What the Model Context Protocol is, how to install a server, whether they are safe, and how MCPpedia scores them.
An MCP server is a small program that exposes tools, data and prompts to an AI assistant over the Model Context Protocol, an open standard introduced by Anthropic in November 2024. The assistant stays the same; the server is what lets it read your database, search your files, open a browser or call an API. A client like Claude Desktop, Claude Code, Cursor or Windsurf connects to one or more servers and offers their tools to the model.
An MCP server gives a model new capabilities — tools it can call over a protocol, running as a separate process you control. A skill gives a model instructions and context for a task it can already do. They compose: a skill can tell the model how to use the tools an MCP server provides. MCP is also client-agnostic, so the same server works in Claude, Cursor and Windsurf, whereas plugin formats are usually tied to one product.
Every MCP client reads a JSON config listing the servers it should start. The JSON is the same across clients — only the file path differs. Add an entry naming the command to run (usually npx or uvx plus the package) or the URL of a remote server, restart the client, and the tools appear. Every server page on MCPpedia carries a copy-paste config block for Claude Desktop, Claude Code, Cursor and Windsurf, plus any environment variables that server needs.
Not automatically. An MCP server runs as a normal process on your machine with your permissions, and its tool descriptions are read by the model as instructions — which is the mechanism behind tool poisoning, where a malicious description tells the model to do something you did not ask for. Before installing, check who publishes it, whether it has open CVEs, whether it authenticates, and what its tools actually claim to do. MCPpedia scans for all four and shows the evidence on each server page.
Every server gets a 0-100 score from five weighted inputs: security (CVE scanning, tool-poisoning detection, and whether the server authenticates), maintenance (commit recency, release cadence, download trend), documentation (setup instructions, examples, tool schema coverage), client compatibility, and token efficiency — how much of your context window the tool definitions consume before you have asked anything. Scores are recomputed daily by bots, never edited by hand, and every input is shown on the server page so you can disagree with the weighting and still use the evidence.
Usually because there is nothing to score. A large share of the catalog is registry entries: a package name, no description, no published tool schema, no commits in the last year. A low score is not an accusation, it is a statement that we could not find evidence of the things that make a server safe to install. Servers with open CVEs or detected tool-poisoning patterns score badly for the opposite reason — we did find evidence.
A tool's description is passed to the model as text it trusts. Tool poisoning is hiding instructions in that description — telling the model to exfiltrate a file, ignore a safety rule, or call another tool with attacker-chosen arguments. The user never sees it, because clients show the tool name, not the full schema. MCPpedia parses every published tool schema and flags descriptions containing instruction-like patterns.
MCPpedia currently tracks 30,000+ MCP servers discovered from the official MCP Registry, GitHub, npm and PyPI. That is the published population, not the usable one — a much smaller number have a description, a published tool schema and recent commits. The catalog is refreshed daily.
Start from what you actually want the model to reach: a database, your filesystem, GitHub, a search API. Prefer servers published by the vendor behind the underlying service over third-party wrappers — they track upstream changes. MCPpedia ranks the top ten in each category, and each category hub explains what separates the leaders from the rest.
Free, no account, no paywall, no login wall. Data comes from the official MCP Registry, the GitHub API, npm and PyPI, plus community submissions and edits — all refreshed by scheduled bots. Scores are computed from that data by open, documented rules. Anyone can propose an edit to a server page, and the full catalog is available through a public API and an MCP server.
Still looking? Read the scoring methodology, the getting started guide, the security advisories, or browse the best servers in each of the 22 categories.
You can also query this catalog from inside your agent with the MCPpedia MCP server.