MCP servers · least privilege

Read-only MCP servers

1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/59

Verdicts · 1,620 servers

✓SAFE913!CAUTION261✕BLOCK446

Transports

A server can list more than one transport.

1,620 servers

1,393–1,416 of 1,620 · ranked by trust score, then stars

Keryx

actionhero/keryx

!CAUTION D

Keryx: The Fullstack TypeScript Framework for MCP and APIs

★ 354 readstreamable-http

Kindex

jmcentire/kindex

!CAUTION D

Knowledge index that learns from your conversations

★ 353 readstdio

memtomem-stm

memtomem/memtomem-stm

✕BLOCK D

Short-term memory proxy gateway with proactive memory surfacing for AI agents

★ 514 readsse

WebPieces TypeScript

deanhiller/webpieces-ts

✕BLOCK D
★ 42 read

obsidian-llm-wiki

Statutecontempt951/obsidian-llm-wiki

✕BLOCK D

Convert your Obsidian markdown vault into a six-persona MCP team for local LLM tools to provide cited, accurate insights.

★ 15 readstdio

vetagent

jakegu1/vetagent

✕BLOCK D

VetAgent — token risk intelligence MCP for AI agents. Cloudflare Worker deployment. Assess token risk (liquidity/honeypot/rug) and return actionable low/medium/high verdict. Remote MCP at https://vetagent.dev/mcp.

★ 01 readstreamable-http

Kuvasz

kuvasz-uptime/kuvasz

✕BLOCK F

Kuvasz (pronounce as [ˈkuvɒs]) is an open-source uptime and SSL monitoring service, with multiple notification channels, status pages, IAC support via YAML, Prometheus integration, a complete REST API and many more!

★ 6361 read

Salesforce

salesforcecli/mcp

✕BLOCK D

MCP Server for interacting with Salesforce instances

★ 48315 readstdio

U.S. Census Bureau Data API

uscensusbureau/us-census-bureau-data-api-mcp

✕BLOCK D

The U.S. Census Bureau Data API MCP connects AI Assistants with official Census Bureau statistics.

★ 9811 readstdio

AI Agents Orchestrator

hoangsonww/ai-agents-orchestrator

✕BLOCK D

Intelligent orchestration system that coordinates multiple AI coding assistants (Claude, Codex, Gemini CLI, Copilot CLI) to collaborate on complex software development tasks via REPL or a Vue/Nuxt UI dashboard. Also includes an Agentic Team runtime with role-based multi-agent open communication & le

★ 9012 read

Ctxo

alperhankendi/ctxo

✕BLOCK F

MCP server for AI coding agents. Instead of reading files one by one, your agent gets dependency graphs, git intent, blast radius, and change health in a single call. Works with any language deep analysis for TypeScript,Java, Go, and C#.

★ 6914 readstdio

Mcp Logic

angrysky56/mcp-logic

✕BLOCK D

Fully functional AI Logic Calculator utilizing Prover9/Mace4 via Python based Model Context Protocol (MCP-Server)- tool for Windows, Linux, Claude App etc

★ 464 readstdio

Congress

amurshak/congressmcp

!CAUTION F

An MCP server allowing AI agents and MCP clients to interface with the Congress.gov API

★ 3324 readstreamable-http

openswissdata

cammac-creator/openswissdata

✕BLOCK F

Swiss federal reference data for AI agents: customs tariff (TARES), FINMA register and warnings list, NOGA/NACE/ISIC crosswalks. Free MCP server, no key. Signed dataset files.

★ 04 readstdio

bagel

Extelligence-ai/bagel

✕BLOCK F

Query robotics, drone, and IoT data in plain English through an MCP server, with an intelligent edge data reduction pipeline that keeps only the data that matters.

★ 3971 readsse

HomeButler

higangssh/homebutler

✕BLOCK F

🏠 Tells you what changed on your server — only what's worth telling. Single Go binary, no database, nothing running on the machines it watches. MCP server built in.

★ 2981 readstdio

Cynical Sally

w1ckedxt/cynical-sally

✕BLOCK F

Brutally honest senior-engineer code reviews for Claude Code, Cursor & Windsurf - and your terminal. Scores, evidence-backed issues, usable fixes.

★ 968 readstdio

TAM

gvaibhav/tam-mcp-server

✕BLOCK F

A comprehensive Model Context Protocol (MCP) server for market sizing analysis, TAM/SAM calculations, and industry research. Built with TypeScript, Express.js, and following the MCP specification.

★ 3668 readsse

Comfy Cozy

josephoibrahim/comfy-cozy

✕BLOCK F

Say 'dreamier' and your ComfyUI workflow shifts — instantly, reversibly. An AI co-pilot for VFX artists: zero-LLM recipes (dreamier/sharper/faster), 133 MCP tools, EXR-aware vision, workflow.lock provenance, full undo, native sidebar, 5 swappable brains (Claude, GPT, Gemini, Ollama, Nemotron).

★ 252 readstdio

mcp-web-validator

AKzar1el/mcp-web-validator

✕BLOCK F

W3C HTML/CSS Validator and Technical SEO Audit MCP Server. Part of the DigestSEO (https://digestseo.com) suite.

★ 98 readstdio

skgate

helv-io/skgate

✕BLOCK F

Any MCP server. Anywhere. An OAuth-protected MCP gateway that can also run the servers, plus SI provider proxying with model aliases, and your Grok subscription as an OpenAI-compatible API with no API key.

★ 91 readstreamable-http

agenda-intelligence-md

vassiliylakhonin/agenda-intelligence-md

✕BLOCK F

Deterministic evidence-packet checks for AI-generated claims: references, quotes, numbers, and support gaps. CLI, Python, MCP, and review adapters.

★ 817 readstdio

dead-letter

BigCactusLabs/dead-letter

✕BLOCK F

Convert .eml email exports to Markdown with YAML front matter

★ 85 readstdio

gatherthread

TH060419/gatherthread

✕BLOCK F

GatherThread 共序:本地 AI 编程 Agent 多人联机协作、实时共享上下文。Self-hostable collaboration for local AI coding agents, Codex Desktop connector & DeepSeek Harness plugin.

★ 61 read

Other risk hubs

By job

Questions

What does read-only mean here?
A server is listed here when its source declares at least one tool and every tool is classed read: no write tools and no destructive tools.
Is a read-only server always safe?
No. 913 are SAFE, 261 CAUTION and 446 BLOCK on this list. A tool list says what the tools do, not whether the surrounding code is clean, so a read-only server can still be BLOCK.
Why are some servers on no risk list?
615 servers declare no tools we can read, because they build the list at runtime. They cannot be called read-only, so they appear on none of the risk hubs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.