MCP servers · least privilege

Read-only MCP servers

1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/52

Verdicts · 1,620 servers

✓SAFE913!CAUTION261✕BLOCK446

Transports

A server can list more than one transport.

1,620 servers

1,225–1,248 of 1,620 · ranked by trust score, then stars

agent-skills

youdotcom-oss/agent-skills

✕BLOCK D

You.com skills and plugins for web search, content extraction, research, finance, and integration discovery, helping AI agents build with up-to-date web context.

★ 861 readstreamable-http

Django ORM Lens

frowningdev/django-orm-lens

✕BLOCK D

Django ER diagrams, N+1 detection, schema drift & migration-risk linting — in VS Code, a CLI and an MCP server. Static analysis: no database, no django.setup(). Free & MIT.

★ 8413 readstdio

Pdfmux

nameetp/pdfmux

✕BLOCK D

PDF extraction that audits its own output — and certifies any other extractor's, catching pages they silently dropped. Verify signed manifests offline: free, MIT, no account. 0.903 on opendataloader-bench, #2 of 8 engines. 7-tool MCP server.

★ 838 readstdio

Paper Format Agent

zxyasfas/paper_format_agent

✕BLOCK D

DOCX formatter for academic papers with a content-fingerprint guard: proves your text is never altered, only the formatting. Also installable as an agent skill. 毕业论文、学位论文的 Word 自动排版:按格式要求改字体字号、行距、缩进、标题和题注;指纹校验保证只改格式、不动正文,也可做格式检查评分。

★ 813 readstdio

AutoMobile

zillow/auto-mobile

✕BLOCK D

Mobile automation suite of tools including an MCP and libraries for test authoring & execution

★ 8016 readsse

Mcp Gateway

aarora79/mcp-gateway

✕BLOCK D

MCP Gateway and Registry

★ 802 read

Kompl

tuirk/kompl

✕BLOCK D

A compounding LLM-wiki, best fit as a personal second brain that organizes and updates itself as it grows, zero upkeep.

★ 784 readstdio

Masquerade

postralai/masquerade

✕BLOCK D

The Privacy Firewall for LLMs

★ 771 read

Pond

tenequm/pond

!CAUTION D

Lossless storage and search for AI agent sessions, across every agentic client.

★ 771 readstdio

Minecraft

fundamentallabs/minecraft-mcp

✕BLOCK D

MCP server for minecraft

★ 762 readstdio

Agent Orchestrator

haohao-end/mcp-agent

✕BLOCK D

A modular Python framework implementing the Model Context Protocol (MCP). It features a standardized client-server architecture over StdIO, integrating LLMs with external tools, real-time weather data fetching, and an advanced RAG (Retrieval-Augmented Generation) system.

★ 754 readstdio

Unifai SDK

unifai-network/unifai-sdk-js

✕BLOCK D

unifai-sdk-js is the Javascript/Typescript SDK for Unifai, an AI native platform for dynamic tools and agent to agent communication.

★ 752 readstdio

MyKG

senolisci/mykg

✕BLOCK D

MyKG Knowledge Graph Engine: Turn raw files into knowledge graphs with induced ontology

★ 7415 readstdio

OpenMSX

nataliapc/mcp-openmsx

✕BLOCK D

A Model Context Protocol (MCP) server for automating openMSX emulator instances. This server provides comprehensive tools for MSX software development, testing, and automation through standardized MCP protocols.

★ 738 readstdio

Image Gen

lansespirit/image-gen-mcp

✕BLOCK D

An MCP server that integrates with gpt-image-1 & Gemini imagen4 model for text-to-image generation services

★ 702 readsse

Chucknorris

pollinations/chucknorris

✕BLOCK D

⚡ C̷h̷u̷c̷k̷N̷o̷r̷r̷i̷s̷ MCP server: Helping LLMs break limits. Provides enhancement prompts inspired by elder-plinius' L1B3RT4S

★ 692 readstdio

Debugg AI

debugg-ai/debugg-ai-mcp

✕BLOCK D

Zero-Config, Fully AI-Managed End-to-End Testing for all code gen platforms.

★ 6810 readstdio

Netlify

netlify/netlify-mcp

✕BLOCK D

Netlify's Official MCP server

★ 673 readstreamable-http

React Native

mrnitro360/react-native-mcp

✕BLOCK D

A Model Context Protocol (MCP) server providing comprehensive guidance and best practices for React Native development based on official React Native documentation.

★ 6617 readstdio

Calculator

huhabla/calculator-mcp-server

✕BLOCK D

A Model Context Protocol (MCP) server that provides Claude with advanced mathematical calculation capabilities

★ 6323 read

Iron Manus

dnnyngyen/ironmanus-mcp

✕BLOCK D

Iron Manus MCP

★ 6322 readstdio

Iron Manus

dnnyngyen/iron-manus-mcp

✕BLOCK D

Iron Manus MCP

★ 6322 readstdio

Weibo

qinyuanpei/mcp-server-weibo

✕BLOCK D

基于 Model Context Protocol 的微博数据接口服务器 - 实时获取微博用户信息、动态内容、热搜榜单、粉丝关注数据。支持用户搜索、内容搜索、话题分析,为 AI 应用提供完整的微博数据接入方案。

★ 631 readstdio

Mailgun

mailgun/mailgun-mcp-server

✕BLOCK D

Implementation of Model Context Protocol server for Mailgun APIs

★ 621 readstdio

Other risk hubs

By job

Questions

What does read-only mean here?
A server is listed here when its source declares at least one tool and every tool is classed read: no write tools and no destructive tools.
Is a read-only server always safe?
No. 913 are SAFE, 261 CAUTION and 446 BLOCK on this list. A tool list says what the tools do, not whether the surrounding code is clean, so a read-only server can still be BLOCK.
Why are some servers on no risk list?
615 servers declare no tools we can read, because they build the list at runtime. They cannot be called read-only, so they appear on none of the risk hubs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.