MCP servers · least privilege

Read-only MCP servers

1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/56

Verdicts · 1,620 servers

✓SAFE913!CAUTION261✕BLOCK446

Transports

A server can list more than one transport.

1,620 servers

1,321–1,344 of 1,620 · ranked by trust score, then stars

acqpath-distribution

reflectme-source/acqpath-distribution

✕BLOCK D

Check declared content rights before RAG, AI input, summarization, training or indexing. Signed RSL evidence via HTTP x402; no legal clearance.

★ 01 readstreamable-http

aga-mcp-server

attestedintelligence/aga-mcp-server

✕BLOCK D

Signed decision records for agent vendors facing customer evidence reviews. Public reference gateway and static verifier; pre-pilot, with documented limits.

★ 011 readstdio

AgentKit

Yacine-ai-tech/AgentKit

✕BLOCK D

Governed MCP server and agent runtime: signed action approvals, typed tool effects and audit logs for Claude Desktop, Cursor and custom agents.

★ 01 readsse

awesome-ai-red-teaming-jp

Ajay77187718/awesome-ai-red-teaming-jp

✕BLOCK D

整理された日本語のAIレッドチーミング情報集。攻撃手法、ツール、規制、防御、論文をまとめて学べるリソース集

★ 04 readstdio

base-http402-extractor-api

psicossz29-netizen/base-http402-extractor-api

✕BLOCK D

Autonomous HTTP 402 Web-to-Markdown API & MCP Server powered by Base L2 micropayments (0.05 USDC).

★ 03 readstdio

canon

moonlight-lupin/canon

✕BLOCK D

Local-first, multilingual church system: plan the service, print the bulletin, project the slides, keep members, rotas, records and the church's books. Runs on an office PC or Docker. AI assistants such as Claude connect through a permission-controlled MCP server.

★ 013 readstreamable-http

Claudex

Mcalesteryahoo411/Claudex

✕BLOCK D

Connect Claude Code interfaces to Codex and native Claude models using a local bridge.

★ 01 read

dayze

gohluke/dayze-mcp

✕BLOCK D

Dayze gives connected AI tools Life Context: your people, plans and memories in a private, correctable record. Hosted MCP (OAuth): https://dayze.com/api/mcp

★ 014 readstdio

globalion-video-render

globalion/video-render-mcp

✕BLOCK D

MCP server that renders Hyperplexed-style motion-graphics MP4s from a script. Free msedge-tts voice, Remotion animations, no watermark. Sign in with Google, get an API key, paste the URL into Claude Desktop.

★ 02 readstreamable-http

hallucc-mcp

fredyee/hallucc-mcp

✕BLOCK D

MCP server for AI hallucination detection & agent safety — verify claims, guard prompts, gate CUA actions

★ 05 readstdio

jorgex-stack

jorgehn98/jorgex-stack

✕BLOCK D

Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI y OpenCode

★ 01 readstreamable-http

juridico-pt

linofcp007/juridico-pt

✕BLOCK D

Advogado pessoal e empresarial em Portugal — plugin Claude Code + servidor MCP (referencias, templates, playbooks, checklists e calculadoras juridicas). PT/EN.

★ 038 readstdio

ko-qmd

tak-bro/ko-qmd

✕BLOCK D

Local hybrid search for Korean Markdown notes & Obsidian vaults (BM25 + Hangul bigram + Qwen3 + rerank, MCP/CLI/SDK) · 한국어 마크다운 로컬 검색

★ 05 readstdio

leanix-agent

Knuckles-Team/leanix-agent

✕BLOCK D
★ 01 readsse

mac-voice-mcp

jeet0007/mac-voice-mcp

✕BLOCK D

Talk with Claude out loud on your Mac — on-device speech with whisper.cpp. An MCP server.

★ 02 readstdio

mcp-dotnet

jgbright/mcp-dotnet

✕BLOCK D

Two MCP stdio servers in .NET 10: Microsoft Teams (teams, channels, chats, messages, search) via Microsoft Graph, and Azure DevOps (work items, pull requests, pipelines, repos, search) via its REST API. Interactive Entra ID sign-in instead of PATs; read-only by default with opt-in write and send gat

★ 01 read

portainer-agent

Knuckles-Team/portainer-agent

✕BLOCK D

Portainer - Manage your Portainer instance through the Portainer Agent/MCP!

★ 02 readsse

publedge

snapsynapse/publedge

✕BLOCK D

Open recordkeeping protocol for fact-specific written interpretations between two parties: JIAs, RMAs, no-action letters, private letter rulings, advisory opinions. Drafting in public.

★ 06 readstdio

sonovault

rekordcloud/sonovault-mcp

✕BLOCK D

MCP server for the SonoVault music metadata API. Search 90M+ tracks, artists, and releases from AI assistants.

★ 015 readstdio

ugc-vz-neu

shufflethis/ugc-vz-neu

✕BLOCK D

Kostenloses UGC-Creator-Verzeichnis für DACH – echte Creator mit Portfolio- und Social-Nachweisen. Next.js, REST API v1, MCP-Server (ugc-vz-mcp) für AI-Agents. Keine Provision, keine KI-Avatare.

★ 04 readstreamable-http

vision-relay

nan1010082085/claude-plugins

✕BLOCK D

跨环境 AI CLI 插件统一仓库 - Claude Code / Codex CLI / Cursor 等插件集合

★ 01 read

voicelayer

EtanHey/voicelayer

✕BLOCK D

Voice I/O MCP for AI coding agents — local TTS + STT, 2 tools (`voice_speak`, `voice_ask`) with ToolAnnotations

★ 02 readstdio

Context7

upstash/context7-mcp

!CAUTION D

Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

★ 62,5103 readstdio

Context7

upstash/context7

!CAUTION D

Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

★ 62,1903 readstdio

Other risk hubs

By job

Questions

What does read-only mean here?
A server is listed here when its source declares at least one tool and every tool is classed read: no write tools and no destructive tools.
Is a read-only server always safe?
No. 913 are SAFE, 261 CAUTION and 446 BLOCK on this list. A tool list says what the tools do, not whether the surrounding code is clean, so a read-only server can still be BLOCK.
Why are some servers on no risk list?
615 servers declare no tools we can read, because they build the list at runtime. They cannot be called read-only, so they appear on none of the risk hubs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.