MCP servers · least privilege

Read-only MCP servers

1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/34

Verdicts · 1,620 servers

✓SAFE913!CAUTION261✕BLOCK446

Transports

A server can list more than one transport.

1,620 servers

793–816 of 1,620 · ranked by trust score, then stars

CloakBrowser-Agent

CloakHQ/CloakBrowser-Agent

!CAUTION B

Jev-powered stealth browser agent. TypeSafe Jev decides each step in ~0.3 s, CloakBrowser carries it out like a human. MCP server, CLI and Python API.

★ 34 read

context-compression

herreravalenz6620/context-compression

!CAUTION B

Reduce token usage for JSON, CSV, and TSV files with deterministic compression that keeps data intact for AI agents.

★ 31 read

korean-dart-mcp

aesthetic-legalism5470/korean-dart-mcp

✓SAFE B

Access OpenDART financial data and corporate filings via MCP. Analyze disclosures, financial statements, and XBRL data directly in your AI assistant.

★ 315 readstdio

promptwheel-ai-logbook

promptwheel-ai/logbook

✓SAFE B

Turn Git history into memory AI coding agents can use.

★ 35 readstdio

release-intel-mcp

barissozudogru/release-intel-mcp

✓SAFE B

Auditable release evidence from commits, pull requests, issues, and contributors between two Git refs, over MCP or CLI.

★ 33 readstdio

string-ai-mcp

usestring/string-ai-mcp

✓SAFE B

Model Context Protocol server for the Web Access API.

★ 35 readstdio

tanilo-mcp

TKCollective/tanilo-mcp

✓SAFE B

MCP server for Tanilo (formerly AgentOracle): connects MCP clients to the Tanilo API. npm package: agentoracle-mcp.

★ 33 readstdio

test-intel-mcp

barissozudogru/test-intel-mcp

✓SAFE B

Local test coverage intelligence for JavaScript and TypeScript: gaps, complexity, and practical test priorities over MCP or CLI.

★ 34 readstdio

Adguardctrl

lidless-labs/adguardctrl

✓SAFE B

One bad call can take down your DNS filtering. adguardctrl gates every AdGuard Home write behind confirm and destructive flags. CLI plus MCP adapter, no daemon.

★ 21 readstdio

comparedge-llm-cost

comparedge/llm-cost-mcp

✓SAFE B

MCP server: token cost math for LLM API calls, 69 models across 17 providers, prices verified by ComparEdge

★ 27 readstdio

comparedge-price-watch

comparedge/price-watch-mcp

✓SAFE B

MCP server: verified SaaS price-change history, watch-log for AI assistants, data by ComparEdge

★ 26 readstdio

firmauy-mcp-inspect

carlosplanchon/firmauy-mcp-inspect

✓SAFE B

Read-only MCP server that brings FirmaUY signature inspection to your AI assistant. Offline, no smart card, no signing, redacted by default.

★ 24 read

hubmesh

DemigodDSK/hubmesh

✓SAFE B

Centrality-aware GraphRAG retrieval planner — drop-in layer over any vector DB. Zero LLM in the query path; MCP server included.

★ 28 readstdio

Layout-debug-mcp

AntonChuraev99/Layout-debug-mcp

✓SAFE B

Point at a layer in a live UI (web DOM, Android Compose), drag it on the real screen, hand it to your AI agent via MCP

★ 26 readstdio

mcp-eval

cavi-ai/mcp-eval

✓SAFE B

🧐 Privacy-preserving MCP server evaluation: deterministic CI probe battery (18 probe kinds, readiness score, SARIF) plus production friction capture with findings that verify and close

★ 21 readstdio

mcp-server

negm17111995/mcp-server

✓SAFE B

Remote MCP server for hotel and flight search on MAQAMI (3M+ hotels). Search live rates, read hotel details, then send the customer a secure checkout link on book.maqami.co. Streamable HTTP, no API key.

★ 21 readstdio

DuckDuckGo MCP Server

ericthered926/duckduckgo-mcp-server

✓SAFE B

an mcp server to access DuckDuckGo

★ 12 readstdio

adsmart-app

ZenniTTy/adsmart-app

✓SAFE B

Gerencie suas campanhas do Google Ads conversando com o Claude. Extensão open source para o Claude Desktop (MCPB), 100% local, com prévia, confirmação e desfazer.

★ 18 read

agentRamen

palrajjp/agentRamen

✓SAFE B

Local-first codebase intelligence memory and task context for coding agents, via CLI, MCP, and local HTTP.

★ 110 readstdio

askjev

pZacca/askjev

✓SAFE B

Unofficial MCP server for Jev (Typesafe AI)

★ 11 readstdio

capitoline

marco-fabbri/capitoline

✓SAFE B

Self-hosted OpenAI-compatible gateway and MCP server over the official Claude Code, Codex and Antigravity CLIs, with a council of models

★ 14 readstreamable-http

chrischall-hemnet

chrischall/hemnet-mcp

✓SAFE B

Hemnet.se real estate for Claude: search, sold prices, listings & market stats

★ 110 readstdio

cloudscape-docs-mcp

prem676/cloudscape-docs-mcp

!CAUTION B

🌐 Enable seamless semantic search over AWS Cloudscape documentation for AI agents and coding assistants with this efficient MCP server.

★ 12 read

crawlora-mcp

Crawlora-org/crawlora-mcp

✓SAFE B

Hosted MCP server for structured public web data: 3,631 tools across 471 platform groups (search, maps, e-commerce, social, finance, app stores), returning clean JSON. Works with Claude, Cursor, VS Code and any MCP client.

★ 13 readstdio

Other risk hubs

By job

Questions

What does read-only mean here?
A server is listed here when its source declares at least one tool and every tool is classed read: no write tools and no destructive tools.
Is a read-only server always safe?
No. 913 are SAFE, 261 CAUTION and 446 BLOCK on this list. A tool list says what the tools do, not whether the surrounding code is clean, so a read-only server can still be BLOCK.
Why are some servers on no risk list?
615 servers declare no tools we can read, because they build the list at runtime. They cannot be called read-only, so they appear on none of the risk hubs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.