MCP servers · least privilege

MCP servers with no destructive tools

3,145 MCP servers declare at least one tool and none of them is classed destructive: nothing deletes, overwrites or runs a command through a declared tool. 1,620 of them only read; the rest may create or edit.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “MCP servers with no destructive tools”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/no-destructive/page/129

Verdicts · 3,145 servers

✓SAFE1,632!CAUTION521✕BLOCK992

Transports

A server can list more than one transport.

3,145 servers

3,073–3,096 of 3,145 · ranked by trust score, then stars

ApiTap

n1byn1kt/apitap

✕BLOCK F

CLI, MCP server, and npm library that turns any website into an API — no docs, no SDK, no browser.

★ 1271 writestdio

mcp-gateway

MikkoParkkola/mcp-gateway

✕BLOCK F

Unlimited MCP servers, tools and APIs. One fixed context cost. Plug every tool you own into Claude, Cursor, Codex or any MCP client: your agent sees a handful, finds the rest on demand, and never drowns in tool definitions. Self-hosted MCP gateway and proxy in one Rust binary, 100+ API integrations

★ 799 writestdio

nomoreide

Rorogogogo/nomoreide

✕BLOCK F

AI-native service workbench: MCP server + shared daemon for Claude Code, Codex, and Gemini. CLI, TUI, and web dashboard for running services, logs, git, and databases.

★ 71 writestreamable-http

Archon

coleam00/archon

✕BLOCK F

The first open-source harness builder for AI coding. Make AI coding deterministic and repeatable.

★ 23,5055 write

Smart Tree

8b-is/smart-tree

✕BLOCK F

Smart Tree: not just a tree, a philosophy. A context-aware, AI-crafted replacement for 20+ tools with MEM8 quantum compression, semantic search, AST-smart editing, and partnership memory. Crafted with care by human + AI—accept no knock-offs.

★ 2707 read

KSail

devantler-tech/ksail

✕BLOCK F

All-in-one Kubernetes SDK: create, manage, and operate clusters across distributions (Kind, K3d, Talos, VCluster) with built-in GitOps, secrets, AI assistant, and MCP server. Only requires Docker or a Cloud Provider.

★ 1663 readstdio

Pentest

dmontgomery40/pentest-mcp

✕BLOCK F

NOT for educational purposes: An MCP server for professional penetration testers including STDIO/HTTP/SSE support, nmap, go/dirbuster, nikto, JtR, hashcat, wordlist building, and more.

★ 14719 readsse

Agent Security Harness

msaleme/red-team-blue-team-agent-fabric

✕BLOCK F

AI agent security harness, adversarial testing: 640 executable tests in the v4.26.1 release, across MCP, A2A, x402/L402, decision governance, benchmark integrity, human-in-the-loop, skill supply chain. Four target shapes: a verdict must be able to be wrong AND to be right. OWASP Agentic v1.1 T1-T17,

★ 326 readstdio

Faxbot

DMontgomery40/Faxbot

✕BLOCK F

Self-hosted, open source, fax-sending API. HIPAA compliant. This fax API includes MCP (Model Context Protocol) support for AI assistant integration.

★ 11 writestdio

Better Auth

better-auth/better-auth

✕BLOCK F

The most comprehensive authentication framework

★ 30,26612 readstreamable-http

claudish

MadAppGang/claudish

✕BLOCK F

Claude Code. Any Model. The most powerful AI coding agent now speaks every language.

★ 1,00511 writestdio

MemClaw

caura-ai/caura-memclaw

✕BLOCK F

Caura (formerly MemClaw) — governed shared memory for AI agent fleets. Multi-agent, multi-tenant, MCP-native. Trust tiers, keystone policies, audit trails, knowledge graph, self-improving retrieval. Apache 2.0.

★ 5442 writestreamable-http

Open Computer Use

yambr/open-computer-use

✕BLOCK F

ARCHIVED — superseded by Wide Moat

★ 1261 writestreamable-http

Travel Planner

gongrzhe/travel-planner-mcp-server

✕BLOCK F
★ 991 writesse

HealthClaw Guardrails

aks129/healthclawguardrails

✕BLOCK F

Open-source guardrails between AI agents and FHIR clinical data — PHI redaction, immutable audit, step-up auth, tenant isolation. MCP server + OpenAI/Gemini adapters. A healthclaw.io project.

★ 306 writesse

Symaira Vault

danieljustus/symaira-vault

✕BLOCK F

🔐 The password manager for terminal users and AI agents. Age-encrypted, keyring-cached, MCP-ready. Zero telemetry.

★ 3027 writestdio

MCP Any

mcpany/core

✕BLOCK F
★ 224 writesse

artifact-site

lexmount/artifact-site

✕BLOCK F

A self-hosted home for your team’s AI-generated pages and documents. Publish HTML, build folders, ZIPs and PDFs as sandboxed, versioned links. CLI + remote MCP for AI agents.

★ 182 readstdio

Clade

shenxingy/Clade

✕BLOCK F

Turn Claude Code and Codex from chat assistants into autonomous coding systems

★ 101 readstdio

trackyourtime

trebeljahr/trackyourtime

✕BLOCK F

Self-hostable time tracker for freelancers. Track time from the web app, your browser or Raycast, then turn the hours into reports and invoices.

★ 28 writestdio

rfauto

geer1895/rfauto

✕BLOCK F

RF/microwave CAD automation + LLM orchestration: multi-solver tuning loop (HFSS/ADS/openEMS/Palace), calibration-anchored surrogate optimization, 71 EM templates, 254 CLI commands, 149 MCP tools, deterministic-kernel physics. GPL-3.0

★ 011 writestdio

who2be

luetzey/who2be

✕BLOCK F

Self-hosted hub for AI agent configuration: versioned personas, playbooks and knowledge with a mandatory review step, served to agents over MCP. Agent configuration you review — not behavior you hope for.

★ 05 readstdio

AGI Memory

cognitivecomputations/agi-memory

✕BLOCK F
★ 6173 readstdio

caura

caura-ai/caura

✕BLOCK F

Caura (formerly MemClaw) — governed shared memory for AI agent fleets. Multi-agent, multi-tenant, MCP-native. Trust tiers, keystone policies, audit trails, knowledge graph, self-improving retrieval. Apache 2.0.

★ 5442 writestreamable-http

Other risk hubs

By job

Questions

What counts as destructive?
A tool that deletes, overwrites or runs commands. We class every tool the source declares as read, write or destructive; a server is listed here when it has tools and none is destructive.
How is this different from read-only?
Read-only servers have only read tools (1,620 servers). This list also includes servers whose tools write: 1,525 of the 3,145 do.
Does no destructive tools mean safe?
No. 1,632 are SAFE, 521 CAUTION and 992 BLOCK on this list. The verdict comes from the audit of the source, not from the tool list alone.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.