MCP servers · least privilege

MCP servers with no destructive tools

3,145 MCP servers declare at least one tool and none of them is classed destructive: nothing deletes, overwrites or runs a command through a declared tool. 1,620 of them only read; the rest may create or edit.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “MCP servers with no destructive tools”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/no-destructive/page/122

Verdicts · 3,145 servers

✓SAFE1,632!CAUTION521✕BLOCK992

Transports

A server can list more than one transport.

3,145 servers

2,905–2,928 of 3,145 · ranked by trust score, then stars

Barbacane

barbacane-dev/barbacane

✕BLOCK F

Barbacane API and Bidirectional AI Gateway

★ 289 read

ai-dossier

imboard-ai/ai-dossier

✕BLOCK F

An open standard for signed, versioned agent skills. Model-driven orchestration with a deterministic shell — host anywhere, verify who wrote it. CLI, registry, MCP, VS Code.

★ 96 writestdio

hbhqq9-bde-score

hbhqq9/bde-score

✕BLOCK F

🏆 Open-source multi-factor stock scoring API (0-100) | US/HK/A-Share 74 stocks | Zero signup | shields.io badges | GitHub Action | EU AI Act compliant

★ 35 readstdio

Trazum

Davmunrey/Trazum

✕BLOCK F

Know what your AI agents cost, per project, without your prompts leaving the machine. CLI, MCP server and CI gate. Zero dependencies, offline.

★ 17 readstdio

limetry

limetry/limetry

!CAUTION F

Limetry is open-source agent action governance: check tool intents against policy before irreversible runs. Returns allow, deny, or approval_required with signed receipts and privacy-safe audit. TypeScript SDK, CLI, and MCP for IDE like Cursor, VS Code, GitHub Copilot, Claude. Optional CI, SQL, and

★ 16 writestdio

Synorive

arturoaeriform174/Synorive

✕BLOCK F

Search your files by meaning and fact-check the web, fully offline.

★ 026 readstdio

GPT Researcher

assafelovic/gpt-researcher

✕BLOCK F

An autonomous agent that conducts deep research on any data using any LLM providers

★ 29,5232 readstreamable-http

Npcpy

cagostino/npcpy

✕BLOCK F

The python library for research and development in NLP, multimodal LLMs, Agents, ML, Knowledge Graphs, and more.

★ 1,5091 writestdio

Npcpy

npc-worldwide/npcpy

✕BLOCK F

The python library for research and development in NLP, multimodal LLMs, Agents, ML, Knowledge Graphs, and more.

★ 1,5091 writestdio

npcpy

NPC-Worldwide/npcpy

✕BLOCK F

The python library for research and development in NLP, multimodal LLMs, Agents, ML, Knowledge Graphs, and more.

★ 1,5081 writestdio

Coolify

stumason/coolify-mcp

✕BLOCK F

MCP server for Coolify — 42 optimized tools for managing self-hosted PaaS through AI assistants

★ 6031 writestdio

Beever Atlas

beever-ai/beever-atlas

✕BLOCK F

Your First LLM-Wiki Conversation Knowledge Base

★ 4482 writestdio

agents-can-communicate

automatis-tools/agents-can-communicate

✕BLOCK F

Messages between AI coding sessions in different vendors' clients, such as Claude Code and Codex. Local, open source, no lead agent.

★ 1302 write

DeployStack

deploystackio/deploystack

✕BLOCK F

Open source MCP hosting - deploy MCP servers to HTTP endpoints for n8n, Dify, Voiceflow, and any MCP client.

★ 644 writestdio

Xcode

polarvista/xcode-mcp-server

✕BLOCK F
★ 531 writesse

Xiaozhi Tools

zhongzitongxue/xiaozhi-mcptools

✕BLOCK F

一个图形化界面的小智MCP服务连接器,包含多种工具! 自动部署服务,方便小白给小智Ai添加MCP工具

★ 5274 readstdio

Lunchmoney

leafeye/lunchmoney-mcp-server

✕BLOCK F
★ 284 readsse

Hecate

hecatehq/hecate

✕BLOCK F

AI workspace and runtime for projects, chats, providers, memory, approvals, and supervised agents.

★ 231 writestreamable-http

platform

GCTRL-TECH/platform

✕BLOCK F

Governed graph-native agent memory: knowledge extraction, fusion, hybrid RAG, scoped access tokens. A push for data sovereignty.

★ 76 readstdio

Bizarharness

PolderLabsVOF/BizarHarness

✕BLOCK F

Guarded multi-agent harness for Claude Code: model aliases, OpenKan planning, isolated worktrees, and evidence-led verification.

★ 21 write

trantor

sashabogi/trantor

✕BLOCK F

The hub-world for AI agent crews — orchestrate Claude Code, Codex, Gemini, Kimi & DeepSeek as live crews with a plan-aware Advisor, a Kanban/flow command center, a testing gate, and an economics brain (Scrooge).

★ 18 writestdio

eurostat-mcp-server

barrylecherous932/eurostat-mcp-server

✕BLOCK F

Query Eurostat datasets on economy, health, and regional data through the Model Context Protocol using STDIO or HTTP.

★ 01 readstdio

llm-wiki-compiler

atomicstrata/llm-wiki-compiler

✕BLOCK F

The knowledge compiler. Raw sources in, interlinked wiki out. Inspired by Karpathy's LLM Wiki pattern.

★ 2,1824 writestdio

octocode-mcp

bgauryy/octocode

✕BLOCK F

Code research platform for AI agents; find, understand, and prove context across your code and all of GitHub, in a fraction of the tokens. One toolset, MCP or CLI

★ 9509 writestdio

Other risk hubs

By job

Questions

What counts as destructive?
A tool that deletes, overwrites or runs commands. We class every tool the source declares as read, write or destructive; a server is listed here when it has tools and none is destructive.
How is this different from read-only?
Read-only servers have only read tools (1,620 servers). This list also includes servers whose tools write: 1,525 of the 3,145 do.
Does no destructive tools mean safe?
No. 1,632 are SAFE, 521 CAUTION and 992 BLOCK on this list. The verdict comes from the audit of the source, not from the tool list alone.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.