Grype Vulnerability Scanner MCP MCP Server Pricing 2026

Tools to read, search, and manipulate Git repositories. Full Git operations support.

authenticated access to the whole GitHub platform — repositories, files, branches, issues, pull requests, Actions runs, security alerts, discussions and notifications — from Claude, Cursor, VS Code, Copilot CLI and any other MCP host. There is no npm package for this server, and that trips up most people who try to install it: `@github/mcp-server` is not published to the npm registry, so any `npx` line you find for it will fail. GitHub ships it three other ways. The easiest is the hosted remote server at https://api.githubcopilot.com/mcp/, which needs no install at all — point an HTTP-transport MCP client at that URL and log in with OAuth (VS Code 1.101+, Claude Desktop, Claude Code, Cursor and Windsurf all support this). The second is the official Docker image ghcr.io/github/github-mcp-server, which is what the copy-paste command on this page runs; on github.com it now performs a browser-based OAuth login on first use and keeps the token in memory only, which is why the published Docker configs map a fixed loopback callback port (-p 127.0.0.1:8085:8085 with GITHUB_OAUTH_CALLBACK_PORT=8085) so the container can receive the callback. Prefer a token? Set GITHUB_PERSONAL_ACCESS_TOKEN instead — it takes precedence over OAuth, and the minimum useful scopes are repo, read:org and read:packages. The third is the native Go binary from the repository's releases, which needs no fixed port for the OAuth flow. GitHub Enterprise Server has no hosted option: use the local server with --gh-host or GITHUB_HOST set to your instance (include the https:// scheme — it defaults to http://, which GHES rejects). Toolsets can be narrowed with GITHUB_TOOLSETS, and an insiders channel is available at /mcp/insiders or via the X-MCP-Insiders header.

a first-party MCP endpoint built into the GitLab instance itself — there is no package to install, because the server ships inside GitLab and answers at https://<your-gitlab>/api/v4/mcp (gitlab.com exposes the same path, so https://gitlab.com/api/v4/mcp works for SaaS projects). It landed as an experiment in GitLab 18.3 and moved to beta in 18.6. Authentication is the part that makes it different from every community GitLab server: it uses OAuth 2.0 Dynamic Client Registration, so the first time a client connects it registers itself as an OAuth application on your instance and is issued an access token — no personal access token pasted into a config file. Administrators who do not want one OAuth application per tool can pre-create a shared application instead. Three prerequisites are what actually block most first connections: GitLab Duo must be set to Always on or On by default, beta and experimental features must be enabled, and MCP access must be switched on at the group or instance level. The tool surface covers issues and merge requests (create_issue, get_issue, create_merge_request, get_merge_request, list_merge_requests, get_merge_request_commits, get_merge_request_diffs, get_merge_request_pipelines, create_merge_request_note, get_merge_request_notes), CI/CD (manage_pipeline for list/create/delete/retry/cancel, get_pipeline_jobs, get_job_log), work items (create_workitem_note, get_workitem_notes, link_work_items, get_saved_view_work_items), search (search across the instance, search_labels, semantic_code_search), list_wiki_pages, and attach_scan_profile. HTTP is the recommended transport — claude mcp add --transport http GitLab https://gitlab.com/api/v4/mcp — and clients that only speak stdio can wrap it with npx mcp-remote <url> on Node 20+. Send the X-Gitlab-Mcp-Server-Tool-Name-Prefix header if generic names like search collide with another connected server. If your instance predates 18.3 or Duo is not available to you, the community alternative most teams land on is zereight/gitlab-mcp (1,889 stars as of 2026-08-16, npm @zereight/mcp-gitlab), which authenticates with a plain personal access token and ships 217 tools — including merge_merge_request, approve_merge_request, execute_graphql and full CI/CD variable management, none of which the built-in server exposes — behind GITLAB_PERMISSION_MODE=readonly/modify and GITLAB_TOOLSETS/GITLAB_TOOLS filtering. One further change worth noting: MCP server access moved from GitLab Premium to GitLab Free in 19.2 and became a setting of its own.

