dockndevai
Ankit VermaOwner · @dockndevai
Safe by default · read-only until you say otherwise

MCP servers that let agents run real systems — safely

Twenty open-source Model Context Protocol servers that let AI agents work with real systems — infrastructure, cloud, databases, Microsoft 365, your Mac, and your own documents — without being handed the keys. Read-only by default, least privilege, secrets never leak.

The security model
20 MCP servers on npm + the Official MCP Registry MIT & Apache-2.0 Claude · Cursor · Codex · VS Code · Windsurf
Products

Twenty MCP servers, one install pattern

Each runs over stdio and installs with a single npx command (requires Node 22+). All share one governance model; full per-client setup lives in every repo's docs/CLIENTS.md. Jump to any product from the Products menu above.

mcp-azure

TypeScript

MCP server for Azure (Resource Manager) — inventory, tags, VM power, lifecycle — with governance controls (scoping, protected groups, location allowlist, delete gating, confirmation).

★ 1↓ 698/mo
npx -y @dockndevai/mcp-azure
GitHubnpm

mcp-azure-devops

TypeScript

MCP server for Azure DevOps — boards, repos, pipelines, projects — with governance controls (access modes, project scoping, protected projects, delete gating, typed confirmation).

★ 1↓ 708/mo
npx -y @dockndevai/mcp-azure-devops
GitHubnpm

mcp-kubernetes

TypeScript

MCP server for Kubernetes — multi-cluster ops with security modes (read-only/read-write/admin) and access-control flags.

★ 2↓ 585/mo
npx -y @dockndevai/mcp-kubernetes
GitHubnpm

mcp-debezium

TypeScript

MCP server for Debezium / Kafka Connect — monitor & manage CDC connectors with security modes and access-control flags.

★ 1↓ 534/mo
npx -y @dockndevai/mcp-debezium
GitHubnpm

mcp-clickhouse

TypeScript

MCP server for ClickHouse — explore, query, and manage with SQL-classification-based security modes and access-control flags.

★ 3↓ 611/mo
npx -y @dockndevai/mcp-clickhouse
GitHubnpm

mcp-kafka

TypeScript

MCP server for Apache Kafka — monitor & manage clusters, topics, and consumer groups (with lag), with security modes and access-control flags.

★ 1↓ 594/mo
npx -y @dockndevai/mcp-kafka
GitHubnpm

mcp-keycloak

TypeScript

MCP server for Keycloak — multi-realm admin with security modes (read-only/read-write/admin) and access-control flags.

★ 1↓ 538/mo
npx -y @dockndevai/mcp-keycloak
GitHubnpm

mcp-percona-pg

TypeScript

MCP server for the Percona Operator for PostgreSQL — manage PostgreSQL + PgBouncer, pooling, backups/PITR, and DR with safe-by-default security flags.

★ 1↓ 553/mo
npx -y @dockndevai/mcp-percona-pg
GitHubnpm

mcp-oci

TypeScript

MCP server for Oracle Cloud (OCI) — live resource discovery, dependency mapping, and Terraform generation, with security modes and access-control flags.

★ 1↓ 313/mo
npx -y @dockndevai/mcp-oci
GitHubnpm

mcp-grafana

TypeScript

MCP server for Grafana — search & edit dashboards, query datasources (Prometheus/Loki/SQL), inspect alerts, with safe-by-default access modes.

★ 0↓ 489/mo
npx -y @dockndevai/mcp-grafana
GitHubnpm

mcp-outlook

TypeScript

Safe-by-default MCP server for Microsoft Outlook mail (Microsoft Graph) — read, search, draft, send, reply, forward and organize email, with browser sign-in.

★ 0↓ 1.1k/mo
npx -y @dockndevai/mcp-outlook
GitHubnpm

ossian-mcp

TypeScript

MCP server for Ossian — ask your own documents with citations, and give an agent memory that persists

★ 2↓ 230/mo
npx -y ossian-mcp
GitHubnpm

mcp-mac-control

TypeScript

Full macOS control MCP server — drive a Mac like a human: shell, AppleScript, files, processes, and human-like GUI (click, drag, scroll, type). Full control by default; opt-in safe mode.

