MCP servers · least privilege

MCP servers with no destructive tools

3,145 MCP servers declare at least one tool and none of them is classed destructive: nothing deletes, overwrites or runs a command through a declared tool. 1,620 of them only read; the rest may create or edit.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “MCP servers with no destructive tools”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/no-destructive/page/124

Verdicts · 3,145 servers

✓SAFE1,632!CAUTION521✕BLOCK992

Transports

A server can list more than one transport.

3,145 servers

2,953–2,976 of 3,145 · ranked by trust score, then stars

cli

modelstudioai/cli

✕BLOCK F

Official Model Studio CLI(阿里云百炼 CLI)built for AI Agent frameworks, exposing models, search, multimodal, and workflow capabilities as structured tool calls.

★ 5395 readstreamable-http

AI-Canvas-tauri

Tenney95/AI-Canvas-tauri

✕BLOCK F

Local-first AI canvas for visual workflows, AI short drama, image/video generation, storyboarding and asset management. ComfyUI, AI agents, MCP & Blender. 本地优先 AI 画布:AI短剧、AI资产管理、图像/视频生成、分镜制作与视频剪辑。

★ 20846 readstdio

NyxStrike

commonhuman-lab/nyxstrike

✕BLOCK F

AI Powered penetration testing Platform for offensive security research

★ 1561 write

DeepSecure

deeptrail/deepsecure

✕BLOCK F

Effortlessly secure your AI agents and AI-powered workflows — from prototype to production. Get easy-to-use identity, credential, and access management built for fast-moving AI developers.

★ 525 readstreamable-http

Rash

paiml/bashrs

✕BLOCK F

Bashrs: Rust-to-Shell Transpiler for Deterministic Bootstrap Scripts

★ 411 read

impri

sekera-radim/impri

✕BLOCK F

Human-in-the-loop approval inbox for AI agents. An agent proposes an action, a human approves or rejects it, then it runs. Watchers + approval inbox, MCP + REST, self-hostable (MIT).

★ 53 writestdio

AiFinPay — payment infrastructure for AI agents

AiFinPay/sdk

✕BLOCK F

Payment infrastructure for AI agents: wallet, passport, owner-enabled Polygon and Base payments.

★ 35 writestdio

puenteo

mano7onam/puenteo

✕BLOCK F

Let your coding agents talk to each other: search every Claude Code / Codex / Gemini / Cursor session and message live sessions. CLI · MCP · hooks · HTTP/SSE · A2A.

★ 11 readstdio

caveman-shrink

JuliusBrussee/caveman

✕BLOCK F

🪨 why use many token when few token do trick. Viral skill + proxy for coding agents that cuts 65% of tokens by talking like a caveman.

★ 111,2134 write

Reactive Resume

amruthpillai/reactive-resume

✕BLOCK F

A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today!

★ 43,1812 readstreamable-http

Reactive Resume

reactive-resume/app

✕BLOCK F

A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today!

★ 43,1812 readstreamable-http

Reactive Resume

reactive-resume/reactive-resume

✕BLOCK F

A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today!

★ 43,1812 readstreamable-http

Mex

mex-memory/mex

✕BLOCK F

Team memory for engineers and their AI agents. Lives in your repo. Shared through Git.

★ 1,7032 writestdio

Snowluma

SnowLuma/SnowLuma

✕BLOCK F

Next Remote Protocol Framework.

★ 1,6111 writestdio

Sentry

getsentry/sentry-mcp

✕BLOCK F

An MCP server for interacting with Sentry via LLMs.

★ 8643 readstdio

Novamira

use-novamira/novamira

✕BLOCK F

MCP server that gives AI agents full access to WordPress through PHP execution and filesystem operations

★ 6983 readstdio

Flyto Core

flytohub/flyto-core

✕BLOCK F

AI said it finished. Flyto2 shows the proof.

★ 4833 readstdio

Claude Delegator

antonbabenko/claude-delegator

✕BLOCK F

Ask Codex, Gemini, Grok, and 400+ OpenRouter models (Qwen, Kimi, DeepSeek) for second opinions or arbiter-mediated consensus. One MCP server for Claude Code, Codex, Cursor, Kiro, OpenCode. Measures the models' usefulness, too.

★ 1697 writestdio

Deliberation

antonbabenko/deliberation

✕BLOCK F

Ask Codex, Gemini, Grok, and 400+ OpenRouter models (Qwen, Kimi, DeepSeek) for second opinions or arbiter-mediated consensus. One MCP server for Claude Code, Codex, Cursor, Kiro, OpenCode. Measures the models' usefulness, too.

★ 1697 writestdio

Unipi

Neuron-Mr-White/unipi

✕BLOCK F

All-in-one, unified harness. Increasing productivity, and accuracy both at the same time. https://pi.dev/packages/@pi-unipi/unipi?name=unipi

★ 712 write

LLM Council

amiable-dev/llm-council

✕BLOCK F

The LLM Council works together to answer your hardest questions

★ 434 read

Perp

hypurrquant/perp-cli

✕BLOCK F

Multi-DEX perpetual futures CLI + MCP server — Pacifica (Solana), Hyperliquid, Lighter (Ethereum). 18 MCP tools for AI-powered trading

★ 393 writestdio

MCPAudit

saagpatel/MCPAudit

✕BLOCK F

Audit all locally configured MCP servers for permission risks, prompt injection threats, and schema drift

★ 42 writestdio

mnema

felipesauer/mnema

✕BLOCK F

Signed, append-only decision records for AI coding agents: an MCP server and CLI that open Claude Code, Codex, Copilot CLI, Gemini CLI, OpenCode, VS Code and Cursor sessions with your team's decisions, hold the edits a rule governs, and let anyone verify the record offline. Tamper-evident, in git.

★ 44 readstdio

Other risk hubs

By job

Questions

What counts as destructive?
A tool that deletes, overwrites or runs commands. We class every tool the source declares as read, write or destructive; a server is listed here when it has tools and none is destructive.
How is this different from read-only?
Read-only servers have only read tools (1,620 servers). This list also includes servers whose tools write: 1,525 of the 3,145 do.
Does no destructive tools mean safe?
No. 1,632 are SAFE, 521 CAUTION and 992 BLOCK on this list. The verdict comes from the audit of the source, not from the tool list alone.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.