MCP servers · least privilege

MCP servers with no destructive tools

3,145 MCP servers declare at least one tool and none of them is classed destructive: nothing deletes, overwrites or runs a command through a declared tool. 1,620 of them only read; the rest may create or edit.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “MCP servers with no destructive tools”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/no-destructive/page/131

Verdicts · 3,145 servers

✓SAFE1,632!CAUTION521✕BLOCK992

Transports

A server can list more than one transport.

3,145 servers

3,121–3,144 of 3,145 · ranked by trust score, then stars

schelling

SchellingAF/schelling

✕BLOCK F

Schelling Add Forward: communication and persistent state for AI agents, over HTTP and MCP, on PostgreSQL.

★ 05 writestdio

Whodb

clidey/whodb

✕BLOCK F

Where data access meets operational intelligence

★ 5,0334 readstreamable-http

Skylos

duriantaco/skylos

✕BLOCK F

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

★ 8403 writesse

Free Crypto News

nirholas/free-crypto-news

✕BLOCK F

Free crypto news API - real-time aggregator for Bitcoin, Ethereum, DeFi, Solana & altcoins. No API key required. RSS/Atom feeds, JSON REST API, historical archive with market context, embeddable widgets, ChatGPT plugin, Claude MCP server, SDKs (Python, TypeScript, Go, React, PHP). AI/LLM ready. Vibe

★ 31914 writestdio

javis-os

blogminhquy/javis-os

✕BLOCK F
★ 2221 readstdio

EGC

fmarzochi/egc

✕BLOCK F

EGC gives every AI coding agent the same brain. Shared memory, skills, and live context across Cursor, Claude Code, Copilot, Aider, and 20+ AI coding tools with zero configuration. Every tab, terminal, and AI stays automatically synchronized. One brain. Everywhere.

★ 637 writestdio

CloudBase AI ToolKit

tencentcloudbase/cloudbase-ai-toolkit

✕BLOCK F

Backend for AI coding agents on CloudBase — database, auth, functions via Plugin, Skills & MCP.

★ 1,1251 writestdio

Unraid

dinglebear-ai/unraid-mcp

✕BLOCK F

Query, monitor, and manage Unraid servers via GraphQL API through MCP tools. Supports system info, Docker, VMs, array/parity, notifications, plugins, rclone, and live telemetry.

★ 1355 readstdio

Unraid

dinglebear-ai/unraid

✕BLOCK F

Query, monitor, and manage Unraid servers via GraphQL API through MCP tools. Supports system info, Docker, VMs, array/parity, notifications, plugins, rclone, and live telemetry.

★ 1355 readstdio

Unraid

jmagar/unraid-mcp

✕BLOCK F

Query, monitor, and manage Unraid servers via GraphQL API through MCP tools. Supports system info, Docker, VMs, array/parity, notifications, plugins, rclone, and live telemetry.

★ 1355 readstdio

VibeShell

veithly/vibeshell

✕BLOCK F

Local-first SSH/SFTP workspace for humans and coding agents: visible operations, shared sessions, integrated files and discoverable plugins.

★ 8420 read

hackmyagent

opena2a-org/hackmyagent

✕BLOCK F

Metasploit for AI agents: scan, attack, and fix AI agents and MCP servers. Open source security toolkit.

★ 831 writestdio

GraphFlow

Roarpeng/GraphFlow

✕BLOCK F

Local-first code knowledge graph and context harness for coding agents. MCP + DeepSeek Harness (dsh) plugin.

★ 194 writestdio

AgenticOS-Workbench

zzoretich/AgenticOS-Workbench

✕BLOCK F

UniDeX Agent Harness: a second brain and supervised Chief of Staff for Claude Code and Codex CLI, with persistent memory, recall and session capture, plus proposals you approve before anything changes. Lives in a plain-Markdown vault, with the UniDeX macOS app as its live dashboard.

★ 32 writestdio

exceptd Security

blamejs/exceptd-skills

✕BLOCK F

AI security skills grounded in mid-2026 threat reality, not stale framework documentation

★ 011 read

great-cto

avelikiy/great_cto

✕BLOCK F

You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 70 specialist agents — an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether i

★ 1039 read

remembra

remembra-ai/remembra

✕BLOCK F

Remembra Relay: one agent stops, the next one already knows. Session handoffs built from git facts, for the next coding agent in any MCP tool, on any machine. MCP server + CLI. MIT.

★ 164 writestdio

bv-mcp

MadaBurns/bv-mcp

✕BLOCK F

Open-source DNS & email security scanner. One MCP endpoint, 57 checks, zero install. Cloudflare Workers.

★ 99 readstreamable-http

BreachPilot

braydos-h/BreachPilot

✕BLOCK F

Autonomous Offensive Security Agent for Red Team Operations

★ 48 writestdio

sequant

sequant-io/sequant

✕BLOCK F

AI coding agent orchestrator — resolve GitHub issues end-to-end with isolated git worktrees, quality gates, and an MCP server. Works with Claude Code or Aider.

★ 11 writesse

Pollinations

pollinations/pollinations

✕BLOCK F

Your Friendly Open-Source Gen-AI Platform

★ 5,1011 writestreamable-http

MisakaNet

Ikalus1988/MisakaNet

✕BLOCK F

📚 A zero-dependency, git-backed micro-lesson library for AI Agents to asynchronously share and search verified debugging experience. | https://misakanet.org

★ 5163 writestdio

bce-engine

blueprint-conformance/bce

✕BLOCK F

Blueprints with Teeth — the blueprint conformance engine: authored architectural intent, enforced in CI.

★ 13 write

llm-trust-guard

nkratk/llm-trust-guard

✕BLOCK F
★ 214 writestreamable-http

Other risk hubs

By job

Questions

What counts as destructive?
A tool that deletes, overwrites or runs commands. We class every tool the source declares as read, write or destructive; a server is listed here when it has tools and none is destructive.
How is this different from read-only?
Read-only servers have only read tools (1,620 servers). This list also includes servers whose tools write: 1,525 of the 3,145 do.
Does no destructive tools mean safe?
No. 1,632 are SAFE, 521 CAUTION and 992 BLOCK on this list. The verdict comes from the audit of the source, not from the tool list alone.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.