MCP servers · least privilege

Read-only MCP servers

1,620 MCP servers declare tools that only read: none of their tools is classed write or destructive. That makes them the safest place to start giving an agent access. Read-only describes the tools, not the code, so the audit verdict still decides whether to connect one.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Read-only MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/read-only/page/67

Verdicts · 1,620 servers

✓SAFE913!CAUTION261✕BLOCK446

Transports

A server can list more than one transport.

1,620 servers

1,585–1,608 of 1,620 · ranked by trust score, then stars

Flexible GraphRAG

stevereiner/flexible-graphrag

✕BLOCK F

Python, LlamaIndex, LangChain, 15 Property Graph, 4 RDF , 10 Vector, OpenSearch, Elasticsearch DBs. 14 data sources, 10 auto sync: Alfresco, Nuxeo, etc. KG auto-building, Ontologies, LLMs, Docling, LlamaParse, LiteParse, GraphRAG, RAG, Hybrid Search, AI Chat. TypeScript React, Vue, Angular frontends

★ 1889 read

Origin

7xuanlu/origin

✕BLOCK F

A living personal wiki. Wenlan turns your documents, notes, and AI chats into pages with links to their sources, and updates them as sources change without overwriting your edits. Claude Code, Codex and other AI tools can build on it.

★ 7917 readstreamable-http

Wenlan

7xuanlu/wenlan

✕BLOCK F

A living personal wiki. Wenlan turns your documents, notes, and AI chats into pages with links to their sources, and updates them as sources change without overwriting your edits. Claude Code, Codex and other AI tools can build on it.

★ 7917 readstreamable-http

Mythos Agent

mythos-agent/mythos-agent

✕BLOCK F

The AI security agent guards your code.

★ 4419 readstdio

corpusiq-docs

CorpusIQ/corpusiq-docs

✕BLOCK F

Hermes Agent Production Knowledge Repository — 406+ repos, AI Agent Marketplace, MCP servers, autonomous AI agent patterns. Production-tested from 1,200+ hours of ops. Updated daily.

★ 232 read

kodelyth-ecc

sifxprime/kodelyth-ecc

✕BLOCK F

70 agents · 196 skills · 103 commands · 44 hook entries · semantic intent routing · self-learning memory · GOD vs EVIL arena · MCP server. macOS, Linux and Windows. Claude Code, Windsurf, Cursor, Codex, Antigravity, Cline, Roo Code, Aider, Kimi, Gemini CLI. MIT.

★ 1122 readstdio

Receiz-commerce

kojibai/Receiz-commerce

✕BLOCK F

Open-source, no-code ecommerce launcher and developer kernel for proof-native artifacts. Clone, configure, and launch your own storefront powered by the Receiz SDK, MCP server, offline verification, ownership receipts, and programmable commerce objects.

★ 14 read

Ouroboros

q00/ouroboros

✕BLOCK F

Agent OS: the agent gets smarter on its own. We just hold the line: Interview-gated, staged evaluation, budgeted evolution loop. MCP server, 14 runtimes: Claude Code, Codex CLI, Gemini CLI, OpenCode, Copilot, Kiro and more.

★ 6,0503 readsse

Notte

nottelabs/notte

✕BLOCK F

Cloud browser infrastructure and web automation platform for your AI and coding agents

★ 2,0022 readstreamable-http

Smart Tree

8b-is/smart-tree

✕BLOCK F

Smart Tree: not just a tree, a philosophy. A context-aware, AI-crafted replacement for 20+ tools with MEM8 quantum compression, semantic search, AST-smart editing, and partnership memory. Crafted with care by human + AI—accept no knock-offs.

★ 2707 read

KSail

devantler-tech/ksail

✕BLOCK F

All-in-one Kubernetes SDK: create, manage, and operate clusters across distributions (Kind, K3d, Talos, VCluster) with built-in GitOps, secrets, AI assistant, and MCP server. Only requires Docker or a Cloud Provider.

★ 1663 readstdio

Pentest

dmontgomery40/pentest-mcp

✕BLOCK F

NOT for educational purposes: An MCP server for professional penetration testers including STDIO/HTTP/SSE support, nmap, go/dirbuster, nikto, JtR, hashcat, wordlist building, and more.

★ 14719 readsse

Agent Security Harness

msaleme/red-team-blue-team-agent-fabric

✕BLOCK F

AI agent security harness, adversarial testing: 640 executable tests in the v4.26.1 release, across MCP, A2A, x402/L402, decision governance, benchmark integrity, human-in-the-loop, skill supply chain. Four target shapes: a verdict must be able to be wrong AND to be right. OWASP Agentic v1.1 T1-T17,

★ 326 readstdio

Better Auth

better-auth/better-auth

✕BLOCK F

The most comprehensive authentication framework

★ 30,26612 readstreamable-http

artifact-site

lexmount/artifact-site

✕BLOCK F

A self-hosted home for your team’s AI-generated pages and documents. Publish HTML, build folders, ZIPs and PDFs as sandboxed, versioned links. CLI + remote MCP for AI agents.

★ 182 readstdio

Clade

shenxingy/Clade

✕BLOCK F

Turn Claude Code and Codex from chat assistants into autonomous coding systems

★ 101 readstdio

who2be

luetzey/who2be

✕BLOCK F

Self-hosted hub for AI agent configuration: versioned personas, playbooks and knowledge with a mandatory review step, served to agents over MCP. Agent configuration you review — not behavior you hope for.

★ 05 readstdio

AGI Memory

cognitivecomputations/agi-memory

✕BLOCK F
★ 6173 readstdio

unitares

cirwel/unitares

✕BLOCK F

Accountability infrastructure for long-running AI agents. Self-hosted MCP server: identity, claims and evidence, review, outcomes, and reconstruction across agent runtimes.

★ 55 readstdio

token-enhancer

Footshaped-friction742/token-enhancer

✕BLOCK F

Reduce web pages to clean text before they reach your AI agent’s context window, saving tokens and cutting noise

★ 26 readstdio

jev-judge-mcp

PyModel/jev-judge-mcp

✕BLOCK F

Typed judgment tools for MCP agents. TypeSafe's Jev model as verify, screen, find, classify, rerank, decide, compare, extract, review, gate, and score: the model judges, policy decides auto, review, or escalate.

★ 711 readstdio

FlAPI

datazoode/flapi

✕BLOCK F

API Framework heavily relying on the power of DuckDB and DuckDB extensions. Ready to build performant and cost-efficient APIs on top of BigQuery or Snowflake for AI Agents and Data Apps

★ 744 readstreamable-http

Token Enhancer

xelektron/token-enhancer

✕BLOCK F

A local proxy that strips web pages down to clean text before they enter your AI agent's context window. 704K tokens → 2.6K tokens. No LLM required.

★ 686 readstdio

CodeSampleX

r2cuerdame/CodeSampleX

✕BLOCK F

An open compatibility testing network: does this library API actually run on your version, OS and runtime? Real build evidence, verified samples, and the environment each result came from.

★ 21 readstdio

Other risk hubs

By job

Questions

What does read-only mean here?
A server is listed here when its source declares at least one tool and every tool is classed read: no write tools and no destructive tools.
Is a read-only server always safe?
No. 913 are SAFE, 261 CAUTION and 446 BLOCK on this list. A tool list says what the tools do, not whether the surrounding code is clean, so a read-only server can still be BLOCK.
Why are some servers on no risk list?
615 servers declare no tools we can read, because they build the list at runtime. They cannot be called read-only, so they appear on none of the risk hubs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.