MCP servers · least privilege

Read-only MCP servers

1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/60

Verdicts · 1,620 servers

✓SAFE913!CAUTION261✕BLOCK446

Transports

A server can list more than one transport.

1,620 servers

1,417–1,440 of 1,620 · ranked by trust score, then stars

xgen-dex-cli

PlateerLab/xgen-dex-core

✕BLOCK F

XGEN Dex — 데스크톱 · CLI · VSCode 확장이 하나의 코어를 공유하는 저장소

★ 210 readstdio

Hookdeck

hookdeck/hookdeck-cli

✕BLOCK F

CLI for Hookdeck: forward webhooks to localhost (ngrok alternative), manage and query Event Gateway resources (sources, connections, destinations, events), run the MCP server for AI agents. Free for dev.

★ 3641 read

Russian Marketplace Data

vladimir-human/ru-marketplace-mcp

✕BLOCK F

Одиннадцать маркетплейсов и недвижимость Циан как MCP-серверы: Wildberries, Ozon, Яндекс Маркет, Детский мир, Авито, AliExpress, Taobao, Мегамаркет, Lamoda, DNS, Ситилинк, Циан. Плюс сравнение цен по всем товарным источникам одним вызовом. Только чтение, ключи не нужны.

★ 1361 readstdio

ru-marketplace-mcp

Vladimir-Human/ru-marketplace-mcp

✕BLOCK F

Одиннадцать маркетплейсов и недвижимость Циан как MCP-серверы: Wildberries, Ozon, Яндекс Маркет, Детский мир, Авито, AliExpress, Taobao, Мегамаркет, Lamoda, DNS, Ситилинк, Циан. Плюс сравнение цен по всем товарным источникам одним вызовом. Только чтение, ключи не нужны.

★ 1321 readstdio

VibeCraft

amenti-labs/vibecraft

✕BLOCK F

AI-driven vibe based Minecraft building via MCP. Describe a build, watch your agent construct it in Minecraft.

★ 10145 readstdio

tianshu-mcp

lanlan0811/tianshu-mcp

✕BLOCK F

天枢harness × AI-Agent 编排 MCP server:调度外部 Agent 干活,用运行时证据做客观验收,不通过自动返修闭环。

★ 107 readstdio

designesy-org

LE-VAI/designesy-org

!CAUTION F

Scores any URL against a 44-check design contract (A-F grade), validates DTCG tokens, and checks drift and AI readiness.

★ 018 readstdio

tw-market-live-data-intelligence

SmartyJohnway/tw-market-live-data-intelligence

✕BLOCK F

Local-first Taiwan market evidence workbench for AI agents — TWSE/TPEx, persistent Watchlists, governed MCP, auditable evidence, explicit execute-once.

★ 01 readstdio

fastCRW

fastcrw/crw

✕BLOCK F

Fast, lightweight Firecrawl/Tavily alternative in Rust. Web scraper, crawler & search API with MCP server for AI agents. Drop-in Firecrawl-compatible API (/scrape, /crawl, /search). 2.3x faster than Tavily, 1.5x faster than Firecrawl in 1K-URL benchmarks. 6 MB RAM, single binary. Self-host or use ma

★ 1,1141 readstdio

Unreal Editor

db-lyon/ue-mcp

✕BLOCK F

Complete Unreal Engine development toolkit exposed as MCP tools.

★ 3824 readstdio

www-project-agent-memory-guard

OWASP/www-project-agent-memory-guard

✕BLOCK F

OWASP Foundation web repository

★ 1835 readstdio

Reshapr

reshaprio/reshapr

✕BLOCK F

The open source, no-code MCP Server for AI-Native API Access

★ 1282 read

Gofannon

the-ai-alliance/gofannon

✕BLOCK F

A web app for rapidly prototyping AI agents and the lightweight web UIs that wrap them—build flows, preview interactions, and share agent-driven experiences without lock-in.

★ 684 read

Auth Step-by-Step

christian-posta/mcp-auth-step-by-step

✕BLOCK F

Step by step walkthrough of an MCP Authorization implementation

★ 621 read

Kollektiv

alexander-zuev/kollektiv-mcp

✕BLOCK F

Kollektiv MCP enables you to chat with and query your own documents directly from IDEs and MCP clients. Private, secure, and integrated into your favorite code editor

★ 611 read

proximo

john-broadway/proximo

✕BLOCK F

The Proxmox MCP you can hand the keys. All four products: PVE, PBS, PMG, PDM.

★ 522 readstdio

Adaptive Graph Of Thoughts

saptadey/adaptive-graph-of-thoughts-mcp-server

✕BLOCK F

LLM Reasoning Framework for Scientific Research

★ 3213 readstdio

Inference Gateway CLI

inference-gateway/cli

✕BLOCK F

A Git-first CLI coding agent that turns ideas, issues, and tasks into real code changes. It can run remotely from your mobile phone or automate your computer.

★ 78 readstreamable-http

ai-nexus

mosesy5688-cell/ai-nexus

✕BLOCK F

Structured AI-entity discovery, evidence, and identity layer for agents.

★ 111 readstreamable-http

Peekaboo

steipete/peekaboo

✕BLOCK F

Peekaboo is a macOS CLI & optional MCP server that enables AI agents to capture screenshots of applications, or the entire system, with optional visual question answering through local or remote AI models.

★ 5,1941 read

Xiaozhi ESP32 Server

joey-zhou/xiaozhi-esp32-server-java

✕BLOCK F

小智ESP32的Java企业级管理平台,提供设备监控、音色定制、角色切换和对话记录管理的前后端及服务端一体化解决方案

★ 1,3575 read

AgentChat

shy2593666979/agentchat

✕BLOCK F

AgentChat 是一个基于 LLM 的智能体交流平台,内置默认 Agent 并支持用户自定义 Agent。通过多轮对话和任务协作,Agent 可以理解并协助完成复杂任务。项目集成 LangChain、Function Call、MCP 协议、RAG、Memory、HITL、Skill、Milvus 和 ElasticSearch 等技术,实现高效的知识检索与工具调用,使用 FastAPI 构建高性能后端服务。

★ 9022 readstdio

Search Scrape

devshero/search-scrape

✕BLOCK F

A unified web extraction and stateful automation engine for AI. Replaces heavy testing frameworks with token-optimized browser control, deep research, and HITL.

★ 707 read

Curion

geanatz/curion

!CAUTION F

Curion is a project-local memory layer for AI coding agents, published as an MCP server for Claude Code, Codex, OpenCode, and other MCP clients.

★ 3311 readstdio

Other risk hubs

By job

Questions

What does read-only mean here?
A server is listed here when its source declares at least one tool and every tool is classed read: no write tools and no destructive tools.
Is a read-only server always safe?
No. 913 are SAFE, 261 CAUTION and 446 BLOCK on this list. A tool list says what the tools do, not whether the surrounding code is clean, so a read-only server can still be BLOCK.
Why are some servers on no risk list?
615 servers declare no tools we can read, because they build the list at runtime. They cannot be called read-only, so they appear on none of the risk hubs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.