MCP servers · least privilege

MCP servers with no destructive tools

3,145 MCP servers declare at least one tool and none of them is classed destructive: nothing deletes, overwrites or runs a command through a declared tool. 1,620 of them only read; the rest may create or edit.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “MCP servers with no destructive tools”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/no-destructive/page/109

Verdicts · 3,145 servers

✓SAFE1,632!CAUTION521✕BLOCK992

Transports

A server can list more than one transport.

3,145 servers

2,593–2,616 of 3,145 · ranked by trust score, then stars

agentigris-agentfund

agentigris/agentfund

✕BLOCK D

Fundraising infrastructure for AI agents on Solana — x402 payments, milestone escrow, on-chain reputation. REST + WebSocket + MCP + ACP.

★ 51 writestdio

MapSmith

mapsmith-ai/MapSmith

✕BLOCK D

Professional-grade GIS geoprocessing over MCP, with a verifiable provenance manifest on every output

★ 26 writestdio

mcp-core

n24q02m/mcp-core

!CAUTION D

Shared foundation for building MCP servers -- Streamable HTTP transport, OAuth 2.1, browser-based credential setup, and a shared embedding daemon.

★ 12 readstreamable-http

claude-grok-build-plugin

xzawed/claude-grok-build-plugin

✕BLOCK D

A Claude Code plugin (MCP-server wrapper) that lets Claude delegate coding tasks to xAI's Grok Build CLI — billed via your xAI subscription, not metered API. 9 MCP tools, /grok:* commands.

★ 19 readstdio

noted

fabriziosalmi/noted

✕BLOCK D

Desktop app for taking notes in Markdown/HTML, with built-in AI, note links (wikilinks), global search, local history, and Git integration

★ 13 readsse

Jentrix open client

jentrix-au/jentrix

✕BLOCK D

Jentrix open client: the CLI and the official Claude Code and Codex plugins

★ 02 readstreamable-http

omneum

cole-h06/omneum

✕BLOCK D

An open-source context evaluator for AI agents.

★ 04 readstdio

open-task-relay-public

lanekingsbery/open-task-relay-public

!CAUTION D

Open-source task commons where AI agents do bounded public-good work, publish evidence, and review results.

★ 02 writestreamable-http

Doris

apache/doris-mcp-server

✕BLOCK D

Apache Doris MCP Server

★ 3481 writestdio

ClaudeR

imnmv/clauder

✕BLOCK D

Connect RStudio to Claude Code, Codex, Gemini, and other LLM agents via MCP. Multi-agent orchestration, automated manuscript auditing, and zero-config setup with uvx

★ 3474 writestdio

AWR

originoneai/awr

✕BLOCK D

Persistent work state and minimal context for long-running AI agents.

★ 1423 writestreamable-http

Transloadit Node.js SDK

transloadit/node-sdk

!CAUTION D

Transloadit's official Node.js SDK

★ 731 readstdio

W&B

wandb/wandb-mcp-server

✕BLOCK D

The official implementation of the W&B Models and Weave MCP server.

★ 704 writestdio

OmniMesh Gateway

omnimesh-labs/omnimesh-gateway

✕BLOCK D

Model Context Protocol (MCP) Gateway & Registry - Central hub for managing tools, resources, and prompts for MCP-compatible LLMs. Translates REST APIs into MCP, builds virtual MCP servers with security and observability, and bridges multiple transports (stdio, SSE, streamable HTTP).

★ 419 readstreamable-http

Puppeteer Real Browser

withlinda/puppeteer-real-browser-mcp-server

✕BLOCK D

Provides AI assistants with powerful, detection-resistant browser automation capabilities built on ZFC Digital's puppeteer-real-browser package.

★ 261 writestdio

@waniwani/sdk

WaniWani-AI/sdk

✕BLOCK D

Build distribution MCPs: multi-step conversational funnels (lead gen, booking, quotes) that run as a single MCP tool in ChatGPT, Claude, and Cursor. A typed state graph compiles to one MCP tool.

★ 181 write

yorishiro-proxy

usk6666/yorishiro-proxy

✕BLOCK D

AI-native MITM proxy — MCP server for traffic interception, recording & replay

★ 171 writestreamable-http

MCPg

devopam/MCPg

!CAUTION D

Postgres MCP Server

★ 131 readstdio

career-compass-mcp

benskamps/career-compass-mcp

✕BLOCK D

Turn Claude into a full job-search partner — Career KB, tailored resumes, application pipeline, interview prep. MCP server + local dashboard; your data never leaves your machine.

★ 63 writestdio

expense

assaf/expense

✕BLOCK D

Forward a receipt to your inbox and it's filed automatically.

★ 62 writestreamable-http

mcp-server

pipeshub-ai/mcp-server

✕BLOCK D

This repository contains the packages that make up Pipeshub’s local MCP server

★ 61 writesse

open-memex

stoneskin/open-memex

✕BLOCK D

Local-first memory layer for AI coding agents — Markdown as source of truth, MCP server + CLI, human-reviewed capture, team knowledge via git PRs.

★ 42 writestdio

orbit-vsx

oaslananka/orbit-vsx

✕BLOCK D

VS Code extension for MCP health, debug-session intelligence, and A2A trust workflows: monitor companion services, inspect Agent Cards, enforce workspace trust, and expose bounded tools to agent mode.

★ 31 read

dibs

Agenxy/dibs

✕BLOCK D

Keeps your agents in the loop about each other. See what the fleet is doing, then message, sync and send files between agents. Dibs reports; it never acts.

★ 221 readstreamable-http

Other risk hubs

By job

Questions

What counts as destructive?
A tool that deletes, overwrites or runs commands. We class every tool the source declares as read, write or destructive; a server is listed here when it has tools and none is destructive.
How is this different from read-only?
Read-only servers have only read tools (1,620 servers). This list also includes servers whose tools write: 1,525 of the 3,145 do.
Does no destructive tools mean safe?
No. 1,632 are SAFE, 521 CAUTION and 992 BLOCK on this list. The verdict comes from the audit of the source, not from the tool list alone.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.