By default the Connector exposes 95 tools — including ones that create, update, and delete. Read-only mode registers only tools that read data. Anything that writes is hidden from the assistant entirely, not just marked "destructive."
$
kuali mcp setup --profile prod --tools read-only
$
kuali mcp setup --profile prod --client claude-code --tools read-only
Restart the AI client (or reload tools) and the destructive tools vanish.
Any _create, _update, _delete, _activate, _deactivate. Document lifecycle (submit, approve, sendback, duplicate). Workflow administration (bypass, retry, skip, reassign, trigger). Imports, integration invocation, file uploads, API key creation, form template updates, permission grants — and kuali_run, the arbitrary-command escape hatch.
If the assistant tries to call one of these, it simply doesn't see it in the tool list.
$
kuali mcp setup --profile sandbox
$
kuali mcp setup --profile prod --tools read-only
Same Connector binary, two config entries. For clients that keep one kuali entry at a time, register each profile as its own MCP server with a distinct name (kuali-sandbox, kuali-prod).
Your API key still has whatever permissions its owner has — if the key could read something you'd rather it couldn't, issue a key for a narrower Kuali user. And the assistant can still describe an action it would take; it just can't execute it.
ON THIS PAGE
<- All guidesPair read-only mode with a dedicated low-privilege API key for truly sensitive environments.
First connection ->
Ready-to-use prompts for curriculum, research, build apps, imports, workflow analysis, and reporting.
Browse prompts →
Tips for Claude Desktop, Claude Code, Codex, Gemini, Copilot, and VS Code.
AI assistants →
Skip the chat — every capability is also a plain kuali command, ready for scripts and CI.
Command reference →
