Read-safe workflows

Agents and MCPMCPSDKreadSaferead_safeinvoke_workflow_read_safe

Mark a side-effect-free workflow read-safe and read-scoped keys can run it, while every other workflow stays out of their reach.

The situation

A read-only key can list and search, but some questions need a computation: price a quote, look up a carrier’s transit time, summarize an order’s history. These run as workflows, and a read key cannot invoke workflows.

The recipe

Declare the workflow read-safe on its worker profile:

workers: [{
  taskQueue: 'quotes',
  workflow: priceQuote,
  config: {
    invocable: true,
    readSafe: true,
    description: 'Price a quote for an order. Reads only.',
  },
}],

A read-scoped caller then runs it through the read-safe variant of the invoke tool:

{ "workflow_type": "priceQuote", "data": { "orderId": "ORD-1042" } }

The tool takes the same parameters as invoke_workflow, runs the same input-schema gate, and returns the workflow id. The flag can also be set through the workflow-config admin surface as read_safe: true.

The guarantee

The flag on the config is the whole contract, and it is fail-closed: it defaults off. Any workflow may be attempted through invoke_workflow_read_safe; one without the flag, or one that is not invocable, fails with a clear error. Invocation roles still apply. OAuth’s “Allow read-only” consent grants exactly this: read what you can read, and run workflows marked read-safe. See MCP.

Agents and MCP