MCP servers · least privilege

MCP servers with no destructive tools

3,145 MCP servers declare at least one tool and none of them is classed destructive: nothing deletes, overwrites or runs a command through a declared tool. 1,620 of them only read; the rest may create or edit.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “MCP servers with no destructive tools”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/no-destructive/page/105

Verdicts · 3,145 servers

✓SAFE1,632!CAUTION521✕BLOCK992

Transports

A server can list more than one transport.

3,145 servers

2,497–2,520 of 3,145 · ranked by trust score, then stars

verifiable-science-envs

jasonbrelsford/verifiable-science-envs

✕BLOCK D

Verifiable-reward RL environments and evals for scientific domains, starting with HLA/immunogenetics

★ 03 writestreamable-http

vikunja-mcp

SkyliveLLC/vikunja-mcp

✕BLOCK D

MCP server for Vikunja. Lets Claude Code, Codex and Claude Desktop read and update your tasks, with a one-command setup CLI.

★ 04 write

vision-relay

nan1010082085/claude-plugins

✕BLOCK D

跨环境 AI CLI 插件统一仓库 - Claude Code / Codex CLI / Cursor 等插件集合

★ 01 read

voicelayer

EtanHey/voicelayer

✕BLOCK D

Voice I/O MCP for AI coding agents — local TTS + STT, 2 tools (`voice_speak`, `voice_ask`) with ToolAnnotations

★ 02 readstdio

wiki-formant

tutmoses/wiki-formant

✕BLOCK D

The portable half of a wiki: derived taxonomy, a spec-correct MCP transport, markdown twins, and conditional-GET plumbing. Zero runtime dependencies.

★ 02 writestreamable-http

Context7

upstash/context7-mcp

!CAUTION D

Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

★ 62,5103 readstdio

Context7

upstash/context7

!CAUTION D

Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

★ 62,1903 readstdio

Antigravity Link

cafetechne/antigravity-link-extension

✕BLOCK D

Mobile companion for Google's Antigravity IDE. Mirror AI sessions on your phone, send messages, stop generation, automate via 9 MCP tools or OpenAPI.

★ 2202 writestdio

Blatant Why

001tmf/blatant-why

✕BLOCK D

AI-powered biologics design campaign agent — multi-agent orchestration with BoltzGen, PXDesign, Protenix, and 200+ cloud tools. Antibodies, nanobodies, de novo binders, and beyond.

★ 11719 write

Media Crawler

mcp-service/media-crawler-mcp-service

✕BLOCK D

一个功能强大的多平台自媒体数据采集MCP工具,支持B站、小红书、抖音、快手、抖音微博、贴吧、知乎等主流平台的公开信息抓取。

★ 773 read

godot-agent

aigengame/godot-agent

!CAUTION D

Godot automation for AI agents to build and verify projects through a CLI, Agent Skill, or MCP server, with structured results, headless operations, and live runtime control.

★ 461 readstdio

mcp-postgres-server

antonorlov/mcp-postgres-server

✕BLOCK D

MCP server for PostgreSQL. Works with VS Code, Cursor, Claude Code, Codex, and Windsurf.

★ 231 writestdio

relay

valtors/relay

✕BLOCK D

MCP server with 40 tools for AI agents. Memory, web fetch, search, file ops, screenshots, and multi-agent coordination in one Go binary.

★ 128 writestdio

nlp2sql

luiscarbonel1991/nlp2sql

✕BLOCK D

Enterprise-ready Natural Language to SQL converter with multi-provider AI support (OpenAI, Anthropic, Gemini). Built for production scale databases (1000+ tables) with Clean Architecture.

★ 81 write

robinhood-toolkit

nirholas/robinhood-toolkit

!CAUTION D

Build on Robinhood Chain and Robinhood Crypto: verified network constants, a chain SDK, a read-only MCP server, runnable examples, and 64 build prompts.

★ 78 writestdio

agent_gateway

creverse-ai-lab/agent_gateway

✕BLOCK D

Let the coding agent you already use delegate work to Claude Code, Codex, and Grok on demand — a local MCP server and Agent Client Protocol (ACP) gateway with persistent sessions, interactive approvals, and crash-safe recovery. No predefined workflows.

★ 33 writestdio

Armature MCP Analytics for TypeScript

armature-tech/mcp-analytics

!CAUTION D

V0 architecture plan for MCP analytics SDK

★ 11 writestdio

rustyhand

Tamang4607/rustyhand

✕BLOCK D

Build an open-source Rust agent OS for autonomous Telegram agents, with one binary, APIs, and a tested Rust codebase

★ 17 read

Lex

Guffawaffle/lex

✕BLOCK D

Policy-aware work continuity with receipts.

★ 02 writestdio

Lex

SmarterGPT/lex

✕BLOCK D

Policy-aware work continuity with receipts.

★ 02 writestdio

LetsFG

letsfg/letsfg

✕BLOCK D

Agent-native flight & hotel search and booking — MCP server, CLI, and Python/JS SDKs. Every airline in the world, major booking sites and OTAs, with per-flight reliability history.

★ 2,11014 readstdio

LLM Sandbox

vndee/llm-sandbox

✕BLOCK D

Lightweight and portable LLM sandbox runtime (code interpreter) Python library.

★ 1,1261 writestdio

Elementor

msrbuilds/elementor-mcp

✕BLOCK D

WordPress plugin that turns Elementor & WordPress into an MCP server. 500+ AI-ready tools for building, editing, and managing page designs programmatically.

★ 7262 readstreamable-http

Flow Nexus

ruvnet/flow-nexus

✕BLOCK D

Flow Nexus is the first competitive agentic platform built entirely on MCP. Deploy autonomous AI swarms, train neural networks, and compete in coding challenges while earning rUv credits. Transform agentic engineering mastery into lived experience through gamified cloud development where agents sp

★ 1053 read

Other risk hubs

By job

Questions

What counts as destructive?
A tool that deletes, overwrites or runs commands. We class every tool the source declares as read, write or destructive; a server is listed here when it has tools and none is destructive.
How is this different from read-only?
Read-only servers have only read tools (1,620 servers). This list also includes servers whose tools write: 1,525 of the 3,145 do.
Does no destructive tools mean safe?
No. 1,632 are SAFE, 521 CAUTION and 992 BLOCK on this list. The verdict comes from the audit of the source, not from the tool list alone.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.