★ 0↓ 774/mo
npx -y @dockndevai/mcp-mac-control
GitHubnpm

mcp-macos

TypeScript

Safe-by-default MCP server to observe & operate a Mac — files, processes, apps, shell, AppleScript, GUI.

★ 0↓ 358/mo
npx -y @dockndevai/mcp-macos
GitHubnpm

mcp-openshift

TypeScript

Safe-by-default MCP server for OpenShift / Kubernetes — projects, pods, logs, deployments, routes and more, with username/password (local IdP) or token auth.

★ 0↓ 539/mo
npx -y @dockndevai/mcp-openshift
GitHubnpm

mcp-teams

TypeScript

Safe-by-default MCP server for Microsoft Teams (Microsoft Graph) — read teams, channels, chats and messages, and post/reply/send, with browser sign-in.

★ 0↓ 481/mo
npx -y @dockndevai/mcp-teams
GitHubnpm

mcp-android

TypeScript

MCP server to control an Android device over ADB — screenshots, taps, typing, app launch, alarms, notifications — safe-by-default with access modes and gated destructive ops.

★ 0
npx -y @dockndevai/mcp-android
GitHubnpm

mcp-core

TypeScript

Shared safe-by-default governance library for the dockndevai MCP server suite: capability/mode gating, resource allowlist + protected resources + opt-in flags, human-in-the-loop elicitation, symlink-safe path canonicalization, audit, and a buildServer + create-mcp-server scaffold.

★ 0
npx -y @dockndevai/mcp-core
GitHubnpm

mcp-ios

TypeScript

MCP server to drive a physical iPhone/iPad over Appium + WebDriverAgent (XCUITest) — safe-by-default with access modes and gated destructive ops.

★ 0
npx -y @dockndevai/mcp-ios
GitHubnpm
The approach

Test Electron & web apps over CDP, not screenshots

For any Chromium-based app there's a better way to let agents test their own changes than computer-use — attach to the app's DevTools instead of driving pixels. mcp-cdp is that tool.

Per-worktree, per-port

Start each agent in its own git worktree, run its own dev build with an explicit --remote-debugging-port, and attach mcp-cdp to that port. Each agent controls only its own app — no two agents fight over one desktop.

The DOM, console & network

Over the Chrome DevTools Protocol the agent reads the real DOM (not a screenshot), and sees what isn't on screen — console errors and failed requests. When a test fails, the reason is right there.

Runs anywhere

CDP works the same on macOS, Linux and Windows — including a headless VPS in the cloud, where OS-specific computer-use can't go. Same flow, any environment.

your-electron-app --remote-debugging-port=9222 && npx -y @dockndevai/mcp-cdp

Safe by default: read-only until you raise the mode, a target allowlist, sign-in pages and browser internals are inspect-only, arbitrary JS is gated behind an explicit flag, and the endpoint is loopback-only. See the mcp-cdp card and the bundled cdp-safe-operations skill.

One governance model

Least privilege, enforced — not documented

Every server shares a pure, unit-tested policy engine. Over-privileged tools are never even advertised to the model; each call is re-checked at runtime.

🔒

Read-only by default

Servers start in read-only mode. Write and admin tools aren't registered until you raise the access mode deliberately.

🎯

Allowlists & protected resources

Scope to specific namespaces, databases, projects or subscriptions. Protected resources can be read but never mutated.

🧨

Delete gating

Destructive operations need the admin mode and an explicit opt-in flag — the most dangerous aren't registered without it.

✍️

Human-in-the-loop approval

Destructive & high-impact actions pause and ask the person to approve — live, via MCP elicitation — before they run. A model can't approve on your behalf.

🧪

Dry-run

Validate and log write intent without executing it — preview exactly what an agent would change.

🧾

JSON audit log

Every guarded operation emits a structured audit line to stderr. Secrets are redacted from all output.

