MCP servers · least privilege

MCP servers with no destructive tools

3,145 MCP servers declare at least one tool and none of them is classed destructive: nothing deletes, overwrites or runs a command through a declared tool. 1,620 of them only read; the rest may create or edit.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “MCP servers with no destructive tools”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/no-destructive/page/130

Verdicts · 3,145 servers

✓SAFE1,632!CAUTION521✕BLOCK992

Transports

A server can list more than one transport.

3,145 servers

3,097–3,120 of 3,145 · ranked by trust score, then stars

claude-autopm

rafeekpro/ClaudeAutoPM

✕BLOCK F

Autonomous Project Management Framework for Claude Code - Advanced AI-powered development automation

★ 395 writestdio

unitares

cirwel/unitares

✕BLOCK F

Accountability infrastructure for long-running AI agents. Self-hosted MCP server: identity, claims and evidence, review, outcomes, and reconstruction across agent runtimes.

★ 55 readstdio

viboplr

outcast1000/viboplr

✕BLOCK F

Plugin-first desktop music player for macOS and Windows — local library, streaming services, lyrics, and radio. Built with Tauri 2, React, and Rust.

★ 31 write

token-enhancer

Footshaped-friction742/token-enhancer

✕BLOCK F

Reduce web pages to clean text before they reach your AI agent’s context window, saving tokens and cutting noise

★ 26 readstdio

AgentRecall

goldentrii/agentrecall-mcp

✕BLOCK F

Correction-first persistent memory for AI agents. MCP server + SDK + CLI. Compounds across sessions.

★ 37111 writestdio

AgentRecall

goldentrii/agentrecall-x

✕BLOCK F

Correction-first persistent memory for AI agents. MCP server + SDK + CLI. Compounds across sessions.

★ 37111 writestdio

AgentRecall

goldentrii/agentrecall

✕BLOCK F

Correction-first persistent memory for AI agents. MCP server + SDK + CLI. Compounds across sessions.

★ 37111 writestdio

jev-judge-mcp

PyModel/jev-judge-mcp

✕BLOCK F

Typed judgment tools for MCP agents. TypeSafe's Jev model as verify, screen, find, classify, rerank, decide, compare, extract, review, gate, and score: the model judges, policy decides auto, review, or escalate.

★ 711 readstdio

agent-bounties

NSPG13/agent-bounties

✕BLOCK F

Open-source bounty network where AI agents post, fund, claim, solve, verify, and get paid for digital work.

★ 185 writestreamable-http

Theokit Sdk

usetheokit/theokit-sdk

✕BLOCK F

Open-source TypeScript SDK and agent runtime you own end to end. Agent.create / prompt / stream / resume, 43 LLM providers on your own keys, MCP with OAuth PKCE, subagents, workflows, evals, memory, and a bubblewrap+seccomp kernel sandbox for tool execution. Local-first, opt-in cloud, Apache-2.0.

★ 313 writestdio

KXM

kontextmind/kxm

✕BLOCK F

Pi extensions for multi-agent communication and orchestration

★ 22 writestdio

n.360

resper1965/n.360

✕BLOCK F

n.iso — plataforma de adequação ISO 27001/27701 da ness.

★ 011 writestdio

FlAPI

datazoode/flapi

✕BLOCK F

API Framework heavily relying on the power of DuckDB and DuckDB extensions. Ready to build performant and cost-efficient APIs on top of BigQuery or Snowflake for AI Agents and Data Apps

★ 744 readstreamable-http

Circuit

snowfort-ai/circuit-mcp

✕BLOCK F

Computer use-like MCP for webapps and electron apps, to enable AI agents to test their changes

★ 607 writesse

Token Enhancer

xelektron/token-enhancer

✕BLOCK F

A local proxy that strips web pages down to clean text before they enter your AI agent's context window. 704K tokens → 2.6K tokens. No LLM required.

★ 686 readstdio

CodeSampleX

r2cuerdame/CodeSampleX

✕BLOCK F

An open compatibility testing network: does this library API actually run on your version, OS and runtime? Real build evidence, verified samples, and the environment each result came from.

★ 21 readstdio

security-gate-x402

nohosa001-pixel/security-gate-x402

✕BLOCK F

The Zero-Trust Safety & Settlement Rail for Autonomous AI Agents. Sub-10ms deterministic guardrails, key leak defense, and cryptographic Proof-of-Safety attestations via x402 on Base ($0.002).

★ 23 read

Home Assistant AI

homeassistant-ai/ha-mcp

✕BLOCK F

The Unofficial and Awesome Home Assistant MCP Server

★ 4,8024 writesse

Agoragentic Integrations

rhein1/agoragentic-integrations

✕BLOCK F

Public adapters and discovery catalog for Triptych OS (Agent OS): agent frameworks, MCP/A2A/x402 protocols, workflows, wallets, SDKs, and examples for execute-first routing, governed handoffs, and receipt-aware agent commerce.

★ 4018 writestdio

video-research-mcp

Galbaz1/video-research-mcp

✕BLOCK F

MCP tools and Claude Code workflows for video analysis, cited research, document extraction, knowledge storage, and optional explainer video production.

★ 231 readstdio

mscodebase-intelligence

ManSio/mscodebase-intelligence

✕BLOCK F

Intelligent codebase search & indexing for Zed. Async MCP server featuring LanceDB/BM25 hybrid search, multi-bucket RAG, and autonomous self-healing workflows. High-performance, memory-safe, and ready for your production code.

★ 214 readstreamable-http

run402-mcp

kychee-com/run402

✕BLOCK F

Full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. TypeScript SDK, CLI and MCP server. Paid with x402/MPP. Open source.

★ 242 writestdio

UniDeX-Agent-Harness

zzoretich/UniDeX-Agent-Harness

✕BLOCK F

UniDeX Agent Harness: a second brain and supervised Chief of Staff for Claude Code and Codex CLI, with persistent memory, recall and session capture, plus proposals you approve before anything changes. Lives in a plain-Markdown vault, with the UniDeX macOS app as its live dashboard.

★ 22 writestdio

SceneScout

brunoboto96/SceneScout

✕BLOCK F

🔭 Your coding agent, turned into a QA tester for any web app. Finds what is broken and shows you the proof: pictures, replays, journey videos and test reports. Over MCP, with Claude Code, Cursor, VS Code, Codex, Gemini CLI and more.

★ 13 writestdio

Other risk hubs

By job

Questions

What counts as destructive?
A tool that deletes, overwrites or runs commands. We class every tool the source declares as read, write or destructive; a server is listed here when it has tools and none is destructive.
How is this different from read-only?
Read-only servers have only read tools (1,620 servers). This list also includes servers whose tools write: 1,525 of the 3,145 do.
Does no destructive tools mean safe?
No. 1,632 are SAFE, 521 CAUTION and 992 BLOCK on this list. The verdict comes from the audit of the source, not from the tool list alone.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.