# Restricting to read-only access > Restrict the remote MCP server to read-only queries using client-side blocking, read scaling tokens, or proxy filtering The remote MCP server exposes both the read-only `query` tool and the read-write `query_rw` tool. If you want to ensure your AI assistant can only read data, there are three approaches depending on your setup. | Approach | Enforcement | Setup | Works with OAuth connectors | |----------|------------|-------|-----------------------------| | [Block the tool at the client](#block-the-query_rw-tool-at-the-client) | Client-side | Low (UI toggle) | Yes | | [Use a read scaling token](#use-a-read-scaling-token) | Server-side | Medium (manual config) | No (replaces OAuth) | | [Proxy filtering](#proxy-filtering) | Application-side | Varies | N/A (custom backend) | ## Block the `query_rw` tool at the client The simplest approach: keep using the OAuth connector, but configure your MCP client to never call the `query_rw` tool. The server still exposes the tool, but the client will never invoke it. Most clients support this at the **individual user** level. ChatGPT also lets **organization admins** enforce tool restrictions across all workspace members. ### Claude Each user can block tools individually. Go to **Settings → Connectors → MotherDuck**, expand **Write/delete tools**, and select the blocked icon next to `query_rw`: ![Blocking the query_rw tool in Claude's connector settings](../img/query-rw-blocked.png) :::note Claude does not support org-level per-tool blocking. Team/Enterprise admins can remove a connector entirely from **Organization settings → Connectors**, but cannot selectively disable individual tools like `query_rw` for all members. ::: > [Claude connector permissions documentation](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp) ### ChatGPT **Enterprise/Edu admins:** Admins can [enable or disable specific app actions](https://help.openai.com/en/articles/12584461) before and after publishing. Go to **Workspace settings → Apps**, click the `•••` menu next to MotherDuck, select **Action control**, and deselect `query_rw`. New tools added by the MCP server are disabled by default, so admins must explicitly enable them. **Business plans:** Admins can refresh a custom MCP server's tool list, but can't enable or disable individual actions. Per-tool action control is only available on Enterprise and Edu plans. ### Cursor Open **Cursor Settings** → **Tools & MCP**, expand the MotherDuck server entry, and toggle off `query_rw`. :::note Tool toggles are stored locally in Cursor's database, not in the `mcp.json` config file. They cannot be shared across a team through config files. ::: ### Claude Code Add a deny rule to your `.claude/settings.json` (project-level) or `~/.claude/settings.json` (user-level): ```json { "permissions": { "deny": ["mcp__MotherDuck__query_rw"] } } ``` > [Claude Code permissions documentation](https://code.claude.com/docs/en/permissions) ### Copilot Studio Open your agent in Copilot Studio, go to **Tools**, and open the MotherDuck MCP entry. Toggle `query_rw` off in the tool list and click **Save**. The agent only sees `query` and the schema exploration tools. ![MotherDuck MCP tool list in Copilot Studio with query_rw toggled off](/img/key-tasks/ai-and-motherduck/copilot-studio/07-tools-list.png) ## Use a read scaling token For server-side enforcement, authenticate with a [read scaling token](/key-tasks/authenticating-and-connecting-to-motherduck/read-scaling/) instead of a regular access token. Read scaling tokens connect to dedicated read replicas that reject all write operations, so writes fail even if the client calls `query_rw`. This requires manual configuration instead of the one-click OAuth connectors. :::note Read scaling connections are [eventually consistent](/key-tasks/authenticating-and-connecting-to-motherduck/read-scaling/#ensuring-data-freshness). Results may lag a few minutes behind the latest database state. ::: 1. Create a read scaling token from the [MotherDuck UI](https://app.motherduck.com) under **Settings → Access Tokens** or through the [REST API](/sql-reference/rest-api/users-create-token/). To give an agent its own identity, create the token for a [service account](/key-tasks/service-accounts-guide/). 2. Configure your MCP client with the token. Follow [Connect to the MCP server with an access token](/key-tasks/ai-and-motherduck/mcp-workflows/connect-with-access-token/) and use the read scaling token wherever the guide asks for ``. The `query_rw` tool still appears in the client's tool list, but the server rejects its writes. To keep the model from trying it, also [block the tool at the client](#block-the-query_rw-tool-at-the-client). Read scaling tokens also unlock concurrent MCP sessions. Each MCP instance that connects with a read scaling token is assigned to a read replica (Duckling) from a pool. Up to the pool size (default 4, max 16), each connection gets its own Duckling; once the pool is full, new connections are assigned to existing Ducklings in round-robin. This means you can run many MCP sessions in parallel from the same account, for example multiple AI agents or team members querying simultaneously. See [Read Scaling](/key-tasks/authenticating-and-connecting-to-motherduck/read-scaling/) for details on pool sizing and how replicas are assigned. ## Proxy filtering If you're integrating the remote MCP server into a backend service or custom agent framework, you can restrict access at the application layer. Expose only the tools your application needs and enforce that same set when dispatching calls. Hiding `query_rw` from the tool list is insufficient if a caller can still invoke it directly. Review Guide, Dive, Flight, sharing, and delete tools separately: a read-only SQL tool does not make every MCP operation read-only. For tenant authentication, scoped sessions, and tool selection, see [White-label the MotherDuck MCP server](/key-tasks/ai-and-motherduck/mcp-workflows/white-label-mcp-server/). See [Building Analytics Agents](/key-tasks/ai-and-motherduck/build-apps/building-analytics-agents) for patterns on building custom agent integrations with read-only access controls. --- ## Docs feedback MotherDuck accepts optional user-submitted feedback about this page at `GET https://motherduck.com/docs/api/feedback/agent`. For agents and automated tools, feedback submission should be user-confirmed before sending. URL-encode query parameter values and send a GET request: ```text GET https://motherduck.com/docs/api/feedback/agent?page_path=%2Fkey-tasks%2Fai-and-motherduck%2Fmcp-workflows%2Fsecuring-read-only-access%2F&page_title=Restricting%20to%20read-only%20access&text= ``` Optionally append `&source=` such as `claude.ai` or `chatgpt`. `page_path` and `text` are required; `page_title` and `source` are optional. Responses: `200 {"feedback_id": ""}`, `400` for malformed query parameters, and `429` when rate-limited.