Safe Mode

Per-connection query execution controls, from no restrictions to full read-only lockdown

Each connection carries its own Safe Mode level, from no restrictions to full write protection. The level decides what happens before a query runs.

Set the Safe Mode level in the Customization pane of the connection form.

Levels

Level	Write Queries	Read Queries	Authentication
Silent	Execute immediately	Execute immediately	None
Alert	Confirmation dialog	Execute immediately	None
Alert (Full)	Confirmation dialog	Confirmation dialog	None
Safe Mode	Confirmation + Touch ID	Execute immediately	Touch ID / password
Safe Mode (Full)	Confirmation + Touch ID	Confirmation + Touch ID	Touch ID / password
Read-Only	Blocked entirely	Execute immediately	None

New connections default to Silent.

Some engines run read queries and nothing else. Cloudflare R2 SQL is one: its connections are pinned to Read-Only and the Safe Mode picker in the connection form is disabled.

How It Works

Silent

No restrictions. Queries execute immediately. TablePro still shows its built-in dangerous query warning for DROP, TRUNCATE, and DELETE-without-WHERE statements.

Alert

A confirmation dialog appears before executing write queries (INSERT, UPDATE, DELETE, DROP, TRUNCATE, ALTER, etc.). The dialog shows a preview of the SQL to be executed. Read queries run without prompts.

Alert (Full)

Same as Alert, but the confirmation dialog appears for ALL queries, including SELECT statements. Useful when you want to review every query before execution.

Safe Mode

Like Alert, but after confirming the dialog, you must also authenticate with Touch ID. Falls back to your macOS password if Touch ID is unavailable.

Safe Mode (Full)

Combines Alert (Full) and Safe Mode: every query requires both a confirmation dialog and Touch ID/password authentication.

Read-Only

All write operations are blocked. The UI disables:

• Inline cell editing
• Adding, deleting, and duplicating rows
• Table truncate and drop operations
• Import functionality

Read queries (SELECT) execute normally.

Drivers Without Read-Only Support

The Redis, MongoDB, and etcd drivers do not support read-only mode, so Safe Mode treats every query on these connections as a write. Alert and Safe Mode levels confirm every query; Read-Only blocks everything. Other non-SQL drivers (Cassandra, Elasticsearch, DynamoDB) classify reads and writes normally.

Toolbar Badge

The current Safe Mode level appears as a badge in the toolbar (orange for Alert levels, red for Safe Mode and Read-Only). Click it to change levels.

Safe Mode badge in the toolbar

Changing the level from the badge applies to the whole connection and stays set as you open other tables and tabs. It writes back to the saved connection, so the Customization pane shows the new level and the change reaches your other Macs when iCloud Sync is on. There is no session-only override.

Editing the level in the connection form works the same way round: the change reaches an open connection right away, so the badge and the form always agree.

Safe Mode gates apply to query execution, saving cell edits, table operations, and sidebar changes.

Server Read-Only Is Not Safe Mode

Safe Mode runs inside TablePro. It never changes anything on the database server, and it cannot make the server accept a write the server itself refuses.

If a save fails with a read-only error while Safe Mode is set to anything other than Read-Only, the database server is the one refusing the write. Common causes:

• You are connected to a read replica or a reader endpoint rather than the primary.
• The server runs with read_only or super_read_only turned on.
• The server or the session sets new transactions to read-only.

TablePro tells the transactions it opens for a write that they are read-write, so a server that only defaults new transactions to read-only accepts the save. A server that is genuinely read-only still refuses, and TablePro says the server refused it.

On MySQL and MariaDB you can check which one it is:

SHOW SESSION VARIABLES WHERE Variable_name IN
  ('transaction_read_only', 'tx_read_only', 'read_only', 'super_read_only', 'innodb_read_only');

innodb_read_only set to ON means you are on a replica. Connect to the primary to write.

External Clients

Safe Mode runs inside the app on every query you execute. External clients (Raycast, Cursor, Claude Desktop, and other MCP clients) hit a separate gate first.

A write request from an external client clears three locks in this order:

1. External Clients (per-connection: Blocked / Read Only / Read & Write). Set in the connection form’s Advanced pane. A Read Only connection rejects any write before the request reaches the database.
2. Token scope (per-integration, readOnly / readWrite / fullAccess). Issued by the pairing flow and bounded by External Access: effective permission is MIN(token.scope, connection.externalAccess).
3. Safe Mode (per-query). The same rules on this page apply once the request has been routed to the connection. Touch ID prompts and confirmation dialogs still appear, even for queries originating from an external client.

DROP and TRUNCATE always need an explicit confirmation phrase via the confirm_destructive_operation tool, regardless of token scope. See External API security model.