Read-only database access for MCP servers

Read-only database access restricts an MCP server's tools to queries that do not modify data. It is the recommended posture for AI-agent callers. Enforce it both at the server's tool layer and, where possible, with a database role that has only SELECT rights.

A write-capable database tool lets an agent's tool calls alter state. Read-only bounds the blast radius to what can be read, which is usually all a research or analysis task needs.

Use a database role restricted to read-only privileges as a second layer beyond any server-side flag. Defense in depth protects data even if the server's read-only switch fails or is absent.