MCP servers · least privilege

Read-only MCP servers

1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/63

Verdicts · 1,620 servers

✓SAFE913!CAUTION261✕BLOCK446

Transports

A server can list more than one transport.

1,620 servers

1,489–1,512 of 1,620 · ranked by trust score, then stars

PDF Reader

sylphxai/pdf-reader-mcp

✕BLOCK F

Any file → clean Markdown for AI agents: PDF, Word, PowerPoint, Excel, EPUB, HTML and web pages, images (OCR), audio and video (metadata, subtitles, transcripts). A fast Rust MCP server and CLI that runs on your machine. No API key.

★ 9361 readstdio

McpStore

ip2a/mcpstore

✕BLOCK F

Elegantly manage your MCP services

★ 4321 readstreamable-http

pgEdge Postgres

pgedge/pgedge-postgres-mcp

✕BLOCK F

pgEdge MCP Server. A PostgreSQL MCP server with a Natural Language Agent CLI and Web UI.

★ 2331 read

Swagger Gateway

zaizaizhao/mcp-swagger-server

✕BLOCK F

MCP Swagger Server 将任何符合 OpenAPI/Swagger 规范的 REST API 转换为 Model Context Protocol (MCP) 格式,让 AI 助手能够理解和调用您的 API。

★ 7715 readsse

openrod

OpenRod/OpenRod

✕BLOCK F

One-click sandboxes for AI agents, with egress policy, MCPs, skills and audit. Built on NVIDIA OpenShell.

★ 173 readstreamable-http

codemcp

mewisme/codemcp

✕BLOCK F

CodeMCP is a workspace-aware execution, context, and agent orchestration server for AI clients.

★ 23 readstreamable-http

Tabularis

tabularisdb/tabularis

✕BLOCK F

Open-source desktop SQL workspace with 3 built-in database drivers and 16 shipped plugins, including SQL Server, DuckDB, ClickHouse and Redis. Built-in MCP server for Claude, Cursor and Devin, SQL notebooks and visual EXPLAIN.

★ 5,0116 read

Payload CMS

matmax-worldwide/payloadcmsmcp

✕BLOCK F

Payload CMS MCP Server

★ 1239 readsse

codelocal

codelocal-cloud/codelocal

✕BLOCK F

The open-source Project Brain for AI coding. Connect ChatGPT, Codex, Claude and MCP-compatible agents to your projects, local tools and persistent knowledge. Fork it, build with it, and help shape the open AI development stack. 🧠⚡

★ 872 readstdio

Last.fm MCP Server

rianvdm/lastfm-mcp

✕BLOCK F

An MCP server that provides seamless access to a user's Last.fm listening data and music information via AI assistants like Claude.

★ 4921 readstreamable-http

Tushare

zhewenzhang/tushare_mcp

✕BLOCK F
★ 4866 readstreamable-http

api2ai

OpenSourceAGI/dev-tools-starter-agent

✕BLOCK F

💻⚒️ NPM dev tools and core parts for Full Stack Starter App & Docs 🚀DEMO

★ 389 read

fluxmail

churichard/fluxmail

✕BLOCK F

Self-hosted email CLI / API / MCP server for AI agents and apps

★ 71 readstdio

orcid-mcp-server

cyanheads/orcid-mcp-server

✕BLOCK F

Search and retrieve researcher profiles, works, affiliations, funding, and peer review records from the ORCID registry via MCP. STDIO or Streamable HTTP.

★ 51 readstdio

PrepDeck

YIzhongyue/PrepDeck

✕BLOCK F

A self-hosted exam prep platform with practice questions, mock exams, AI-powered explanations, and personalized progress tracking, built on Cloudflare.

★ 01 readstreamable-http

teardrop

teardrop-ai/teardrop

!CAUTION F

An A2A-first marketplace for autonomous economic agents: discover specialists, delegate tasks, and settle per-request blockchain payments over federated MCP tools and streaming AG-UI.

★ 01 readstreamable-http

MARM

lyellr88/marm-systems

✕BLOCK F

Local-first 3-in-1 AI memory layer & MCP server for Claude Code, Codex, Grok, Gemini, VS Code and Cursor. Fuses session history, codebase indexing & concept graphs in SQLite. Enables zero-cloud, privacy-first context & instant recall, supports multi-agent swarms.

★ 41011 readstdio

Reasoner

jacck/mcp-reasoner

✕BLOCK F

A systematic reasoning MCP server implementation for Claude Desktop with beam search and thought evaluation.

★ 2771 readsse

SuperLocalMemory

qualixar/superlocalmemory

✕BLOCK F

Open-source governed, local-first memory control plane for AI agents and teams. arXiv:2608.08253

★ 2273 readstdio

sunpeak

Alignbase/sunpeak

✕BLOCK F

Server-agnostic MCP testing framework and full-stack MCP App framework for ChatGPT Apps, Claude Connectors, and more.

★ 2171 readstreamable-http

Splunk AI Connector

deslicer/mcp-for-splunk

✕BLOCK F

MCP Server for integrating with Splunk Enterprise

★ 273 readstdio

neo-agent-brain

neomjs/neo-agent-brain

✕BLOCK F

Point a cross-model AI engineering team at your own codebases. The Agent OS keeps named AI maintainers' identity, memory and review across labs alive between sessions — the Brain Neo.mjs runs on itself. Multi-tenant: onboarding a codebase is a config entry, not a fork.

★ 1140 readstdio

RepoTunnel

Yashwanth034/RepoTunnel

✕BLOCK F

RepoTunnel is a secure local AI workspace bridge that connects ChatGPT Web and MCP-compatible AI clients to approved local projects, files, terminals, Git, GitHub, browsers, editors, and desktop applications—so AI can inspect, edit, test, run, and manage real development work without constant copy-p

★ 61 readstreamable-http

mantle

aotter/mantle

✕BLOCK F

AotterMantle SDK: agent-native CMS runtime, manifests, admin UI, and Cloudflare adapter.

★ 53 read

Other risk hubs

By job

Questions

What does read-only mean here?
A server is listed here when its source declares at least one tool and every tool is classed read: no write tools and no destructive tools.
Is a read-only server always safe?
No. 913 are SAFE, 261 CAUTION and 446 BLOCK on this list. A tool list says what the tools do, not whether the surrounding code is clean, so a read-only server can still be BLOCK.
Why are some servers on no risk list?
615 servers declare no tools we can read, because they build the list at runtime. They cannot be called read-only, so they appear on none of the risk hubs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.