MCP servers · least privilege

Read-only MCP servers

1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/61

Verdicts · 1,620 servers

✓SAFE913!CAUTION261✕BLOCK446

Transports

A server can list more than one transport.

1,620 servers

1,441–1,464 of 1,620 · ranked by trust score, then stars

footprintjs

footprintjs/footPrint

✕BLOCK F

The flowchart pattern for backend code — self-explainable systems that AI can reason about. Causal traces, auto-generated tool descriptions, transactional state.

★ 2015 read

triumvirate

michaeljboscia/triumvirate

!CAUTION F

Five AI agents. One coordination layer. No relay server. Plus a trust layer that checks whether the review actually happened.

★ 116 readstreamable-http

tool-control-plane

Abhishek-chohan/tool-control-plane

✕BLOCK F

The unglamorous half of agent tooling: a gRPC control plane for sessions, machines, fenced writes, and capability-scoped keys. HTTP and MCP gateways; Python, TypeScript, and Go SDKs.

★ 07 readstdio

ThinkWatch

thinkwatchproject/thinkwatch

✕BLOCK F

Enterprise AI bastion host for secure AI API and MCP access, with unified proxying, RBAC, audit logs, rate limiting, and cost tracking across OpenAI, Anthropic, Gemini, and self-hosted LLMs.

★ 8142 readstreamable-http

Context

neuledge/context

✕BLOCK F

Local-first documentation for AI agents

★ 4173 readstdio

ue-mcp

db-lyon/ue-mcp

✕BLOCK F

Complete Unreal Engine development toolkit exposed as MCP tools.

★ 4074 readstdio

Task Orchestrator

jpicklyk/task-orchestrator

✕BLOCK F

Server-enforced workflow discipline for AI agents. An MCP server providing persistent work items, dependency graphs, quality gates, and actor attribution. Schemas define what agents must produce — the server blocks the call if they don't. Works with any MCP-compatible client.

★ 2076 readstdio

Context Lattice

sheawinkler/contextlattice

✕BLOCK F

The local-first intelligence layer that gives AI agents durable continuity, explainable retrieval, portable context, and verified learning across harnesses.

★ 1531 readstreamable-http

Linear Streamable

iceener/linear-streamable-mcp-server

✕BLOCK F

MCP Server for interacting with Linear API. Written in TypeScript, Node and Hono.dev

★ 711 readstreamable-http

Globalping

jsdelivr/globalping-mcp-server

✕BLOCK F

Remote MCP server that gives LLMs access to run network commands

★ 6411 readsse

Dense-Mem

markhuangai/dense-mem

!CAUTION F

Self-hosted AI agent memory server with MCP, evidence provenance, typed claims, conflict detection, embeddings, recall, PostgreSQL, and pgvector

★ 396 readstreamable-http

agentdeals

robhunter/agentdeals

!CAUTION F

Catalogue of developer infrastructure free tiers, startup credits and pricing, with side-by-side vendor comparisons for hosting, databases and AI APIs. Website, JSON API and MCP server, read by coding agents choosing a stack.

★ 2212 readstdio

typesafe-mcp

MarkChu-git/typesafe-mcp

✕BLOCK F

MCP server for TypeSafe AI's Jev: typed yes/no, choice and score answers with act / review / abstain gating.

★ 15 readstreamable-http

robopartpicker

brainbook0/robopartpicker

✕BLOCK F

Open robotics project discovery, bill-of-materials compilation and parts sourcing. Source-linked, evidence-first, live at robopartpicker.com.

★ 018 readstreamable-http

Reactuse

childrentime/reactuse

✕BLOCK F

115+ production-ready React Hooks for sensors, UI, state & browser APIs. Tree-shakable, SSR-safe, TypeScript-first. Used by Shopee, PDD & Ctrip. Inspired by VueUse.

★ 1,0613 readstdio

Get Gather

mcp-getgather/mcp-getgather

✕BLOCK F

Exoskeleton for autonomous assistant

★ 731 read

Aiquila

elgorro/aiquila

✕BLOCK F

Private AI for your Nextcloud — an MCP server (316 tools), a native Nextcloud app with chat and Coworkers, and one-command Hetzner deployment.

★ 382 readstdio

Glaux

cetusk/Glaux

✕BLOCK F

A Lightweight DAW for Making Music with AI

★ 133 readstreamable-http

CareLoop-AI

workatustadarshajay/CareLoop-AI

✕BLOCK F

The foundation flow accepts a doctor's note, uses a Gemini tool-calling agent to save each actionable item as a card in Postgres, and displays all saved cards in the frontend.

★ 06 readstreamable-http

Terravision

patrickchugh/terravision

✕BLOCK F

Professional cloud architecture diagrams with official AWS, Azure and GCP icons, from Terraform code or a plain JSON graph. MCP server + agent skill.

★ 1,6392 readsse

elementor-mcp

msrbuilds/elementor-mcp

✕BLOCK F

WordPress plugin that turns Elementor & WordPress into an MCP server. 500+ AI-ready tools for building, editing, and managing page designs programmatically.

★ 7332 readstreamable-http

Pepper

skwallace36/pepper

✕BLOCK F

iOS dynamic library MCP for agents

★ 1054 readstdio

Lilbee

tobocop2/lilbee

✕BLOCK F

The whole local AI stack in one executable: it runs and manages local AI models across every GPU, and it's a search engine you can talk to, with cited answers from your files, code, and the web. MCP server for coding agents, web crawler, TUI, CLI, REST API, Python library. No Ollama or LM Studio nee

★ 636 readstreamable-http

Knowledge Base

jeanibarz/knowledge-base-mcp-server

✕BLOCK F

This MCP server provides tools for listing and retrieving content from different knowledge bases.

★ 5422 readsse

Other risk hubs

By job

Questions

What does read-only mean here?
A server is listed here when its source declares at least one tool and every tool is classed read: no write tools and no destructive tools.
Is a read-only server always safe?
No. 913 are SAFE, 261 CAUTION and 446 BLOCK on this list. A tool list says what the tools do, not whether the surrounding code is clean, so a read-only server can still be BLOCK.
Why are some servers on no risk list?
615 servers declare no tools we can read, because they build the list at runtime. They cannot be called read-only, so they appear on none of the risk hubs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.