MCP servers · least privilege

Read-only MCP servers

1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/45

Verdicts · 1,620 servers

✓SAFE913!CAUTION261✕BLOCK446

Transports

A server can list more than one transport.

1,620 servers

1,057–1,080 of 1,620 · ranked by trust score, then stars

HotClip

xixihhhh/hotclip

!CAUTION B

免费开源的 AI 剪辑 / 直播切片工具:长视频、直播回放、播客一键切成爆款竖屏短视频,直发抖音/快手/B站/小红书/视频号——AI 找高光金句、弹幕热度进爆点判断、自动加字幕、横屏转竖屏,本地运行无水印不上传 | Free open-source Opus Clip alternative, 100% local: AI clips long videos & livestream VODs into viral 9:16 shorts for TikTok & YouTube Shorts. No credits, no watermark, no uploads. Win/macOS/L

★ 3013 read

WeLink

runzhliu/welink

!CAUTION B

🔍微信聊天数据分析的本地化AI-agent(Docker/Windows/MacOS) · AI分身 / 大模型分析 / 好友排行 / 词云 / 情感趋势 / 群聊画像

★ 2873 read

Repowire

prassanna-ravishankar/repowire

!CAUTION B

May the agents talk . Connect Claude Code, Opencode, Codex, Pi across projects, across machines and with your telegram

★ 2641 readstdio

Wxflows

ibm/wxflows

!CAUTION B

Examples and tutorials for building AI applications with watsonx.ai Flows Engine

★ 1181 readstdio

Cryo

z80dev/cryo-mcp

!CAUTION B

A Python package for accessing Cryo datasets via Claude Code

★ 9110 read

Ops

heht571/ops-mcp-server

!CAUTION B

服务器、网络设备巡检和运维MCP工具

★ 5912 readstdio

Mocxykit

shunseven/mocxykit

!CAUTION B

This is an Frontend development service middleware that can be used with webpack and vite. Its main function is to visualize the configuration, manage http(s)-proxy, and mock data.

★ 391 readsse

AI DirScan

elitewa/ai_dirscan

!CAUTION B

可用于AI进行自动目录扫描的MCP辅助工具

★ 362 readsse

Hyades

apology-is-policy/hyades

!CAUTION B

Unicode/ASCII Mathematical Typesetting Engine with LaTeX Input, VSCode Integration, MCP server, and Automatic Rendering into Source Code Comments

★ 302 readstreamable-http

CSS Noop Checker

purupurupu/css-noop-checker

!CAUTION B

Chrome DevTools extension that detects CSS properties with no effect

★ 253 readstdio

RTFM

roomi-fields/rtfm

!CAUTION B

The open retrieval layer for AI coding agents. Indexes code, docs, legal, research, data — 22 parsers (incl. EPUB, DOCX, ODT), FTS5 + semantic search, knowledge graph. Serves surgical context via MCP. Open source, local, free.

★ 258 readstdio

dsh-skills-anywhere

noteflowai/dsh-skills-anywhere

!CAUTION B

Check Agent Skills before reuse: find missing local resources in browser or CI, review pinned examples, and serve skills through DeepSeek Harness or MCP.

★ 69 readstdio

echelongraph-mcp

echelongraph/echelongraph-mcp

!CAUTION B

MCP server for CVE intelligence: 16 read-only tools for CVE records, CISA KEV, EPSS history, exploits, fix guidance as sources state it, version, SBOM and lockfile checks, vendor advisories, and per-CVE exposure from Shodan data (© Shodan). Free and keyless.

★ 213 readstdio

6F

Xxx91n/6F

!CAUTION B

Macro + micro engineering-content audit for git-healthy repositories — Claude Code Agent Plugin (Hub-of-Facts + federated adjudication, evidence gates, verifiable receipts). Preview: 3 of 5 capabilities live.

★ 01 read

indexagentica-mcp

Drudley/indexagentica-mcp

!CAUTION B

Read-only remote MCP server (Streamable HTTP) and REST search for indexagentica.com

★ 04 readstreamable-http

Ghidra

bethington/ghidra-mcp

!CAUTION B

Ghidra MCP Server — 200+ MCP tools for AI-powered reverse engineering. GUI plugin + headless server, lazy tool loading, convention enforcement, batch operations, Ghidra Server integration, and Docker deployment.

★ 3,9483 readstdio

Code Interpreter API

shroominic/codeinterpreter-api

!CAUTION B

👾 Open source implementation of the ChatGPT Code Interpreter

★ 3,8441 read

Azure DevOps

microsoft/azure-devops-mcp

!CAUTION B

The MCP server for Azure DevOps, bringing the power of Azure DevOps directly to your agents.

★ 2,0273 readstdio

LLM Wiki

lucasastorian/llmwiki

!CAUTION B

Open Source Implementation of Karpathy's LLM Wiki. Upload documents, connect your Claude account via MCP, and have it write your wiki !

★ 1,6432 readstreamable-http

Mem0

mem0ai/mem0-mcp

!CAUTION B
★ 6621 readstdio

TrueMemory

buildingjoshbetter/truememory

✓SAFE B

The memory your AI should have had from the start. Automatic capture, automatic recall, 100% local. One SQLite file, zero cloud. Works with Claude Code, Claude CLI, Cursor, Codex CLI, Gemini CLI.

★ 3791 readstdio

Notion

awkoy/notion-mcp-server

!CAUTION B

Notion MCP server for Claude, Cursor, ChatGPT & Claude Desktop. Connect AI agents to Notion via Model Context Protocol — pages, databases, blocks, comments, files.

★ 1731 readstdio

Outline Connector

vortiago/mcp-outline

!CAUTION B

A Model Context Protocol (MCP) server enabling AI assistants to interact with Outline documentation services.

★ 1561 readsse

Vera

lemon07r/vera

!CAUTION B

Local code search combining BM25, vector similarity, and cross-encoder reranking. Parses 60+ languages with tree-sitter, runs entirely offline, and returns structured results with file paths, line ranges, and symbol metadata. Built in Rust.

★ 1186 read

Other risk hubs

By job

Questions

What does read-only mean here?
A server is listed here when its source declares at least one tool and every tool is classed read: no write tools and no destructive tools.
Is a read-only server always safe?
No. 913 are SAFE, 261 CAUTION and 446 BLOCK on this list. A tool list says what the tools do, not whether the surrounding code is clean, so a read-only server can still be BLOCK.
Why are some servers on no risk list?
615 servers declare no tools we can read, because they build the list at runtime. They cannot be called read-only, so they appear on none of the risk hubs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.