How to give AI read-only access with MCP

Why read-only is worth it

The principle is least privilege: give only the access that's needed. If the AI just needs to read — analyze documents, query data, make summaries — there's no reason to also give it the power to write. A read-only server can't write or delete, full stop: the most serious mistake (a ruined file, lost data) becomes impossible, not just unlikely.

Watch out for one point: read-only blocks changes, it doesn't eliminate every risk. An AI reading a confidential piece of data could still repeat it in the wrong context. Read-only is the foundation, not the whole defense.

How to do it

The detail changes depending on the type of server, but the idea is one.

For files: use a read-only filesystem server. The standard filesystem server also allows writing; there are versions designed for read-only. Look for a "read-only" filesystem server and use it instead of the normal one, so writing is ruled out from the start.
For databases: use read-only access. Connect the database with a user that can only read (SELECT queries), or choose a server that exposes only read tools. The working syntax, with a database server limited to reading:

{
  "mcpServers": {
    "data": {
      "command": "npx",
      "args": ["-y", "@executeautomation/database-server", "--sqlite", "/Users/yourname/data/archive.db", "--read-only"]
    }
  }
}

(Check on the server's page the exact name of the read-only option: it varies from server to server.)

Keep confirmations on anyway. Even with read-only, leave active the confirmation requests for any action that goes beyond simple reading.
Verify. Ask the AI to try to modify something: it must reply that it can't. If it succeeds, read-only is not active.

A concrete example

Paolo wants the AI to analyze his company's financial statements but is terrified it will delete or alter a file by mistake. He puts the statements in a folder and connects a read-only filesystem server pointed there. Then he tests it: he asks the AI to "delete the old file". The assistant replies that it doesn't have permission to modify anything in that folder.

Reassured, Paolo gets to work: "compare the financial statements of the last three years and tell me where costs grew". The AI reads and answers, with no way, not even by mistake, to touch the original files. Read-only gave him the usefulness without the anxiety.

When it does NOT work (and how to fix it)

If the standard server doesn't offer read-only

The official filesystem server also allows writing and has no per-folder switch. If you need real read-only, switch to a dedicated read-only filesystem server: there are some made for it. Don't rely on manual confirmation alone if the data really matters.

If sometimes you need to let the AI write

Keep two configurations: a read-only one for normal use, one with writing only when needed, pointed at a test copy. That way you never leave writing active "for convenience" on the real data, but you have it ready when you need it.

If the data is very sensitive

Read-only prevents changes, not exposure. For third parties' personal data or confidential data, weigh up whether the AI really needs to see it: sometimes the right choice is not to give access at all, or to work on an anonymized version.

A tip from someone who actually uses it

Set read-only as your default setting, and grant writing only as a conscious exception, for a specific task and for as long as it's needed. Flipping the mindset — "by default it can't touch anything, except when I allow it" — shields you from almost all incidents, because the dangerous case becomes the rare and deliberate one, not the everyday one.

Frequently asked questions

How do I know if read-only is really active?

Put it to the test: ask the AI to modify or delete something. If it's read-only, it will reply that it can't. It's a ten-second test worth more than any reassurance, and it's worth repeating after every configuration change.

Does read-only make the AI less useful?

For most everyday uses no: analyzing, summarizing, searching, comparing are all reading operations. You only need writing when you want the AI to produce or modify files and data, and that's exactly where you want to be present and give the go-ahead.

Is read-only one hundred percent safe?

Here's the misunderstanding to clear up: it blocks changes and deletions, which is a great deal, but it doesn't protect against everything. A sensitive piece of data read by the AI can end up in an answer or be combined with other things in an unwanted way. Read-only is the most important defense; it should be combined with trusted servers and with choosing what, really, is worth having it read.

Quick answer