MCP servers · least privilege

MCP servers with no destructive tools

3,145 MCP servers declare at least one tool and none of them is classed destructive: nothing deletes, overwrites or runs a command through a declared tool. 1,620 of them only read; the rest may create or edit.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “MCP servers with no destructive tools”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/no-destructive/page/115

Verdicts · 3,145 servers

✓SAFE1,632!CAUTION521✕BLOCK992

Transports

A server can list more than one transport.

3,145 servers

2,737–2,760 of 3,145 · ranked by trust score, then stars

Sudocode

sudocode-ai/sudocode

✕BLOCK F

Lightweight agent orchestration dev tool that lives in your repo

★ 2933 writestdio

dsh-config-manager

xiajiajun516/dsh-config-manager

✕BLOCK F

DeepSeek Harness (DSH) backup & restore plugin — export, import, migrate and sync your complete DSH configuration, plugins, MCP servers, skills and workspace. One-click migration to another machine.

★ 1842 writestreamable-http

Ultimate

dicklesworthstone/ultimate_mcp_server

✕BLOCK F

Comprehensive MCP server exposing dozens of capabilities to AI agents: multi-provider LLM delegation, browser automation, document processing, vector ops, and cognitive memory systems

★ 1611 writesse

Nitan

nitansde/nitan-mcp

✕BLOCK F

MCP client and Skill for US Card Forum

★ 1231 writestdio

Codebase

anrgct/autodev-codebase

✕BLOCK F

A vector embedding-based code semantic search tool with MCP server and multi-model integration. Can be used as a pure CLI tool. Supports Ollama for fully local embedding and reranking, enabling complete offline operation and privacy protection for your code repository

★ 1221 writesse

Search Scrape

devshero/search-scrape

✕BLOCK F

A unified web extraction and stateful automation engine for AI. Replaces heavy testing frameworks with token-optimized browser control, deep research, and HITL.

★ 707 read

Curion

geanatz/curion

!CAUTION F

Curion is a project-local memory layer for AI coding agents, published as an MCP server for Claude Code, Codex, OpenCode, and other MCP clients.

★ 3311 readstdio

Roku Dev Studio

paramount-engineering/roku-dev-studio

✕BLOCK F

Cross-platform Electron desktop studio for Roku developers: remote control, device queries, sideload, telnet console, RALE/App Connector, BrightScript Fiddle, JSON Action Scripts, an `rds` CLI, an MCP server for AI agents, and an internet relay.

★ 321 write

footprintjs

footprintjs/footPrint

✕BLOCK F

The flowchart pattern for backend code — self-explainable systems that AI can reason about. Causal traces, auto-generated tool descriptions, transactional state.

★ 2015 read

repopilot

azen07508-debug/repopilot

✕BLOCK F

Release gate for public GitHub repositories. Give it a repo URL and it returns a ship-or-block verdict with file-and-line evidence, the fixes that clear the gate, and the deployment plan and launch copy you ship with. HTTP + MCP. Static analysis only; no code execution.

★ 31 writestdio

triumvirate

michaeljboscia/triumvirate

!CAUTION F

Five AI agents. One coordination layer. No relay server. Plus a trust layer that checks whether the review actually happened.

★ 116 readstreamable-http

tool-control-plane

Abhishek-chohan/tool-control-plane

✕BLOCK F

The unglamorous half of agent tooling: a gRPC control plane for sessions, machines, fenced writes, and capability-scoped keys. HTTP and MCP gateways; Python, TypeScript, and Go SDKs.

★ 07 readstdio

ThinkWatch

thinkwatchproject/thinkwatch

✕BLOCK F

Enterprise AI bastion host for secure AI API and MCP access, with unified proxying, RBAC, audit logs, rate limiting, and cost tracking across OpenAI, Anthropic, Gemini, and self-hosted LLMs.

★ 8142 readstreamable-http

Context

neuledge/context

✕BLOCK F

Local-first documentation for AI agents

★ 4173 readstdio

ue-mcp

db-lyon/ue-mcp

✕BLOCK F

Complete Unreal Engine development toolkit exposed as MCP tools.

★ 4074 readstdio

Task Orchestrator

jpicklyk/task-orchestrator

✕BLOCK F

Server-enforced workflow discipline for AI agents. An MCP server providing persistent work items, dependency graphs, quality gates, and actor attribution. Schemas define what agents must produce — the server blocks the call if they don't. Works with any MCP-compatible client.

★ 2076 readstdio

Context Sync

intina47/context-sync

✕BLOCK F

Local persistent memory store for LLM applications including continue.dev, cursor, claude desktop, github copilot, codex, antigravity, etc.

★ 1903 writestdio

Context Lattice

sheawinkler/contextlattice

✕BLOCK F

The local-first intelligence layer that gives AI agents durable continuity, explainable retrieval, portable context, and verified learning across harnesses.

★ 1531 readstreamable-http

Linear Streamable

iceener/linear-streamable-mcp-server

✕BLOCK F

MCP Server for interacting with Linear API. Written in TypeScript, Node and Hono.dev

★ 711 readstreamable-http

Netlify Examples

netlify/examples

✕BLOCK F

A collection of examples and demonstrations to help people building the web with Netlify

★ 671 writestreamable-http

Globalping

jsdelivr/globalping-mcp-server

✕BLOCK F

Remote MCP server that gives LLMs access to run network commands

★ 6411 readsse

Talkito

robdmac/talkito

✕BLOCK F

TalkiTo lets developers interact with AI systems through speech across multiple channels (terminal, API, phone). It can be used as both a command-line tool and a Python library.

★ 5415 writesse

fury-antidetect-browser

furyteamtop/fury-antidetect-browser

✕BLOCK F

Free, open-source anti-detect browser. A Chromium 155 fork that spoofs the fingerprint in C++ rather than with injected JavaScript, with per-profile personas and proxies, a built-in MCP server for AI assistants, and a self-hostable team server with per-project access. No seats, no per-profile pricin

★ 536 write

Dense-Mem

markhuangai/dense-mem

!CAUTION F

Self-hosted AI agent memory server with MCP, evidence provenance, typed claims, conflict detection, embeddings, recall, PostgreSQL, and pgvector

★ 396 readstreamable-http

Other risk hubs

By job

Questions

What counts as destructive?
A tool that deletes, overwrites or runs commands. We class every tool the source declares as read, write or destructive; a server is listed here when it has tools and none is destructive.
How is this different from read-only?
Read-only servers have only read tools (1,620 servers). This list also includes servers whose tools write: 1,525 of the 3,145 do.
Does no destructive tools mean safe?
No. 1,632 are SAFE, 521 CAUTION and 992 BLOCK on this list. The verdict comes from the audit of the source, not from the tool list alone.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.