🛡️

Local AI risk guard (optional)

laya-guard classifies high-risk commands (shell, JS eval, apply/delete/exec) allow / confirm / block with a local decision model before they run. Defence in depth that only ever tightens, never grants; fails closed; fully on-device. Wired into every mutating server in the suite (15 servers) — off by default, enabled per-server with one flag.

Interactive confirmation — the agent asks to delete a dashboard; the server pauses and asks the human via MCP elicitation. Declining leaves it untouched; approving proceeds.
Human-in-the-loop confirmation in action.
Platforms behind them

The systems the agents sit on top of

The MCP servers are adapters. These are the real platforms I build and run underneath.

ossian

RAG platform

Open-book RAG over your own documents — Spring Boot + Spring AI, a React console, Keycloak OAuth2, Postgres/pgvector and Redis. Answers with citations, plus a maintenance side for ingestion, re-indexing and coverage gaps. ossian-mcp is its agent adapter.

GitHub

spring-llm-gateway

LLM gateway

An LLM gateway on Spring Cloud Gateway (WebFlux): virtual keys, token quotas, usage metering and failover for self-hosted OpenAI-compatible backends (vLLM, Ollama).

GitHub
Otto

A voice for the Claude you already run

A realtime, voice-driven assistant with Claude as the brain: local Whisper STT, streaming TTS with barge-in, subagents, and a web dashboard.

homebrew-otto

Install

A brew tap to install Otto.

brew install dockndevai/otto/otto
GitHub
Hands-on labs

Runnable reference environments

Every claim measured, every failure documented. Most pair with an MCP server above.

percona-pg-lab

Database

PostgreSQL + PgBouncer on Kubernetes with the Percona Operator — HA, DR, connection pooling, backups, observability. Pairs with mcp-percona-pg.

GitHub

kafka-lifecycle-lab

Streaming

Operating Apache Kafka on Kubernetes with Strimzi — provision, upgrade, DR with MirrorMaker 2, and read-only agent triage. Pairs with mcp-kafka.

GitHub

mac-attack

On-device AI

A macOS game and real screensaver: the camera turns people into cartoon characters and a local decision model (Laya) directs harmless toy chaos at them — ~340 ms per decision on an M2 Pro. Body rectangles only, no face recognition, nothing recorded or uploaded. Documents what macOS refuses: a screensaver can never get camera access, so a launchd helper owns the camera and publishes anonymous boxes over localhost.

GitHub · Download for Mac
Get started

Add one to your agent in a minute

Every server is a standard stdio MCP server on npm. Here it is in Claude Code — start in read-only and raise the mode when you need to.

# Claude Code — mcp-kubernetes, read-only
claude mcp add kubernetes \
  -e K8S_MODE="read-only" \
  -- npx -y @dockndevai/mcp-kubernetes

# Or wire any server into claude_desktop_config.json:
{
  "mcpServers": {
    "kubernetes": {
      "command": "npx",
      "args": ["-y", "@dockndevai/mcp-kubernetes"],
      "env": { "K8S_MODE": "read-only" }
    }
  }
}
  1. Pick a server from the Products menu and copy its npx command.
  2. Start read-only. Every server boots in the safest mode; only read tools are exposed.
  3. Raise the mode deliberately when you need writes — read-write, then admin plus an opt-in flag for anything destructive.
  4. Per-client setup (Claude, Cursor, Codex, VS Code, Windsurf) is in each repo's docs/CLIENTS.md.
Around the web

Where I share & ship

The suite is built in the open and promoted across the developer community — code, packages, writing, and discussion.

🐙GitHub
Source for all 20 servers + platforms 💼LinkedIn
Professional profile ✖️X / Twitter
Updates & launches ✍️Dev.to
Long-form write-ups 📝CoderLegion
Guest articles 🟠Reddit
r/mcp & r/LocalLLaMA 🟧Hacker News
Show HN 📦npm
@dockndevai packages ☕Maven
Java artifacts · io.github.dockndevai 🗂️MCP Registry
Official listings ⭐Awesome MCP
Community directory