MCP access profiles

For the complete documentation index see: llms.txt

All documentation pages available in markdown.

Access profiles control which MCP tools Aerospike Voyager exposes to your AI coding agent. Choosing the right profile limits the operations an agent can call during exploration and development, but it does not replace cluster-level access control.

Prerequisites

The MCP server started. See Setup.
You have at least one saved cluster connection.

A convenience guardrail, not a security boundary

Access profiles filter which tools an AI agent can call. Voyager matches on tool names only.

Profiles reduce the chance of unintended writes while you work with an agent. They do not enforce security at the database. Full Access exposes every tool, and even Read Only can still return sensitive data through read operations.

For clusters where an agent must stay within a specific privilege level, restrict the user account that Voyager uses to connect. Configure role-based access control (RBAC) on the cluster so the database refuses unauthorized operations even when Voyager’s profile is Full Access.

The Read Only profile omits execute_info and execute_info_on_node because the Aerospike info protocol carries both read and write subcommands on the same channel. Commands such as set-config:, truncate:, and recluster: could otherwise reach the cluster through a generic info tool call. Excluding these tools is the only reliable name-based filter Voyager can apply.

Available profiles

Voyager provides two access profiles.

Full Access

All 23 tools are available. The agent can read, write, delete, manage connections, and run info commands. The profile code returned by the server is full-access.

This is the default in the Voyager app. Use it during active development when you need the agent to create or update records or manage connections.

Read Only

Browse and read operations only. The profile code returned by the server is read-only.

Use it for safe exploration, schema discovery, and any context where you want to prevent the agent from modifying cluster data.

Allowed tools (11 total):

Connections: list_connections, get_connection, connect, disconnect, test_connection
Browsing: list_namespaces, list_sets, get_nodes
Record reads: get_record, record_exists, query

Blocked tools (12 total):

Record writes: create_record, update_record, delete_record, delete_bin, truncate_set
Connection writes: create_connection, update_connection, delete_connection
Cluster metadata: get_cluster_summary, get_namespace_stats
Cluster info: execute_info, execute_info_on_node

Note

Blocked tools still appear in the agent’s tools/list response. They are rejected at call time, not hidden. Calling a blocked tool returns an error naming the active profile and listing the allowed tools. Example:

tool "create_record" is blocked by active profile "read-only". Allowed tools:
get_connection, list_connections, connect, disconnect, test_connection,
list_namespaces, list_sets, get_nodes, get_record, record_exists, query, ...
To enable this tool, update the mcpToolProfile preference to "full-access"

The mcpToolProfile preference named in that error is Voyager’s stored setting, which you change with the Access profile selector on the MCP Server page.

How to switch profiles

Open Voyager.
Open the MCP Server page from the sidebar.
Use the Access profile selector to choose Full Access or Read Only.

The profile change takes effect immediately. The tool list returned by the server does not change, but subsequent calls to blocked tools are rejected until the profile is switched back.

Security considerations

Access profiles are one layer in a broader security model. Role-based access control (RBAC) on the connection user provides enforcement. Profiles provide a convenience guardrail inside Voyager.

Token authentication: When token auth is enabled, agents must include a valid Bearer token in the Authorization header. Without a valid token, the MCP server rejects all requests regardless of profile. See Setup for how to generate and manage tokens.

Localhost-only by default: The MCP server binds to 127.0.0.1 by default, which means it is not accessible from other machines on your network. Only agents running on the same machine can reach it unless the bind interface is explicitly changed.

When to use Read Only:

You are letting an agent explore an unfamiliar dataset or schema for the first time.
You are sharing an endpoint with others and want to prevent accidental writes.
You want to audit what the agent would do before granting write access.

When Full Access is appropriate:

You are actively developing against a local or development cluster.
The agent needs to create test records or manage connections as part of a development workflow.
You have reviewed the agent’s planned actions and are confident in its scope.