MCP servers · least privilege
Read-only MCP servers
1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.
Cite
Cite this page
ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/67
Verdicts · 1,620 servers
Transports
- stdio, runs locally1,124
- Streamable HTTP, remote555
- SSE, legacy remote133
- Not declared284
A server can list more than one transport.
1,620 servers
1,585–1,608 of 1,620 · ranked by trust score, then stars
Flexible GraphRAG
stevereiner/flexible-graphrag
Python, LlamaIndex, LangChain, 15 Property Graph, 4 RDF , 10 Vector, OpenSearch, Elasticsearch DBs. 14 data sources, 10 auto sync: Alfresco, Nuxeo, etc. KG auto-building, Ontologies, LLMs, Docling, LlamaParse, LiteParse, GraphRAG, RAG, Hybrid Search, AI Chat. TypeScript React, Vue, Angular frontends
Origin
7xuanlu/origin
A living personal wiki. Wenlan turns your documents, notes, and AI chats into pages with links to their sources, and updates them as sources change without overwriting your edits. Claude Code, Codex and other AI tools can build on it.
Wenlan
7xuanlu/wenlan
A living personal wiki. Wenlan turns your documents, notes, and AI chats into pages with links to their sources, and updates them as sources change without overwriting your edits. Claude Code, Codex and other AI tools can build on it.
Mythos Agent
mythos-agent/mythos-agent
The AI security agent guards your code.
corpusiq-docs
CorpusIQ/corpusiq-docs
Hermes Agent Production Knowledge Repository — 406+ repos, AI Agent Marketplace, MCP servers, autonomous AI agent patterns. Production-tested from 1,200+ hours of ops. Updated daily.
kodelyth-ecc
sifxprime/kodelyth-ecc
70 agents · 196 skills · 103 commands · 44 hook entries · semantic intent routing · self-learning memory · GOD vs EVIL arena · MCP server. macOS, Linux and Windows. Claude Code, Windsurf, Cursor, Codex, Antigravity, Cline, Roo Code, Aider, Kimi, Gemini CLI. MIT.
Receiz-commerce
kojibai/Receiz-commerce
Open-source, no-code ecommerce launcher and developer kernel for proof-native artifacts. Clone, configure, and launch your own storefront powered by the Receiz SDK, MCP server, offline verification, ownership receipts, and programmable commerce objects.
Ouroboros
q00/ouroboros
Agent OS: the agent gets smarter on its own. We just hold the line: Interview-gated, staged evaluation, budgeted evolution loop. MCP server, 14 runtimes: Claude Code, Codex CLI, Gemini CLI, OpenCode, Copilot, Kiro and more.
Notte
nottelabs/notte
Cloud browser infrastructure and web automation platform for your AI and coding agents
Smart Tree
8b-is/smart-tree
Smart Tree: not just a tree, a philosophy. A context-aware, AI-crafted replacement for 20+ tools with MEM8 quantum compression, semantic search, AST-smart editing, and partnership memory. Crafted with care by human + AI—accept no knock-offs.
KSail
devantler-tech/ksail
All-in-one Kubernetes SDK: create, manage, and operate clusters across distributions (Kind, K3d, Talos, VCluster) with built-in GitOps, secrets, AI assistant, and MCP server. Only requires Docker or a Cloud Provider.
Pentest
dmontgomery40/pentest-mcp
NOT for educational purposes: An MCP server for professional penetration testers including STDIO/HTTP/SSE support, nmap, go/dirbuster, nikto, JtR, hashcat, wordlist building, and more.
Agent Security Harness
msaleme/red-team-blue-team-agent-fabric
AI agent security harness, adversarial testing: 640 executable tests in the v4.26.1 release, across MCP, A2A, x402/L402, decision governance, benchmark integrity, human-in-the-loop, skill supply chain. Four target shapes: a verdict must be able to be wrong AND to be right. OWASP Agentic v1.1 T1-T17,
Better Auth
better-auth/better-auth
The most comprehensive authentication framework
artifact-site
lexmount/artifact-site
A self-hosted home for your team’s AI-generated pages and documents. Publish HTML, build folders, ZIPs and PDFs as sandboxed, versioned links. CLI + remote MCP for AI agents.
Clade
shenxingy/Clade
Turn Claude Code and Codex from chat assistants into autonomous coding systems
who2be
luetzey/who2be
Self-hosted hub for AI agent configuration: versioned personas, playbooks and knowledge with a mandatory review step, served to agents over MCP. Agent configuration you review — not behavior you hope for.
AGI Memory
cognitivecomputations/agi-memory
unitares
cirwel/unitares
Accountability infrastructure for long-running AI agents. Self-hosted MCP server: identity, claims and evidence, review, outcomes, and reconstruction across agent runtimes.
token-enhancer
Footshaped-friction742/token-enhancer
Reduce web pages to clean text before they reach your AI agent’s context window, saving tokens and cutting noise
jev-judge-mcp
PyModel/jev-judge-mcp
Typed judgment tools for MCP agents. TypeSafe's Jev model as verify, screen, find, classify, rerank, decide, compare, extract, review, gate, and score: the model judges, policy decides auto, review, or escalate.
FlAPI
datazoode/flapi
API Framework heavily relying on the power of DuckDB and DuckDB extensions. Ready to build performant and cost-efficient APIs on top of BigQuery or Snowflake for AI Agents and Data Apps
Token Enhancer
xelektron/token-enhancer
A local proxy that strips web pages down to clean text before they enter your AI agent's context window. 704K tokens → 2.6K tokens. No LLM required.
CodeSampleX
r2cuerdame/CodeSampleX
An open compatibility testing network: does this library API actually run on your version, OS and runtime? Real build evidence, verified samples, and the environment each result came from.
Other risk hubs
By job
Questions
What does read-only mean here?
Is a read-only server always safe?
Why are some servers on no risk list?
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does read-only mean here?
- Is a read-only server always safe?
- Why are some servers on no risk list?