MCP servers · least privilege
MCP servers with no destructive tools
3,145 MCP servers declare at least one tool and none of them is classed destructive: nothing deletes, overwrites or runs a command through a declared tool. 1,620 of them only read; the rest may create or edit.
Cite
Cite this page
ModelsAtlas. “MCP servers with no destructive tools”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/no-destructive/page/129
Verdicts · 3,145 servers
Transports
- stdio, runs locally2,191
- Streamable HTTP, remote1,060
- SSE, legacy remote253
- Not declared563
A server can list more than one transport.
3,145 servers
3,073–3,096 of 3,145 · ranked by trust score, then stars
ApiTap
n1byn1kt/apitap
CLI, MCP server, and npm library that turns any website into an API — no docs, no SDK, no browser.
mcp-gateway
MikkoParkkola/mcp-gateway
Unlimited MCP servers, tools and APIs. One fixed context cost. Plug every tool you own into Claude, Cursor, Codex or any MCP client: your agent sees a handful, finds the rest on demand, and never drowns in tool definitions. Self-hosted MCP gateway and proxy in one Rust binary, 100+ API integrations
nomoreide
Rorogogogo/nomoreide
AI-native service workbench: MCP server + shared daemon for Claude Code, Codex, and Gemini. CLI, TUI, and web dashboard for running services, logs, git, and databases.
Archon
coleam00/archon
The first open-source harness builder for AI coding. Make AI coding deterministic and repeatable.
Smart Tree
8b-is/smart-tree
Smart Tree: not just a tree, a philosophy. A context-aware, AI-crafted replacement for 20+ tools with MEM8 quantum compression, semantic search, AST-smart editing, and partnership memory. Crafted with care by human + AI—accept no knock-offs.
KSail
devantler-tech/ksail
All-in-one Kubernetes SDK: create, manage, and operate clusters across distributions (Kind, K3d, Talos, VCluster) with built-in GitOps, secrets, AI assistant, and MCP server. Only requires Docker or a Cloud Provider.
Pentest
dmontgomery40/pentest-mcp
NOT for educational purposes: An MCP server for professional penetration testers including STDIO/HTTP/SSE support, nmap, go/dirbuster, nikto, JtR, hashcat, wordlist building, and more.
Agent Security Harness
msaleme/red-team-blue-team-agent-fabric
AI agent security harness, adversarial testing: 640 executable tests in the v4.26.1 release, across MCP, A2A, x402/L402, decision governance, benchmark integrity, human-in-the-loop, skill supply chain. Four target shapes: a verdict must be able to be wrong AND to be right. OWASP Agentic v1.1 T1-T17,
Faxbot
DMontgomery40/Faxbot
Self-hosted, open source, fax-sending API. HIPAA compliant. This fax API includes MCP (Model Context Protocol) support for AI assistant integration.
Better Auth
better-auth/better-auth
The most comprehensive authentication framework
claudish
MadAppGang/claudish
Claude Code. Any Model. The most powerful AI coding agent now speaks every language.
MemClaw
caura-ai/caura-memclaw
Caura (formerly MemClaw) — governed shared memory for AI agent fleets. Multi-agent, multi-tenant, MCP-native. Trust tiers, keystone policies, audit trails, knowledge graph, self-improving retrieval. Apache 2.0.
Open Computer Use
yambr/open-computer-use
ARCHIVED — superseded by Wide Moat
Travel Planner
gongrzhe/travel-planner-mcp-server
HealthClaw Guardrails
aks129/healthclawguardrails
Open-source guardrails between AI agents and FHIR clinical data — PHI redaction, immutable audit, step-up auth, tenant isolation. MCP server + OpenAI/Gemini adapters. A healthclaw.io project.
Symaira Vault
danieljustus/symaira-vault
🔐 The password manager for terminal users and AI agents. Age-encrypted, keyring-cached, MCP-ready. Zero telemetry.
MCP Any
mcpany/core
artifact-site
lexmount/artifact-site
A self-hosted home for your team’s AI-generated pages and documents. Publish HTML, build folders, ZIPs and PDFs as sandboxed, versioned links. CLI + remote MCP for AI agents.
Clade
shenxingy/Clade
Turn Claude Code and Codex from chat assistants into autonomous coding systems
trackyourtime
trebeljahr/trackyourtime
Self-hostable time tracker for freelancers. Track time from the web app, your browser or Raycast, then turn the hours into reports and invoices.
rfauto
geer1895/rfauto
RF/microwave CAD automation + LLM orchestration: multi-solver tuning loop (HFSS/ADS/openEMS/Palace), calibration-anchored surrogate optimization, 71 EM templates, 254 CLI commands, 149 MCP tools, deterministic-kernel physics. GPL-3.0
who2be
luetzey/who2be
Self-hosted hub for AI agent configuration: versioned personas, playbooks and knowledge with a mandatory review step, served to agents over MCP. Agent configuration you review — not behavior you hope for.
AGI Memory
cognitivecomputations/agi-memory
caura
caura-ai/caura
Caura (formerly MemClaw) — governed shared memory for AI agent fleets. Multi-agent, multi-tenant, MCP-native. Trust tiers, keystone policies, audit trails, knowledge graph, self-improving retrieval. Apache 2.0.
Other risk hubs
By job
Questions
What counts as destructive?
How is this different from read-only?
Does no destructive tools mean safe?
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What counts as destructive?
- How is this different from read-only?
- Does no destructive tools mean safe?