// mcp field guide
A growing, sourced guide to the Model Context Protocol servers agents actually use — what each one does, which of its tools are destructive or irreversible, and an honest verdict on where a human-approval guard genuinely helps. Every profile cites the official repo and docs. We call out where a guard adds little, too — that's how you know the rest is trustworthy.
The through-line: a guard is worth exactly as much as a server's destructive surface. A read-only server barely needs one. A server whose one tool can DROP TABLE, merge to main, or issue a refund needs a human checkpoint on that tool — and honesty that some of those actions can't be undone, only compensated. So we grade each server not with a logo, but with a fit verdict you can argue with.
DEVOPS · reference server
Sandboxed read/write to your files. No delete tool — the real risk is overwrite.
DEVOPS · official (GitHub)
Repos, issues, PRs, Actions. A big safe read surface plus a few high-blast-radius writes.
DATA · reference + community
Read-only reference server vs. write-capable ones. The split is the whole story.
FINTECH · official (Stripe)
An agent touching real money on a live account. A refund is a new transaction, not an undo.
INFRASTRUCTURE · community / Red Hat
kubectl-equivalent power over a live cluster. Deleting a namespace or PVC is the K8s DROP TABLE.
COMMUNICATION · official (Slack)
Reads are harmless; posting is effectively irreversible — deleting doesn't un-notify anyone.
PRODUCTIVITY · official (Notion)
"Delete" is recoverable trash. The real edge is a full-content overwrite and bulk edits.
PRODUCTIVITY · Anthropic / Google
Mostly read today. The strong case (sharing, permanent delete) is latent until those tools ship.
OBSERVABILITY · official (Sentry)
Mostly read/diagnostic + triage. One truly irreversible tool. An honest low-risk profile.
DATA / BACKEND · official (Supabase)
Arbitrary SQL, migrations, branch deletes — but read-only mode + project scoping are the recommended defaults.
INFRASTRUCTURE · official (Cloudflare)
A family: read-only servers where a gate is theater, and write servers that delete buckets, databases and zones.
INFRASTRUCTURE · official (AWS Labs)
A ~60-server suite: most read/advisory, but the Core API server runs any CLI — terminate, delete-stack, s3 rb.
PROJECT MGMT · Atlassian + community
Official server has no deletes; community adds jira_delete_issue — and a deleted Jira issue has no trash.
PROJECT MGMT · official (Linear)
Read-and-triage with no delete/archive tool. Value is bulk ops + notifications, not "undoing deletes."
BROWSER · official (Microsoft)
Innocuous tool names, but the same browser_click advances a test page or places a $4,000 order.
DATA WAREHOUSE · official (Snowflake)
Cortex + raw SQL. Read-only by default on the managed server; per-statement permissions on the local one.
DATABASE · official (MongoDB)
Live DB writes and Atlas provisioning. Real --readOnly mode; drop-database is catastrophic.
DEPLOY · official (Vercel)
No delete/rollback/env-var tools at all — the irreversible edge is money (buy_pro) and production publish.
COMMUNICATIONS · Twilio (alpha)
Send an SMS or place a call and it's delivered + billed instantly — Slack's irreversible post, with real money.
OBSERVABILITY · Datadog + community
Weak for the read majority (like Sentry) — but non-default toolsets reach delete, execute_code and remote shell.
CRM · official (HubSpot)
No delete tool and no customer-facing send — the two expected edges are absent. The real risk is bulk record overwrites.
FINTECH · official (PayPal)
Capture payments, issue refunds, cancel subscriptions — real money that can't be un-moved. A refund is a new transaction.
COMMUNITY · unofficial
No official server. A bot-authenticated agent posts (irreversible), deletes channels with their history, and bans members.
CRM · official + community
The official DX server is read-only SOQL; full CRUD, bulk DML and arbitrary Apex live in community connectors.
COMMERCE · official + community
The dev/docs MCP is read-only (wrong demo for a guard). The money is in Checkout and community Admin servers.
SUPPORT · community + first-party
A public reply emails the customer — and the popular server defaults to public, so a "note" can go out by omission.
NO-CODE DB · community + official
No delete-table/base tool exists — the catastrophic scenario isn't reachable. The risk is bulk record delete/overwrite.
FINTECH · official (Block/Square)
Three generic meta-tools — a payment and a list arrive under the same name. Classify by the args, not the tool.
EMAIL · Google + community
Official server is draft-only (can't send). The community one sends immediately and permanently deletes.
ENTERPRISE / ITSM · official + community
A write propagates through automation. Change execution, script deploy and deletes reach production process.
SUPPORT · official (Intercom)
Honest: 13 tools, mostly read. The only writes are Help Center articles — no customer reply or delete tool today.
PROJECT MGMT · official (Asana)
Read-and-triage; strong only on delete_task (vendor-irreversible), moderate on bulk writes and notify comments.
PRODUCTIVITY · Google + community
Reading is safe; an event with attendees emails real people — the invite/cancellation can't be un-sent.
IDENTITY · official (Okta)
Identity is high-blast: deactivate or delete a user, reset factors, lock people out of everything. Ships elicitation confirms.
