MCP servers · least privilege

Read-only MCP servers

1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/65

Verdicts · 1,620 servers

✓SAFE913!CAUTION261✕BLOCK446

Transports

A server can list more than one transport.

1,620 servers

1,537–1,560 of 1,620 · ranked by trust score, then stars

Kybernesis Platform

KybernesisAI/platform

✕BLOCK F
★ 01 read

lense

adeelahmad/lense

✕BLOCK F

Lens: intelligence for your agent. Safe, secure and cost-effective. A self-hosted, cited knowledge graph and MCP server for your agents, from a Raspberry Pi to the cloud.

★ 05 readstreamable-http

Chrome Browser

hangwin/mcp-chrome

✕BLOCK F

Chrome MCP Server is a Chrome extension-based Model Context Protocol (MCP) server that exposes your Chrome browser functionality to AI assistants like Claude, enabling complex browser automation, content analysis, and semantic search.

★ 12,4387 readsse

kubernetes-mcp-server

containers/kubernetes-mcp-server

✕BLOCK F

Model Context Protocol (MCP) server for Kubernetes and OpenShift

★ 2,1547 readstdio

codflow

bighadj22/codflow

✕BLOCK F

The open-source, COD-first e-commerce + delivery platform for Algeria built agentic-ready.

★ 3425 read

Sage

l33tdawg/sage

✕BLOCK F

(S)AGE - (Sovereign) Agent Governed Experience

★ 25411 readstdio

Axon

ali-kamali/axon.mcp.server

✕BLOCK F

Transform your codebase into an intelligent knowledge base for AI-powered development with Cursor IDE, Google AntiGravity, and MCP-enabled assistants

★ 16622 readstdio

deepPairing

mitchjablonski/deepPairing

✕BLOCK F

Review what Claude Code is about to change on a rich visual surface — inline comments, evidence, and a gate that remembers the approaches you rejected.

★ 15 readstdio

living-bread-mcp

thegoodfruit/living-bread-mcp

✕BLOCK F

Remote MCP server for The Living Bread: Scripture from a stored text, verses for a need, real churches and gatherings, and the prayers real people prayed over you. mcp.living-bread.org

★ 08 readsse

cli

modelstudioai/cli

✕BLOCK F

Official Model Studio CLI(阿里云百炼 CLI)built for AI Agent frameworks, exposing models, search, multimodal, and workflow capabilities as structured tool calls.

★ 5395 readstreamable-http

AI-Canvas-tauri

Tenney95/AI-Canvas-tauri

✕BLOCK F

Local-first AI canvas for visual workflows, AI short drama, image/video generation, storyboarding and asset management. ComfyUI, AI agents, MCP & Blender. 本地优先 AI 画布:AI短剧、AI资产管理、图像/视频生成、分镜制作与视频剪辑。

★ 20846 readstdio

DeepSecure

deeptrail/deepsecure

✕BLOCK F

Effortlessly secure your AI agents and AI-powered workflows — from prototype to production. Get easy-to-use identity, credential, and access management built for fast-moving AI developers.

★ 525 readstreamable-http

Rash

paiml/bashrs

✕BLOCK F

Bashrs: Rust-to-Shell Transpiler for Deterministic Bootstrap Scripts

★ 411 read

puenteo

mano7onam/puenteo

✕BLOCK F

Let your coding agents talk to each other: search every Claude Code / Codex / Gemini / Cursor session and message live sessions. CLI · MCP · hooks · HTTP/SSE · A2A.

★ 11 readstdio

Reactive Resume

amruthpillai/reactive-resume

✕BLOCK F

A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today!

★ 43,1812 readstreamable-http

Reactive Resume

reactive-resume/app

✕BLOCK F

A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today!

★ 43,1812 readstreamable-http

Reactive Resume

reactive-resume/reactive-resume

✕BLOCK F

A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today!

★ 43,1812 readstreamable-http

Sentry

getsentry/sentry-mcp

✕BLOCK F

An MCP server for interacting with Sentry via LLMs.

★ 8643 readstdio

Novamira

use-novamira/novamira

✕BLOCK F

MCP server that gives AI agents full access to WordPress through PHP execution and filesystem operations

★ 6983 readstdio

Flyto Core

flytohub/flyto-core

✕BLOCK F

AI said it finished. Flyto2 shows the proof.

★ 4833 readstdio

LLM Council

amiable-dev/llm-council

✕BLOCK F

The LLM Council works together to answer your hardest questions

★ 434 read

mnema

felipesauer/mnema

✕BLOCK F

Signed, append-only decision records for AI coding agents: an MCP server and CLI that open Claude Code, Codex, Copilot CLI, Gemini CLI, OpenCode, VS Code and Cursor sessions with your team's decisions, hold the edits a rule governs, and let anyone verify the record offline. Tamper-evident, in git.

★ 44 readstdio

Conarium

dogrucanemek-alt/conarium

✕BLOCK F

Self-hosted governance layer between AI assistants and your real data. Deterministic PII masking, allow/deny policy, hash-chained audit, offline-verifiable Ed25519 receipts per access when a receipt sink is configured, coverage reconciliation against the DB's own query counters to surface gateway by

★ 324 readstdio

wrg-sigma-rules

WRG-11/wrg-sigma-rules

✕BLOCK F

Sigma rules for ransomware, threat actors and vulnerabilities disclosed in AI/LLM apps and MCP servers, with multi-backend conversion and an MCP server for Claude Code, Codex and Cursor. CI-pinned claims.

★ 23 read

Other risk hubs

By job

Questions

What does read-only mean here?
A server is listed here when its source declares at least one tool and every tool is classed read: no write tools and no destructive tools.
Is a read-only server always safe?
No. 913 are SAFE, 261 CAUTION and 446 BLOCK on this list. A tool list says what the tools do, not whether the surrounding code is clean, so a read-only server can still be BLOCK.
Why are some servers on no risk list?
615 servers declare no tools we can read, because they build the list at runtime. They cannot be called read-only, so they appear on none of the risk hubs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.