To give an AI agent read-only access through MCP, enforce it where the data lives: use a credential that can only read, expose only read tools, and keep write paths behind a separate server and approval. A readOnly label on a tool is metadata, and the spec says clients must treat it as untrusted unless the server is trusted.
Why labels are not enough
MCP tool definitions can carry annotations that describe behaviour, such as a hint that a tool only reads. The tools page states that clients must consider annotations untrusted unless they come from trusted servers. A server can be wrong, outdated or hostile, so a hint cannot be your control.
OWASP gives the sturdier advice for excessive agency: grant downstream access only at the level required, such as read-only database access, and enforce authorization in the downstream system rather than relying on the model's decisions.
Three layers, in order of strength
| Layer | Example | Strength |
|---|---|---|
| Credential | A database role with select only, a token with read scope | Strongest |
| Server design | A server that exposes list and get tools only | Strong |
| Tool annotation | A read only hint | Informational |
Use all three, and rely on the first.
Steps
- Create a dedicated identity for the agent, never reuse a human or shared account.
- Give it read permission on the narrowest set of resources that supports the task.
- Run a read only MCP server for that identity, with no write, delete or admin tools.
- If writes are sometimes needed, run a second server with its own identity and approval step.
- Test it: try a write through the tool and directly with the credential, and confirm both fail.
- Log reads too, since reading can leak data.
What read only does not protect
Read access can still expose secrets, personal data and internal documents, and an injected instruction can ask the agent to send what it read somewhere else. Pair read only with limits on where the agent can send data, which the OWASP guidance on minimizing extensions and the rule of two both support.
The OAuth side helps as well. The spec recommends starting with a minimal scope set and raising it by challenge when needed, so the first token an agent holds is a read token.
Safeguard includes policies, gates and guardrails and agent identity for per agent access. A free scan is at https://gold.safeguard.sh/scan.
Try it yourself
Ask yourself, for each tool call in the demo, whether it reads or changes anything, and which credential would enforce that.
Click through it at your own pace, or open it full screen.
Quick check
Is a read only annotation enough?
No. It is a hint from the server. Enforce read only with the credential and the downstream permissions.
Can an agent leak data with read access alone?
Yes. Reading can expose secrets and an injected instruction can try to send them out, so limit outbound paths too.
Sources
- MCP specification: Tools (draft)
- OWASP GenAI: LLM06 Excessive Agency
- MCP specification: Security Best Practices (draft)
Last reviewed: 19 October 2026.
