Plenty of database servers offer a read-only mode. A mode is a setting, and settings get changed by whoever is trying to make something work at the time. Here the write path does not exist in the tool list at all, and the query tool names the four statement types it accepts. That is a meaningful difference when the caller is a model that will, eventually, try to fix a problem by writing to the database. The three introspection tools are what make the read side actually usable — an agent that can read the schema writes a query that runs, and one that cannot writes a query about columns it imagined.
A read-only PostgreSQL client with five tools: connect, query, and three that describe the database — schemas, tables and a single table's structure.
- query accepts SELECT, WITH, EXPLAIN and SHOW, and nothing else — there is no write tool to disable.
- list_schemas, list_tables and describe_table give an agent the structure it needs to write a correct query instead of guessing at column names.
- connect_db is documented as being for the case where no default connection exists, so the normal path is configured rather than passed per call.
A PostgreSQL connection, normally configured as the default rather than supplied per call.
One command plus a key — npx mcp-postgres-secure --access-mode readonly, then supply credentials