MCP servers · least privilege
MCP servers with no destructive tools
3,145 MCP servers declare at least one tool and none of them is classed destructive: nothing deletes, overwrites or runs a command through a declared tool. 1,620 of them only read; the rest may create or edit.
Cite
Cite this page
ModelsAtlas. “MCP servers with no destructive tools”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/no-destructive/page/120
Verdicts · 3,145 servers
Transports
- stdio, runs locally2,191
- Streamable HTTP, remote1,060
- SSE, legacy remote253
- Not declared563
A server can list more than one transport.
3,145 servers
2,857–2,880 of 3,145 · ranked by trust score, then stars
mcp-hangar
mcp-hangar/mcp-hangar
MCP policy enforcement plane — deterministic policy on every Model Context Protocol call: identity, RFC 8707 audience binding, tool schema digest pinning, full audit trail. Python, self-hosted, MIT.
memory-os-cli
yonro/memory-os-cli
XMemo: user-owned Memory OS for AI agents. Public client (@xmemo/client), MCP distribution, Skills and plugins.
fluxmail
churichard/fluxmail
Self-hosted email CLI / API / MCP server for AI agents and apps
Vx
vznjs/vx
orcid-mcp-server
cyanheads/orcid-mcp-server
Search and retrieve researcher profiles, works, affiliations, funding, and peer review records from the ORCID registry via MCP. STDIO or Streamable HTTP.
prax
lodsb/prax
A self-hosted library for the papers and web pages one person reads: hybrid search, a graph whose links cite their sentence, and an MCP interface for agents
board-planner
rafalpodles/board-planner
One board. Your team works it. So do your agents. Kanban, sprints, REST API and MCP server — self-hosted, AGPL, with a PM agent and execution workers that run your tasks under your gates.
PrepDeck
YIzhongyue/PrepDeck
A self-hosted exam prep platform with practice questions, mock exams, AI-powered explanations, and personalized progress tracking, built on Cloudflare.
teardrop
teardrop-ai/teardrop
An A2A-first marketplace for autonomous economic agents: discover specialists, delegate tasks, and settle per-request blockchain payments over federated MCP tools and streaming AG-UI.
Trail-Code
trailhq/Trail-Code
Turbocharge Claude Code, Cursor, Codex, Gemini & every coding agent: faster, cheaper, with contextual understanding specific to your codebase.
Fonoster
fonoster/fonoster
🚀 The open-source alternative to Twilio.
MARM
lyellr88/marm-systems
Local-first 3-in-1 AI memory layer & MCP server for Claude Code, Codex, Grok, Gemini, VS Code and Cursor. Fuses session history, codebase indexing & concept graphs in SQLite. Enables zero-cloud, privacy-first context & instant recall, supports multi-agent swarms.
Reasoner
jacck/mcp-reasoner
A systematic reasoning MCP server implementation for Claude Desktop with beam search and thought evaluation.
SuperLocalMemory
qualixar/superlocalmemory
Open-source governed, local-first memory control plane for AI agents and teams. arXiv:2608.08253
sunpeak
Alignbase/sunpeak
Server-agnostic MCP testing framework and full-stack MCP App framework for ChatGPT Apps, Claude Connectors, and more.
MATLAB
williamcloudqi/matlab-mcp-server
The MATLAB MCP server provides AI users with powerful scientific computing and data analysis capabilities. It allows users to execute MATLAB code directly in conversations, generate MATLAB scripts from natural language descriptions, and access MATLAB documentation.
GitLab
jmrplens/gitlab-mcp-server
Open source GitLab MCP server for AI assistants: 2-tool dynamic find/execute over 850+ GitLab actions (1,000+ Enterprise), stdio/HTTP/OAuth, safe/read-only modes.
Splunk AI Connector
deslicer/mcp-for-splunk
MCP Server for integrating with Splunk Enterprise
Codesteward
codesteward/codesteward
Agentic code review with structural graph intelligence — PR gate + branch stewardship. Self-hosted. Apache-2.0.
neo-agent-brain
neomjs/neo-agent-brain
Point a cross-model AI engineering team at your own codebases. The Agent OS keeps named AI maintainers' identity, memory and review across labs alive between sessions — the Brain Neo.mjs runs on itself. Multi-tenant: onboarding a codebase is a config entry, not a fork.
RepoTunnel
Yashwanth034/RepoTunnel
RepoTunnel is a secure local AI workspace bridge that connects ChatGPT Web and MCP-compatible AI clients to approved local projects, files, terminals, Git, GitHub, browsers, editors, and desktop applications—so AI can inspect, edit, test, run, and manage real development work without constant copy-p
mantle
aotter/mantle
AotterMantle SDK: agent-native CMS runtime, manifests, admin UI, and Cloudflare adapter.
harborclerk
r0shi/harborclerk
An MCP server that lets AI agents query your document archive instead of uploading it — with OCR, hybrid search, and cited local-AI answers in a private, Mac-native app.
Align CLI
aligndottech/align-cli
Align CLI - capture decisions, check alignment, and query your decision graph from the terminal
Other risk hubs
By job
Questions
What counts as destructive?
How is this different from read-only?
Does no destructive tools mean safe?
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What counts as destructive?
- How is this different from read-only?
- Does no destructive tools mean safe?