MCP server for tracing, prompt management, evaluation, and agent observability implementation help.

Connect Claude Code, Cursor, Codex, VS Code, Gemini CLI, Copilot CLI, and other MCP clients to LiveKit's free documentation MCP server for current realtime voice AI, WebRTC, SDK, CLI, and agent implementation context.