How are you giving your agents database access without handing them write privileges?

Building agents that need to read from a database keeps running into the same tension: to let the agent query your data, you usually give it a connection string — and now your agent can also UPDATE, DELETE, or DROP if it hallucinates a "fix" or gets prompt-injected into one.

For most agent use cases the actual need is read access: look up a record, check the schema, pull some rows to reason over. The write capability is pure downside — it's where all the blast radius lives and almost none of the value.

So I built an MCP server that gives an agent read access and makes writes impossible, not just discouraged:

• Point it at a Postgres connection string, it exposes an MCP endpoint your agent connects to.
• Every query runs inside a READ ONLY transaction — even if the agent generates a destructive query, the database refuses it.
• A guard rejects mutation statements and dangerous functions (file reads, SSRF-style calls) before they execute.
• Returns schema + results as structured content the agent can act on, no second round trip.

The thing I keep coming back to: an agent with read-only data access is useful; an agent with write access to prod is a liability you haven't been billed for yet.

Curious how others here handle this — separate read replica? Restricted role? App-layer wrapper? Just trusting the model? There's a sandbox to try the approach without connecting your own DB (link in comments).