AWS Labs maintains a monorepo of specialized, open-source MCP servers that bring AWS best practices directly into AI-assisted development workflows, spanning infrastructure, data, AI/ML, cost management, and healthcare/life-sciences domains. Rather than one monolithic server, the project ships dozens of focused servers you install individually depending on the task: the AWS Documentation MCP Server for real-time official docs and API references, dedicated servers for Terraform/CDK/CloudFormation infrastructure-as-code, container and serverless platforms (ECS, EKS, Lambda), SQL/NoSQL databases (DynamoDB, RDS, Aurora), search and analytics (OpenSearch), messaging (SQS/SNS), and cost/billing analysis. Most servers install via uvx with a package name like awslabs.aws-documentation-mcp-server, run locally over stdio, and use standard AWS credential chains (IAM roles, profiles, or access keys) rather than exposing raw account credentials to the model. AWS also now offers a managed, remote "AWS MCP Server" (in preview) that combines full API coverage with pre-built agent SOPs, syntactically validated API calls, and complete CloudTrail audit logging for teams that want centralized governance instead of running servers locally. The Getting Started with Kiro/Cursor/VS Code/Claude Code sections in the repo provide one-click install configs for each server, making it straightforward to wire up only the AWS services a given project actually touches.

Cloudflare ships two different things under this name. The mcp-server-cloudflare repo provides 16 remote, domain-specific MCP servers rather than one monolith — Documentation, Workers Bindings (storage/AI/compute primitives), Workers Builds, Observability (logs/analytics), Container sandboxes, Browser Rendering (fetch pages, convert to markdown, screenshots), Logpush health, AI Gateway (prompt/response search), AI Search, Audit Logs, DNS Analytics, Digital Experience Monitoring, Cloudflare One CASB, Radar, GraphQL analytics and the Agents SDK docs server, each on its own `*.mcp.cloudflare.com/mcp` hostname. Separately, the Cloudflare API MCP server at mcp.cloudflare.com/mcp (repo: cloudflare/mcp) exposes the whole 2,500+ endpoint Cloudflare API through just two tools, `search` and `execute`, using the Code Mode pattern — model-written JavaScript runs in an isolated Dynamic Worker, costing ~1,000 tokens of context against the ~1.17M an equivalent native-tool server would need. Pick a domain server when you want a readable, curated tool list for one product area; pick the API server for breadth or for endpoints nobody wrote a tool for. All endpoints are Streamable HTTP on `/mcp` and support the MCP 2026-07-28 spec; the historical `/sse` URLs remain as aliases for the same Streamable HTTP handler but no longer serve the deprecated HTTP+SSE transport, so clients pinned to SSE must switch. Auth is OAuth on connect, or a scoped Cloudflare API token as a bearer header for CI. Clients without native remote-MCP support bridge via `npx mcp-remote https://<subdomain>.mcp.cloudflare.com/mcp`.

The Vercel MCP server is a powerful Model Context Protocol integration that allows AI assistants like Claude, Cursor, and Cline to interact directly with your Vercel infrastructure. It exposes essential platform capabilities as AI-callable tools, meaning you can manage projects, trigger deployments, inspect build logs, and configure custom domains via natural language prompts. For frontend developers and DevOps teams working within the Vercel ecosystem, this eliminates the need to constantly context-switch between an IDE, terminal, and the Vercel dashboard. You can simply ask your AI agent to "check the status of the latest production deployment", "fetch the build logs for the staging environment and identify the Next.js hydration error", or "list all environment variables for the current project". By bridging the gap between your codebase and your hosting platform, the Vercel MCP server turns your AI assistant into an embedded DevOps engineer capable of diagnosing build failures and managing serverless deployments in real time. Vercel ships this as an official hosted (remote) MCP server at https://mcp.vercel.com — there is no package to install locally. Connect an MCP client to that URL and authenticate through the browser-based OAuth flow, which scopes access to the Vercel teams and projects your account can already reach rather than a long-lived Personal Access Token. For example, add it to Claude Code with `claude mcp add --transport http vercel https://mcp.vercel.com`, then complete the OAuth consent screen; the repo vercel/vercel-mcp-overview is the official public overview of this server, with full docs at vercel.com/docs/mcp/vercel-mcp.