MCP servers · least privilege

MCP servers with no destructive tools

3,145 MCP servers declare at least one tool and none of them is classed destructive: nothing deletes, overwrites or runs a command through a declared tool. 1,620 of them only read; the rest may create or edit.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “MCP servers with no destructive tools”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/no-destructive/page/120

Verdicts · 3,145 servers

✓SAFE1,632!CAUTION521✕BLOCK992

Transports

A server can list more than one transport.

3,145 servers

2,857–2,880 of 3,145 · ranked by trust score, then stars

mcp-hangar

mcp-hangar/mcp-hangar

✕BLOCK F

MCP policy enforcement plane — deterministic policy on every Model Context Protocol call: identity, RFC 8707 audience binding, tool schema digest pinning, full audit trail. Python, self-hosted, MIT.

★ 181 writestdio

memory-os-cli

yonro/memory-os-cli

✕BLOCK F

XMemo: user-owned Memory OS for AI agents. Public client (@xmemo/client), MCP distribution, Skills and plugins.

★ 121 writestdio

fluxmail

churichard/fluxmail

✕BLOCK F

Self-hosted email CLI / API / MCP server for AI agents and apps

★ 71 readstdio

Vx

vznjs/vx

✕BLOCK F
★ 65 writestdio

orcid-mcp-server

cyanheads/orcid-mcp-server

✕BLOCK F

Search and retrieve researcher profiles, works, affiliations, funding, and peer review records from the ORCID registry via MCP. STDIO or Streamable HTTP.

★ 51 readstdio

prax

lodsb/prax

✕BLOCK F

A self-hosted library for the papers and web pages one person reads: hybrid search, a graph whose links cite their sentence, and an MCP interface for agents

★ 39 write

board-planner

rafalpodles/board-planner

✕BLOCK F

One board. Your team works it. So do your agents. Kanban, sprints, REST API and MCP server — self-hosted, AGPL, with a PM agent and execution workers that run your tasks under your gates.

★ 19 write

PrepDeck

YIzhongyue/PrepDeck

✕BLOCK F

A self-hosted exam prep platform with practice questions, mock exams, AI-powered explanations, and personalized progress tracking, built on Cloudflare.

★ 01 readstreamable-http

teardrop

teardrop-ai/teardrop

!CAUTION F

An A2A-first marketplace for autonomous economic agents: discover specialists, delegate tasks, and settle per-request blockchain payments over federated MCP tools and streaming AG-UI.

★ 01 readstreamable-http

Trail-Code

trailhq/Trail-Code

✕BLOCK F

Turbocharge Claude Code, Cursor, Codex, Gemini & every coding agent: faster, cheaper, with contextual understanding specific to your codebase.

★ 10,6753 write

Fonoster

fonoster/fonoster

✕BLOCK F

🚀 The open-source alternative to Twilio.

★ 8,1143 writestdio

MARM

lyellr88/marm-systems

✕BLOCK F

Local-first 3-in-1 AI memory layer & MCP server for Claude Code, Codex, Grok, Gemini, VS Code and Cursor. Fuses session history, codebase indexing & concept graphs in SQLite. Enables zero-cloud, privacy-first context & instant recall, supports multi-agent swarms.

★ 41011 readstdio

Reasoner

jacck/mcp-reasoner

✕BLOCK F

A systematic reasoning MCP server implementation for Claude Desktop with beam search and thought evaluation.

★ 2771 readsse

SuperLocalMemory

qualixar/superlocalmemory

✕BLOCK F

Open-source governed, local-first memory control plane for AI agents and teams. arXiv:2608.08253

★ 2273 readstdio

sunpeak

Alignbase/sunpeak

✕BLOCK F

Server-agnostic MCP testing framework and full-stack MCP App framework for ChatGPT Apps, Claude Connectors, and more.

★ 2171 readstreamable-http

MATLAB

williamcloudqi/matlab-mcp-server

✕BLOCK F

The MATLAB MCP server provides AI users with powerful scientific computing and data analysis capabilities. It allows users to execute MATLAB code directly in conversations, generate MATLAB scripts from natural language descriptions, and access MATLAB documentation.

★ 541 writesse

GitLab

jmrplens/gitlab-mcp-server

✕BLOCK F

Open source GitLab MCP server for AI assistants: 2-tool dynamic find/execute over 850+ GitLab actions (1,000+ Enterprise), stdio/HTTP/OAuth, safe/read-only modes.

★ 434 writestdio

Splunk AI Connector

deslicer/mcp-for-splunk

✕BLOCK F

MCP Server for integrating with Splunk Enterprise

★ 273 readstdio

Codesteward

codesteward/codesteward

✕BLOCK F

Agentic code review with structural graph intelligence — PR gate + branch stewardship. Self-hosted. Apache-2.0.

★ 213 writestreamable-http

neo-agent-brain

neomjs/neo-agent-brain

✕BLOCK F

Point a cross-model AI engineering team at your own codebases. The Agent OS keeps named AI maintainers' identity, memory and review across labs alive between sessions — the Brain Neo.mjs runs on itself. Multi-tenant: onboarding a codebase is a config entry, not a fork.

★ 1140 readstdio

RepoTunnel

Yashwanth034/RepoTunnel

✕BLOCK F

RepoTunnel is a secure local AI workspace bridge that connects ChatGPT Web and MCP-compatible AI clients to approved local projects, files, terminals, Git, GitHub, browsers, editors, and desktop applications—so AI can inspect, edit, test, run, and manage real development work without constant copy-p

★ 61 readstreamable-http

mantle

aotter/mantle

✕BLOCK F

AotterMantle SDK: agent-native CMS runtime, manifests, admin UI, and Cloudflare adapter.

★ 53 read

harborclerk

r0shi/harborclerk

✕BLOCK F

An MCP server that lets AI agents query your document archive instead of uploading it — with OCR, hybrid search, and cited local-AI answers in a private, Mac-native app.

★ 32 writestreamable-http

Align CLI

aligndottech/align-cli

✕BLOCK F

Align CLI - capture decisions, check alignment, and query your decision graph from the terminal

★ 21 readsse

Other risk hubs

By job

Questions

What counts as destructive?
A tool that deletes, overwrites or runs commands. We class every tool the source declares as read, write or destructive; a server is listed here when it has tools and none is destructive.
How is this different from read-only?
Read-only servers have only read tools (1,620 servers). This list also includes servers whose tools write: 1,525 of the 3,145 do.
Does no destructive tools mean safe?
No. 1,632 are SAFE, 521 CAUTION and 992 BLOCK on this list. The verdict comes from the audit of the source, not from the tool list alone.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.