MCP servers · least privilege

Read-only MCP servers

1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/64

Verdicts · 1,620 servers

✓SAFE913!CAUTION261✕BLOCK446

Transports

A server can list more than one transport.

1,620 servers

1,513–1,536 of 1,620 · ranked by trust score, then stars

Align CLI

aligndottech/align-cli

✕BLOCK F

Align CLI - capture decisions, check alignment, and query your decision graph from the terminal

★ 21 readsse

datahogo

datahogo/datahogo

✕BLOCK F

Open-source security scanner that runs on your machine — your code never leaves your laptop. 300+ checks for JS/TS, Python, Go, Java, PHP, C#, mobile and Supabase. Plain-language explanations, AI fixes with your own API key.

★ 04 readstdio

DataQ

TheurgicDuke771/DataQ

✕BLOCK F

Open-source data quality monitoring: checks across warehouses, lakehouses and object stores, triggered by ADF, Airflow and dbt, with alerting and an MCP server.

★ 02 readstreamable-http

flowviant

flowviant/cli

✕BLOCK F
★ 01 readstreamable-http

Unstract

zipstack/unstract

✕BLOCK F

LLM-Driven Extraction of Unstructured Data — Built for API Deployments & ETL Pipeline Workflows

★ 7,2455 read

graphjin

dosco/graphjin

✕BLOCK F

One governed graph for AI agents — GraphQL + MCP over your databases, files, APIs, and code

★ 3,2063 readstreamable-http

Hevy

chrisdoc/hevy-mcp

!CAUTION F

Manage your Hevy workouts, routines, folders, and exercise templates. Create and update sessions faster, organize plans, and search exercises to build workouts quickly. Stay synced with changes so your training log is always up to date.

★ 4932 readstdio

hevy-mcp

chrisdoc/hevy-mcp

!CAUTION F

Manage your Hevy workouts, routines, folders, and exercise templates. Create and update sessions faster, organize plans, and search exercises to build workouts quickly. Stay synced with changes so your training log is always up to date.

★ 4832 readstdio

ClinicalTrials.gov

cyanheads/clinicaltrialsgov-mcp-server

✕BLOCK F

Search ClinicalTrials.gov trials, retrieve study details and results, and match patients to eligible trials via MCP. STDIO or Streamable HTTP.

★ 972 readstdio

Teradata

teradata/teradata-mcp-server

✕BLOCK F

The community development of a MCP server for a Teradata database

★ 571 readstdio

Barbacane

barbacane-dev/barbacane

✕BLOCK F

Barbacane API and Bidirectional AI Gateway

★ 289 read

hbhqq9-bde-score

hbhqq9/bde-score

✕BLOCK F

🏆 Open-source multi-factor stock scoring API (0-100) | US/HK/A-Share 74 stocks | Zero signup | shields.io badges | GitHub Action | EU AI Act compliant

★ 35 readstdio

Trazum

Davmunrey/Trazum

✕BLOCK F

Know what your AI agents cost, per project, without your prompts leaving the machine. CLI, MCP server and CI gate. Zero dependencies, offline.

★ 17 readstdio

Synorive

arturoaeriform174/Synorive

✕BLOCK F

Search your files by meaning and fact-check the web, fully offline.

★ 026 readstdio

GPT Researcher

assafelovic/gpt-researcher

✕BLOCK F

An autonomous agent that conducts deep research on any data using any LLM providers

★ 29,5232 readstreamable-http

Xiaozhi Tools

zhongzitongxue/xiaozhi-mcptools

✕BLOCK F

一个图形化界面的小智MCP服务连接器,包含多种工具! 自动部署服务,方便小白给小智Ai添加MCP工具

★ 5274 readstdio

Lunchmoney

leafeye/lunchmoney-mcp-server

✕BLOCK F
★ 284 readsse

platform

GCTRL-TECH/platform

✕BLOCK F

Governed graph-native agent memory: knowledge extraction, fusion, hybrid RAG, scoped access tokens. A push for data sovereignty.

★ 76 readstdio

eurostat-mcp-server

barrylecherous932/eurostat-mcp-server

✕BLOCK F

Query Eurostat datasets on economy, health, and regional data through the Model Context Protocol using STDIO or HTTP.

★ 01 readstdio

EDT-MCP

DitriXNew/EDT-MCP

✕BLOCK F

MCP for 1C:EDT

★ 3001 readstreamable-http

EDT

ditrixnew/edt-mcp

✕BLOCK F

MCP for 1C:EDT

★ 2931 readstreamable-http

JSON Server

gongrzhe/json-mcp-server

✕BLOCK F

JSON handling and processing mcp server

★ 902 readsse

Twitter

crazyrabbitltc/mcp-twitter-server

✕BLOCK F

Model Context Protocol Server for Accessing twitter

★ 2516 readsse

artifactflow

Gadsotek/artifactflow

✕BLOCK F

Open-source, self-hosted, versioned vault for AI-generated HTML, Markdown, Mermaid, and image artifacts, with scoped MCP access and isolated two-origin previews.

★ 51 readstreamable-http

Other risk hubs

By job

Questions

What does read-only mean here?
A server is listed here when its source declares at least one tool and every tool is classed read: no write tools and no destructive tools.
Is a read-only server always safe?
No. 913 are SAFE, 261 CAUTION and 446 BLOCK on this list. A tool list says what the tools do, not whether the surrounding code is clean, so a read-only server can still be BLOCK.
Why are some servers on no risk list?
615 servers declare no tools we can read, because they build the list at runtime. They cannot be called read-only, so they appear on none of the risk hubs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.