ClickHouse MCP — Read-Only Defaults + Drop Protection

Practical Notes

• Quant: keep CLICKHOUSE_ALLOW_WRITE_ACCESS off by default; enable it only for controlled workflows (migrations, backfills).
• Quant: destructive ops require a second flag (CLICKHOUSE_ALLOW_DROP=true)—use that as a policy gate for production safety.

Rollout pattern

• Start with the ClickHouse SQL playground credentials or a staging cluster to validate connectivity and result formats.
• Keep writes disabled; create a second server instance for admin tasks if you truly need mutations.
• Enable auth before exposing HTTP/SSE to any shared network and rotate tokens regularly.

Watchouts

Even with write flags off, leaking sensitive query results into an LLM is still a risk. Apply query limits, masking, and least-privilege credentials.

FAQ

Q: Can it work without ClickHouse (local only)? A: Yes. The README describes a chDB mode that runs an embedded ClickHouse engine.

Q: How do I enable writes safely? A: Set CLICKHOUSE_ALLOW_WRITE_ACCESS=true, and keep CLICKHOUSE_ALLOW_DROP off unless you explicitly need destructive operations.

Q: What should I test first? A: Run one SELECT against a known table and verify the server refuses mutation queries in default mode.