INFRASTRUCTURE · official (HashiCorp)
Registry-read by default; enable operations and is_destroy apply tears down real infra — the highest blast radius, non-compensable.
DATABASE · official (Redis)
No read-only mode. The catastrophe isn't one tool — it's a scan + delete loop, and overwrites with no history.
SEARCH / DATA · Elastic + community
The official/Agent-Builder path is read-only search; community servers add delete_index — irreversibly dropping data.
ON-CALL · official (PagerDuty)
Read-only by default; enable writes and an agent pages real humans at 3am — or resolves a live incident and hides it.
OBSERVABILITY · official (Grafana)
Weak for the read majority (like Sentry). The sharp edge: delete an alert rule (removes detection) or mute-route an outage.
| Server | Category | The action worth gating | Guard fit |
|---|---|---|---|
| Filesystem | DevOps | Overwriting a file (no backup) via write_file/edit_file | MODERATE |
| GitHub | DevOps | merge_pull_request, deploy triggers, public comments | STRONG |
| PostgreSQL | Data | execute_sql in write mode — DROP/TRUNCATE/DELETE | WEAK → STRONG |
| Stripe | Fintech | create_refund, subscription cancel, invoice void | STRONG |
| Kubernetes | Infra | delete namespace/PVC, drain, scale-to-zero, exec | STRONG |
| Slack | Comms | Posting a message (irreversible — un-notifies no one) | MODERATE |
| Notion | Productivity | Full-content update-page overwrite & bulk edits | MODERATE |
| Google Drive | Productivity | Sharing changes & permanent delete (latent — not yet exposed) | LOW |
| Sentry | Observability | delete_uptime_monitor; org-shaping config writes | MODERATE |
| Supabase | Data | Destructive execute_sql, migrations, delete_branch | STRONG |
| Cloudflare | Infra | r2/d1/kv_delete, zone/DNS delete via the unified API | STRONG |
| AWS | Infra | call_aws destructive CLI; CCAPI/IAM deletes | STRONG |
| Jira / Atlassian | Project mgmt | jira_delete_issue (permanent, community); bulk ops | MODERATE |
| Linear | Project mgmt | Bulk mutations & notification-emitting comments (no deletes) | LOW |
| Playwright | Browser | The consequential submit/confirm; browser_evaluate | MODERATE |
| Snowflake | Data warehouse | Write/DDL/DROP SQL beyond the statement permissions | STRONG |
| MongoDB | Database | drop-database, delete-many, Atlas teardown | STRONG |
| Vercel | Deploy | Purchases (buy_pro/buy_domain) & production deploys | STRONG |
| Twilio | Comms | Send SMS / place call / buy number — instant, billed, irreversible | STRONG |
| Datadog | Observability | Mute/downtime; non-default delete / execute_code / remote shell | WEAK → STRONG |
| HubSpot | CRM | Bulk create/update overwriting live customer records | MODERATE |
| PayPal | Fintech | Capture (pay_order), create_refund, cancel subscription | STRONG |
| Discord | Community | Send message (irreversible), delete channel, ban member | STRONG |
| Salesforce | CRM | Community CRUD/bulk DML/apex_execute; metadata deploys | STRONG |
| Shopify | Commerce | complete_checkout (payment); Admin refund/cancel/fulfill | STRONG |
| Zendesk | Support | Public reply emails the customer (public-by-default trap) | MODERATE |
| Airtable | No-code DB | Bulk delete_records / overwrite (no schema-delete tool) | STRONG |
| Square | Fintech | payments/refunds/payouts via one meta-tool — classify by args | STRONG |
| Gmail | send_email (no unsend), permanent delete; official is draft-only | STRONG | |
| ServiceNow | Enterprise / ITSM | Change approval/execution, script deploy, deletes, membership | STRONG |
| Intercom | Support | Help Center article writes (no reply/delete tool today) | MODERATE |
| Asana | Project mgmt | delete_task (vendor-irreversible), bulk writes, notify comments | LOW |
| Google Calendar | Productivity | Create/update/delete event with attendees emails real people | MODERATE |
| Okta | Identity | Deactivate/delete_user, reset MFA factors — locks people out | STRONG |
| Terraform | Infra | create_run with is_destroy — tears down real infra (gated flag) | WEAK → STRONG |
| Redis | Database | A scan+delete loop; rename/overwrite with no history | STRONG |
| Elasticsearch | Search / data | delete_index in community servers (official path is read-only) | WEAK → STRONG |
| PagerDuty | On-call | Triggering a page (wakes humans); resolving a live incident | MODERATE |
| Grafana | Observability | alerting_manage_rules delete & routing/mute — hides outages | WEAK → STRONG |
DROP).ChronoMCP is a transparent proxy that works with every server here — it passes reads through and gates the destructive calls on a human. Zero rewrite, MIT.
Read the quickstart → GitHubProfiles describe third-party software from its public sources; ChronoMCP is independent and not affiliated with these projects. Capabilities reflect sources current as of Aug 2026 and change often — follow the source links on each page for the latest.