{ "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-14T01:25:58.088Z", "record_id": "VXI-EXT-TOOL-TRUST-MOTHERDUCK-01-v1", "record_kind": "external_reference", "title": "MotherDuck local MCP: Read-only queries and host access", "system": "MotherDuck local MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does read-only mode isolate a self-hosted MotherDuck MCP server from its host?", "near_questions": [ "Does a read-only database connector isolate the host filesystem?", "Can a self-hosted query tool change local settings?", "How does MotherDuck local MCP differ from the remote service?", "Which identity does a local database connector use?", "What should I check before giving third parties query access?", "Does disabling writes prevent every sensitive host operation?", "Can database switching expand the available data?", "Does local execution keep query results away from the AI client?", "What evidence supports a host-isolation claim?", "Can I preserve the documented local-server boundary?", "Which server version was reviewed for read-only behaviour?", "When should a local query connector be reassessed?" ], "supported_claims": [ { "claim": "No. The publisher explicitly warns that read-only mode alone still allows filesystem access and DuckDB setting changes. The local server and hosted remote service have different boundaries. A data-write restriction is insufficient evidence of host isolation for third-party access.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "No. The publisher explicitly warns that read-only mode alone still allows filesystem access and DuckDB setting changes. The local server and hosted remote service have different boundaries. A data-write restriction is insufficient evidence of host isolation for third-party access.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-NEON-01-v1", "VXI-EXT-TOOL-TRUST-PRISMA-01-v1", "VXI-EXT-TOOL-TRUST-PLANETSCALE-01-v1", "VXI-EXT-TOOL-TRUST-AIVEN-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "MotherDuck local MCP read-only defaults and token requirements", "source_url": "https://github.com/motherduckdb/mcp-server-motherduck/blob/main/README.md", "checked_on": "2026-10-14", "candidate_record_id": "VXI-EXT-TOOL-TRUST-MOTHERDUCK-01-v1", "candidate_record_sha256": "a236e937a53d78adf199c6abe20a7934aaf50e3aa7f62f9ee2cf8981b598ef64", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "No. The publisher explicitly warns that read-only mode alone still allows filesystem access and DuckDB setting changes. The local server and hosted remote service have different boundaries. A data-write restriction is insufficient evidence of host isolation for third-party access.", "required_buyer_context": "Identify local or remote deployment, host exposure, database mode, service identity and filesystem restrictions.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "MotherDuck local MCP", "variant": "Publisher local DuckDB/MotherDuck server" }, "review_status": "documentation_review_only", "checked_on": "2026-10-14", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "MotherDuck publishes the local server; the buyer operates a self-hosted instance.", "source_ids": [ "motherduck" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Query DuckDB or MotherDuck through MCP.", "source_ids": [ "motherduck" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Reads selected database data and schema information.", "source_ids": [ "motherduck" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Write mode is optional; read-only mode does not itself restrict all host operations.", "source_ids": [ "motherduck" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "MotherDuck connections use a token; local DuckDB access uses the host environment.", "source_ids": [ "motherduck" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Database mode, database switching and host restrictions are separate settings.", "source_ids": [ "motherduck" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Local data may be returned to the assistant; remote databases add their own connection path.", "source_ids": [ "motherduck" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "A read-only label can conceal unresolved filesystem exposure.", "source_ids": [ "motherduck" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Host isolation, token scope and third-party deployment controls have not been tested.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "Require host-access evidence before treating self-hosted read-only access as isolated.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "motherduck", "url": "https://github.com/motherduckdb/mcp-server-motherduck/blob/main/README.md", "final_url": "https://github.com/motherduckdb/mcp-server-motherduck/blob/main/README.md", "title": "MotherDuck local MCP read-only defaults and token requirements", "checked_on": "2026-10-14", "sha256": "051db6971a3775888e1154e21459d9f49c128f37c2e23b98d9f6bf7d92fc4cc8", "bytes": 350336 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Save the distinction between database write protection and host isolation.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Recheck local server version, exposed transport and host restrictions." }, "change_history": [ { "version": 1, "date": "2026-10-14", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#motherduck-local-readonly-host-trust", "machine_readable_record": "/varexis-index/records/motherduck-local-readonly-host-trust.json" }