MCP servers · least privilege

Read-only MCP servers

1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/57

Verdicts · 1,620 servers

✓SAFE913!CAUTION261✕BLOCK446

Transports

A server can list more than one transport.

1,620 servers

1,345–1,368 of 1,620 · ranked by trust score, then stars

Media Crawler

mcp-service/media-crawler-mcp-service

✕BLOCK D

一个功能强大的多平台自媒体数据采集MCP工具,支持B站、小红书、抖音、快手、抖音微博、贴吧、知乎等主流平台的公开信息抓取。

★ 773 read

godot-agent

aigengame/godot-agent

!CAUTION D

Godot automation for AI agents to build and verify projects through a CLI, Agent Skill, or MCP server, with structured results, headless operations, and live runtime control.

★ 461 readstdio

rustyhand

Tamang4607/rustyhand

✕BLOCK D

Build an open-source Rust agent OS for autonomous Telegram agents, with one binary, APIs, and a tested Rust codebase

★ 17 read

LetsFG

letsfg/letsfg

✕BLOCK D

Agent-native flight & hotel search and booking — MCP server, CLI, and Python/JS SDKs. Every airline in the world, major booking sites and OTAs, with per-flight reliability history.

★ 2,11014 readstdio

Elementor

msrbuilds/elementor-mcp

✕BLOCK D

WordPress plugin that turns Elementor & WordPress into an MCP server. 500+ AI-ready tools for building, editing, and managing page designs programmatically.

★ 7262 readstreamable-http

Flow Nexus

ruvnet/flow-nexus

✕BLOCK D

Flow Nexus is the first competitive agentic platform built entirely on MCP. Deploy autonomous AI swarms, train neural networks, and compete in coding challenges while earning rUv credits. Transform agentic engineering mastery into lived experience through gamified cloud development where agents sp

★ 1053 read

All About AI

allaboutai-yt/mcp-servers

✕BLOCK D

All About AI MCP Servers

★ 812 readstdio

VideoDB Agent Toolkit

video-db/agent-toolkit

✕BLOCK D

An open-source agent toolkit that auto-syncs SDK versions, docs, and examples—built for seamless integration with LLMs, and AI agents ( MCP compatible).

★ 484 readstdio

container-manager-mcp

Knuckles-Team/container-manager-mcp

✕BLOCK D

Manage containers on docker, podman, compose, and docker swarm through an MCP Server for Agentic AI

★ 62 readsse

mcp-framework

QuantGeekDev/mcp-framework

!CAUTION D

The Typescript MCP Framework

★ 93013 readsse

Mcp Framework

quantgeekdev/mcp-framework

!CAUTION D

The Typescript MCP Framework

★ 92913 readsse

Spec Workflow

kingkongshot/specs-workflow-mcp

✕BLOCK D

Intelligent spec workflow management MCP server

★ 1271 readstdio

Package Docs

sammcj/mcp-package-docs

✕BLOCK D

An MCP server that provides LLMs with efficient access to package documentation across multiple programming languages

★ 7913 readstdio

Brain

mordechaipotash/brain-mcp

✕BLOCK D

The recorder for your AI conversations — local-first MCP memory that keeps byte-exact copies of your Claude Code, Codex and Pi sessions (Claude Code deletes its own after 30 days) and answers with a citation or abstains. DuckDB.

★ 785 readstdio

WeChat Claude Code

dcatfly/weixin_claude_code

✕BLOCK D

WeChat Channel plugin for Claude Code — bidirectional messaging between WeChat and Claude Code via MCP protocol

★ 564 readstdio

WEBGhosting

yranjan06/webghosting-mcp

✕BLOCK D

Intelligent stealth browser MCP server for AI agents with 30 tools, 22 anti fingerprint scripts, and LLM powered extraction. Works seamlessly with Cursor, Claude, VS Code, and any OpenAI compatible LLM.

★ 323 readsse

YaraFlux

threatflux/yaraflux

✕BLOCK D

A yara based MCP Server

★ 231 readstdio

pattern-mcp

donaldrichard19-LVD/pattern-mcp

✕BLOCK D

Pattern checks a coding agent's UI decisions against your own design system before it builds, whether that lives in code or in Figma. It helps the agent reuse what the product already has and build only what is actually missing. An opt-in enforcement boundary can make that check required, and every

★ 91 readstdio

Marlo

KarthikSubramanian07/Marlo

✕BLOCK D

Fixes accessibility violations and proves it. Multi-engine WCAG detection routed by measured accuracy, verified minimal-diff repairs, and a published error rate.

★ 24 readstreamable-http

IDA

jtsylve/ida-mcp

✕BLOCK D

A headless MCP server for IDA Pro and Ghidra

★ 1693 readstdio

Ripgrep

mcollina/mcp-ripgrep

✕BLOCK D

An MCP server to wrap ripgrep

★ 755 readstdio

GreptimeDB

greptimeteam/greptimedb-mcp-server

✕BLOCK D

A Model Context Protocol (MCP) server for GreptimeDB

★ 291 readstdio

vault-cortex

aliasunder/vault-cortex

✕BLOCK D

Standalone MCP server for Obsidian vaults — hybrid search, structured memory, task management, files, OAuth 2.1. Run locally, self-host, or one-click deploy for remote access.

★ 266 readstreamable-http

corpus

ryanjdillon/corpus

✕BLOCK D

Semantic search and structured query over your own content

★ 06 readstreamable-http

Other risk hubs

By job

Questions

What does read-only mean here?
A server is listed here when its source declares at least one tool and every tool is classed read: no write tools and no destructive tools.
Is a read-only server always safe?
No. 913 are SAFE, 261 CAUTION and 446 BLOCK on this list. A tool list says what the tools do, not whether the surrounding code is clean, so a read-only server can still be BLOCK.
Why are some servers on no risk list?
615 servers declare no tools we can read, because they build the list at runtime. They cannot be called read-only, so they appear on none of the risk hubs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.