Feature Request: Add --read-only flag for Workers Bindings MCP server

[Paulitos]

Feature Request

Add a --read-only flag option for the Workers Bindings MCP server to allow users to grant only read permissions during OAuth.

Use Case

I want to use the MCP server to debug and inspect R2 buckets, D1 databases, and Workers without granting write access. This is important for:

• Security: Prevent accidental modifications from AI agents
• Debugging: Only need to inspect/read data, not modify it

Example: Supabase MCP

The Supabase MCP server supports this pattern:

npx -y @supabase/mcp-server-supabase@latest --read-only --project-ref=<project-ref>

The --read-only flag ensures the MCP server only requests read scopes during authentication.

Requested Change

Add a similar flag for Cloudflare MCP:

npx mcp-remote https://bindings.mcp.cloudflare.com/sse --read-only

Or provide a separate read-only endpoint:

npx mcp-remote https://bindings.mcp.cloudflare.com/sse/read-only

This would only request these OAuth scopes:

• User: Read
• Cloudflare Account: Read
• Cloudflare Workers/R2/D1: Read only (no write)
• Remove "Background Access" for read-only mode