MCP servers · over the network

Remote MCP servers

2,120 MCP servers list a remote transport, streamable HTTP or SSE. A remote server needs no install, but what you send it leaves your machine. Our audit reads the source in the repository; it cannot see what a hosted deployment runs.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Remote MCP servers”. Retrieved 29 Oct 2026. https://modelsatlas.com/mcp/remote/page/85

Verdicts · 2,120 servers

✓SAFE706!CAUTION493✕BLOCK921

Transports

A server can list more than one transport.

Tool risk

563

servers expose at least one destructive tool: delete, overwrite or run. The median server with a readable tool list exposes 12 tools.

Servers with no destructive tools →

2,120 servers

2,017–2,040 of 2,120 · ranked by trust score, then stars

chat-recall

munhq/chat-recall

✕BLOCK F

Memory, secret alerts, ranked code findings and tracked tasks across every AI coding tool. Indexes Claude Code, Codex, OpenCode, Antigravity and Cursor sessions into one searchable history, and exposes it to your agent over MCP.

★ 22 destructivestdio

Selene

tercumantanumut/selene

✕BLOCK F

Selene is a desktop app that runs AI agents on your machine. Connect them to your WhatsApp, Telegram, Slack, or Discord. Write code, generate images, build personal assistants. All from one place. Your data stays on your device.

★ 1692 writestreamable-http

Seline

tercumantanumut/seline

✕BLOCK F

Selene is a desktop app that runs AI agents on your machine. Connect them to your WhatsApp, Telegram, Slack, or Discord. Write code, generate images, build personal assistants. All from one place. Your data stays on your device.

★ 1692 writestreamable-http

Open Computer Use

wide-moat/open-computer-use

✕BLOCK F

ARCHIVED — superseded by Wide Moat

★ 1261 writestreamable-http

Attio

kesslerio/attio-mcp-server

✕BLOCK F

Attio Model Context Protocol (MCP) server implementation

★ 695 destructivestdio

clerk

clerk/cli

✕BLOCK F

Put your agent in control with the Clerk CLI

★ 551 destructivestreamable-http

workbench

amarthaid/workbench

✕BLOCK F

One MCP endpoint. Every tool your agent needs. Self-hosted, per-user OAuth. 20+ SaaS integrations and invite you to add more.

★ 69 destructivestreamable-http

anysearch-cli

Xxx91n/anysearch-cli

✕BLOCK F

Vertical-domain information-specialist agent CLI — search + research + memory + knowledge with domain allowlists, abstain-first answers, and a fail-open MCP server

★ 01 writestdio

mcp-agentgate

wookat/agentgate

✕BLOCK F

AgentGate — scan, lock, and gate your MCP servers. npm-audit + lockfile + CI drift gate for the MCP era.

★ 06 writesse

n8n-mcp

czlonkowski/n8n-mcp

✕BLOCK F

A MCP for Claude Desktop / Claude Code / Windsurf / Cursor to build n8n workflows for you

★ 23,0553 destructivesse

Ouroboros

q00/ouroboros

✕BLOCK F

Agent OS: the agent gets smarter on its own. We just hold the line: Interview-gated, staged evaluation, budgeted evolution loop. MCP server, 14 runtimes: Claude Code, Codex CLI, Gemini CLI, OpenCode, Copilot, Kiro and more.

★ 6,0503 readsse

Notte

nottelabs/notte

✕BLOCK F

Cloud browser infrastructure and web automation platform for your AI and coding agents

★ 2,0022 readstreamable-http

unifi-mcp

sirkirby/unifi-mcp

✕BLOCK F

MCP servers & Graph API for the UniFi suite of applications, Network, Protect, and Access

★ 8727 writesse

UniFi Network

sirkirby/unifi-network-mcp

✕BLOCK F

MCP servers & Graph API for the UniFi suite of applications, Network, Protect, and Access

★ 8697 writesse

UniFi Network

sirkirby/unifi-mcp

✕BLOCK F

MCP servers & Graph API for the UniFi suite of applications, Network, Protect, and Access

★ 8537 writesse

mcp-gateway

MikkoParkkola/mcp-gateway

✕BLOCK F

Unlimited MCP servers, tools and APIs. One fixed context cost. Plug every tool you own into Claude, Cursor, Codex or any MCP client: your agent sees a handful, finds the rest on demand, and never drowns in tool definitions. Self-hosted MCP gateway and proxy in one Rust binary, 100+ API integrations

★ 799 writestdio

GeneXus 18

lennix1337/genexus18mcp

✕BLOCK F

GeneXus MCP server with native SDK support for GeneXus 16–18 plus basic legacy compatibility for GeneXus 8, 9, 10.1–10.3, and 15 via reflection/COM drivers.

★ 363 destructivestdio

Dida365

zh1754629545/dida365-mcp-servers

✕BLOCK F

基于滴答官方文档生成的日程待办增删改查MCP服务

★ 342 destructivesse

memory-cloud

kagura-ai/memory-cloud

✕BLOCK F

Adaptive memory for AI agents & teams — beyond RAG. Self-hosted MCP server that gets smarter every time you search: hybrid search + a neural memory graph that learns. Works with Claude, ChatGPT & any MCP client.

★ 12Not listed in sourcestreamable-http

nomoreide

Rorogogogo/nomoreide

✕BLOCK F

AI-native service workbench: MCP server + shared daemon for Claude Code, Codex, and Gemini. CLI, TUI, and web dashboard for running services, logs, git, and databases.

★ 71 writestreamable-http

Memory Service

doobidoo/mcp-memory-service

✕BLOCK F

Open-source persistent memory for AI agent pipelines (LangGraph, CrewAI, AutoGen) and Claude. REST API + knowledge graph + autonomous consolidation.

★ 1,9541 destructivestdio

Pentest

dmontgomery40/pentest-mcp

✕BLOCK F

NOT for educational purposes: An MCP server for professional penetration testers including STDIO/HTTP/SSE support, nmap, go/dirbuster, nikto, JtR, hashcat, wordlist building, and more.

★ 14719 readsse

Sema

sema-lisp/sema

✕BLOCK F

A Lisp with first-class LLM primitives, implemented in Rust

★ 501 destructivestdio

Agent Security Harness

msaleme/red-team-blue-team-agent-fabric

✕BLOCK F

AI agent security harness, adversarial testing: 640 executable tests in the v4.26.1 release, across MCP, A2A, x402/L402, decision governance, benchmark integrity, human-in-the-loop, skill supply chain. Four target shapes: a verdict must be able to be wrong AND to be right. OWASP Agentic v1.1 T1-T17,

★ 326 readstdio

Other risk hubs

By job

Questions

What counts as a remote MCP server?
A server is listed here when its declared transports include streamable-http or sse.
Do remote servers also run locally?
1,435 of the 2,120 also list stdio, so the same package can run as a local process. 685 are remote only.
Are remote servers safe?
706 are SAFE, 493 CAUTION and 921 BLOCK. The verdict is for the source we read; a hosted instance may differ from it, so give a remote server the narrowest credentials it needs.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.