Enforce read-only queries

[cpsievert]

Probably by parsing the SQL string suggested by the model before executing.

For Python, I think we could use https://github.com/tobymao/sqlglot
For R, we may want to wrap something like https://github.com/apache/datafusion-sqlparser-rs (into an optional dependency?)

Additional context https://claude.ai/share/929cdd9d-3ec0-4245-9a4a-b24066356cea

[gadenbuie]

I really don't think we should get into the business of parsing the SQL string. Databases have robust permission and privilege features that are practically the only reliable way we can recommend people guarantee that any data base user can take only read-only actions.

Instead of parsing the query, I think we should invest time in locking down the in-memory databases we use. And we should add an article to the documentation that describes the security implications that come with putting a querychat app into production. Establishing appropriate database permissions is entirely a very normal thing to do in that case, and we should be actively recommending it to devs.

[cpsievert]

Yea, maybe long-term it's something to consider, but I agree that encouraging proper permissions is the better short-term action.