MCP servers · least privilege

Read-only MCP servers

1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/66

Verdicts · 1,620 servers

✓SAFE913!CAUTION261✕BLOCK446

Transports

A server can list more than one transport.

1,620 servers

1,561–1,584 of 1,620 · ranked by trust score, then stars

mistgate

Mistgate/mistgate

✕BLOCK F

Self-hosted panel for running a VPN for others: family, friends, a community or a small team. Hysteria2 and AmneziaWG, one link per person, VLESS REALITY coming. Add servers from the browser over SSH; client-eye health checks and Telegram alerts; MCP for AI agents. Two static Go binaries, SQLite, no

★ 16 readstreamable-http

drift

lungenemptynester200/drift

✕BLOCK F

Detect architecture drift in AI-assisted codebases with deterministic checks and clear signals

★ 01 readstdio

MCP Toolbox for Databases

googleapis/genai-toolbox

✕BLOCK F

MCP Toolbox for Databases is an open source MCP server for databases.

★ 16,4602 readstreamable-http

Kubernetes

manusa/kubernetes-mcp-server

✕BLOCK F

Model Context Protocol (MCP) server for Kubernetes and OpenShift

★ 2,1397 readstdio

Kubernetes

containers/kubernetes-mcp-server

✕BLOCK F

Model Context Protocol (MCP) server for Kubernetes and OpenShift

★ 2,1167 readstdio

Keeper

ridafkih/keeper.sh

✕BLOCK F

Calendar sync tool & universal calendar MCP server. Aggregate, sync and control calendars on Google, Outlook, Office 365, iCloud, CalDAV or ICS.

★ 1,3552 readstreamable-http

Hypa

Hypabolic/Hypa

✕BLOCK F
★ 2121 read

CodeNib

sysevol-ai/CodeNib

✕BLOCK F

Find source context and trace calls across languages in Claude Code, Codex and other MCP agents.

★ 863 readstdio

roboparts

lm203688/roboparts

✕BLOCK F

RoboParts — Vendor-neutral composition checker for embodied systems | 具身系统的组合校验层(开源、厂商中立)| 868 实体 / 20 品类 / ISO 9409-1 法兰判定 / 三态 fail-closed 裁决(能/不能/不知道)| MCP Server + 开放 API + GitHub Action

★ 038 readstdio

Mcp Ts Core

cyanheads/mcp-ts-core

✕BLOCK F

Agent-native TypeScript framework for building MCP servers.

★ 1524 readstdio

Mcp Ts Template

cyanheads/mcp-ts-template

✕BLOCK F

Agent-native TypeScript framework for building MCP servers.

★ 1524 readstdio

IBM i Server

ibm/ibmi-mcp-server

✕BLOCK F

MCP server for IBM i systems

★ 857 readstdio

wenlan

wenlan-app/wenlan

✕BLOCK F

A living personal wiki. Wenlan turns your documents, notes, and AI chats into pages with links to their sources, and updates them as sources change without overwriting your edits. Claude Code, Codex and other AI tools can build on it.

★ 7919 readstreamable-http

Markdown Vault

pvliesdonk/markdown-vault-mcp

✕BLOCK F

Generic markdown vault MCP with hybrid search

★ 342 readstdio

benchweave

madeinoz67/benchweave

✕BLOCK F

BenchWeave is a Python test-bench gateway for embedded systems, combining reusable instrument and DUT plugins, shared device profiles, and safety-aware automated testing using AI.

★ 01 readstreamable-http

Rheo

MasterZ1311/Rheo

✕BLOCK F

Sovereign local-first AI voice studio. Neural speech synthesis, zero-shot voice cloning, zero-latency dictation, and MCP agent voice I/O. Built with Tauri & FastAPI.

★ 05 readstreamable-http

create-nextblock

nextblock-cms/nextblock

✕BLOCK F

The open-source, full-stack CMS for Next.js 16. An AI-native, developer-first alternative to headless platforms built with React Server Components, Supabase, and Tailwind CSS.

★ 181 readstreamable-http

blixtrade

blixvip/blixtrade

✕BLOCK F

Solana memecoin terminal with a public read API and an MCP server: live pump.fun feed, holder ledgers, Jupiter quotes.

★ 220 read

obsidian-mcp-server

cyanheads/obsidian-mcp-server

✕BLOCK F

Read, write, search, and surgically edit Obsidian vault notes, tags, and frontmatter via MCP. STDIO or Streamable HTTP.

★ 6953 readstdio

publisher

malloydata/publisher

✕BLOCK F

Publisher is the open-source analytics engine for Malloy. It lets you define data models once — and use them everywhere.

★ 11114 readstreamable-http

gina

gina-io/gina

✕BLOCK F

MVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency

★ 114 read

surreal-memory

acidkill/surreal-memory

✕BLOCK F
★ 78 readstreamable-http

MCPOmni Connect

abiorh001/mcp_omni_connect

✕BLOCK F

An agent runtime for Python. Give your agent real work. Keep control: every action checked before it runs, every run survives a crash without silently redoing anything, every step on the record.

★ 24918 readsse

Obsidian LLM Wiki

2233admin/obsidian-llm-wiki

✕BLOCK F

Your markdown vault, compiled into a 6-persona MCP team for Claude Code, Codex, OpenCode, and Gemini CLI. Headless-first. Cites, doesn't guess.

★ 369 readstdio

Other risk hubs

By job

Questions

What does read-only mean here?
A server is listed here when its source declares at least one tool and every tool is classed read: no write tools and no destructive tools.
Is a read-only server always safe?
No. 913 are SAFE, 261 CAUTION and 446 BLOCK on this list. A tool list says what the tools do, not whether the surrounding code is clean, so a read-only server can still be BLOCK.
Why are some servers on no risk list?
615 servers declare no tools we can read, because they build the list at runtime. They cannot be called read-only, so they appear on none of the risk hubs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.