MCP servers · least privilege

MCP servers with no destructive tools

3,145 MCP servers declare at least one tool and none of them is classed destructive: nothing deletes, overwrites or runs a command through a declared tool. 1,620 of them only read; the rest may create or edit.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “MCP servers with no destructive tools”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/no-destructive/page/121

Verdicts · 3,145 servers

✓SAFE1,632!CAUTION521✕BLOCK992

Transports

A server can list more than one transport.

3,145 servers

2,881–2,904 of 3,145 · ranked by trust score, then stars

kansei-mcp-server

kansei-link/kansei-mcp-server

✕BLOCK F

Local-first MCP navigator for AI agents. 11,000+ SaaS services, 200 workflow recipes, 89-97% token savings. Works with Claude Code, Cursor, Cline, Zed, Windsurf.

★ 15 writestdio

md-business

meta-taro/md-business

✕BLOCK F

Business documents as Markdown — invoices, design docs and test sheets validated by JSON Schema, rendered to A4 PDF, and editable by AI agents through a built-in MCP server. Tauri desktop app + Chrome extension.

★ 16 writestdio

bitHuman docs

bithuman-product/public-docs

✕BLOCK F

Public — source for docs.bithuman.ai (Astro Starlight + auto-generated OpenAPI reference). [public]

★ 02 write

datahogo

datahogo/datahogo

✕BLOCK F

Open-source security scanner that runs on your machine — your code never leaves your laptop. 300+ checks for JS/TS, Python, Go, Java, PHP, C#, mobile and Supabase. Plain-language explanations, AI fixes with your own API key.

★ 04 readstdio

DataQ

TheurgicDuke771/DataQ

✕BLOCK F

Open-source data quality monitoring: checks across warehouses, lakehouses and object stores, triggered by ADF, Airflow and dbt, with alerting and an MCP server.

★ 02 readstreamable-http

flowviant

flowviant/cli

✕BLOCK F
★ 01 readstreamable-http

Unstract

zipstack/unstract

✕BLOCK F

LLM-Driven Extraction of Unstructured Data — Built for API Deployments & ETL Pipeline Workflows

★ 7,2455 read

Langroid

langroid/langroid

✕BLOCK F

Harness LLMs with Multi-Agent Programming

★ 4,1033 writestdio

graphjin

dosco/graphjin

✕BLOCK F

One governed graph for AI agents — GraphQL + MCP over your databases, files, APIs, and code

★ 3,2063 readstreamable-http

Stripe AI

stripe/ai

✕BLOCK F

One-stop shop for building AI-powered products and businesses with Stripe.

★ 1,9041 writestdio

Minions

hazyresearch/minions

✕BLOCK F

Big & Small LLMs working together

★ 1,3611 write

Coolify MCP Server

StuMason/coolify-mcp

✕BLOCK F

MCP server for Coolify — 42 optimized tools for managing self-hosted PaaS through AI assistants

★ 6121 writestdio

Hevy

chrisdoc/hevy-mcp

!CAUTION F

Manage your Hevy workouts, routines, folders, and exercise templates. Create and update sessions faster, organize plans, and search exercises to build workouts quickly. Stay synced with changes so your training log is always up to date.

★ 4932 readstdio

hevy-mcp

chrisdoc/hevy-mcp

!CAUTION F

Manage your Hevy workouts, routines, folders, and exercise templates. Create and update sessions faster, organize plans, and search exercises to build workouts quickly. Stay synced with changes so your training log is always up to date.

★ 4832 readstdio

Reversecore

sjkim1127/reversecore_mcp

!CAUTION F

A security-first MCP server that empowers AI agents to perform automated reverse engineering, malware analysis, forensics, vulnerability research, and SAST — powered by Radare2, YARA, LIEF, Capstone, and more.

★ 2079 writesse

Remindb

radimsem/remindb

✕BLOCK F

An agentic memory database that cuts session tokens by 82–99%. One portable SQLite file — your agent's memory, anywhere.

★ 1291 writestreamable-http

Pentest

ramkansal/pentestmcp

✕BLOCK F

pentestMCP: AI-Powered Penetration Testing via MCP, an MCP designed for penetration testers.

★ 1087 writestreamable-http

Vibe Coder

freshtechbro/vibe-coder-mcp

✕BLOCK F

Vibe-Coder-MCP server extends AI assistants with specialized software development tools.

★ 1031 writesse

ClinicalTrials.gov

cyanheads/clinicaltrialsgov-mcp-server

✕BLOCK F

Search ClinicalTrials.gov trials, retrieve study details and results, and match patients to eligible trials via MCP. STDIO or Streamable HTTP.

★ 972 readstdio

Teradata

teradata/teradata-mcp-server

✕BLOCK F

The community development of a MCP server for a Teradata database

★ 571 readstdio

Heimdall App Store Connect

erayendes/app-store-connect-mcp

✕BLOCK F

Heimdall — MCP server for the Apple App Store Connect API and App Store Server API (StoreKit 2). 890 tools across 13 profiles, generated from Apple's OpenAPI spec, plus one-call macros for worldwide pricing, submission readiness and metadata diffs, and confirm-before-write safety. Works with Claude,

★ 5110 writestdio

Profullstack

profullstack/mcp-server

✕BLOCK F

A generic, modular server for implementing the Model Context Protocol (MCP).

★ 459 writestdio

Fastly

fastly/mcp

✕BLOCK F

Model Context Protocol (MCP) server for AI-powered Fastly CDN management.

★ 391 writestreamable-http

Janee

rsdouglas/janee

✕BLOCK F

Secrets management for AI agents via MCP • @janeesecure

★ 307 writestdio

Other risk hubs

By job

Questions

What counts as destructive?
A tool that deletes, overwrites or runs commands. We class every tool the source declares as read, write or destructive; a server is listed here when it has tools and none is destructive.
How is this different from read-only?
Read-only servers have only read tools (1,620 servers). This list also includes servers whose tools write: 1,525 of the 3,145 do.
Does no destructive tools mean safe?
No. 1,632 are SAFE, 521 CAUTION and 992 BLOCK on this list. The verdict comes from the audit of the source, not from the tool list alone.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.