@@ -3,7 +3,7 @@ import { Tool } from "../../tool/tool"
 import { zodToJsonSchema } from "../tool-zod-compat"
 import * as Precedence from "../workspace/precedence"
 import * as Registry from "../native/connections/registry"
-import { classifyAndCheck, isSingleQuery } from "./sql-classify"
+import { classifyAndCheck, isSingleQuery, REMOTE_EXECUTE_CALL } from "./sql-classify"
 import { maskSql, tokenizeSql } from "./sql-tokenize"
 import { executeQuery, type QueryContext } from "../native/query-execution"
 
@@ -185,7 +185,9 @@ export function readSql(sql: string, dialect?: string): string {
     /\b(pg_try_advisory\w*|pg_advisory_unlock\w*|pg_advisory_lock\w*|pg_advisory_xact\w*|pg_terminate_backend|pg_cancel_backend|pg_reload_conf|pg_rotate_logfile|pg_promote|pg_switch_wal|pg_logical_emit_message|pg_create_\w*_replication_slot|pg_drop_replication_slot|pg_replication_slot_advance|pg_replication_origin_\w+|dblink|dblink_\w+|pg_notify|pg_stat_reset\w*|pg_wal_replay_\w+|pg_logical_slot_\w+|pg_replication_slot_\w+|get_lock|release_lock|release_all_locks|is_free_lock|is_used_lock|master_pos_wait|source_pos_wait|sleep|benchmark|pg_xlog_replay_\w+|pg_log_backend_memory_contexts|pg_create_restore_point|pg_backup_\w+|pg_start_backup|pg_stop_backup|lo_from_bytea)\s*\(/i.test(
       functions,
     ) ||
-    SIDE_EFFECT_FUNCTION_CALL.test(functions)
+    SIDE_EFFECT_FUNCTION_CALL.test(functions) ||
+    // DuckDB attachments run these statements remotely, outside the local read-only transaction.
+    REMOTE_EXECUTE_CALL.test(functions)
   ) {
     throw new Error(
       "sql_check only accepts a single read-only SELECT (or WITH ... SELECT); it never writes or fixes data.",
 
@@ -165,6 +165,9 @@ export function classifyMulti(sql: string, dialect?: string): "read" | "write" {
   return classify(sql, dialect)
 }
 
+/** DuckDB table functions that execute a statement on an attached PostgreSQL, MySQL or SQLite database. */
+export const REMOTE_EXECUTE_CALL = /\b(postgres_execute|mysql_execute|sqlite_execute)\s*\(/i
+
 /**
  * Single-pass: classify and check for hard-denied statement types.
  * Returns both the overall query type and whether a hard-deny pattern was found.
@@ -193,7 +196,13 @@ export function classifyAndCheck(sql: string, dialect?: string): {
         (s: { statement_type: string }) => s.statement_type && HARD_DENY_TYPES.has(s.statement_type.toUpperCase()),
       )
 
-    return { queryType: otherIsReadOnly(sql, result.statements, dialect) ? "read" : "write", blocked }
+    // DuckDB scanner functions run their statement on the attached remote database, outside any local
+    // read-only transaction, so a SELECT calling them is a write.
+    const remoteExecute = REMOTE_EXECUTE_CALL.test(maskSql(tokenizeSql(sql, dialect).tokens))
+    return {
+      queryType: !remoteExecute && otherIsReadOnly(sql, result.statements, dialect) ? "read" : "write",
+      blocked,
+    }
   } catch (error) {
     return { ...classifyFallback(sql, dialect), parseError: error instanceof Error ? error.message : String(error) }
   }
 
@@ -1044,6 +1044,8 @@ test.each([
   "lowrite(1, 'value')",
   "force_checkpoint()",
   "query('SELECT 1')",
+  "postgres_execute('remote', 'DELETE FROM orders')",
+  "mysql_execute('remote', 'DELETE FROM orders')",
   String.raw`U&"pg\005fterminate_backend"(1)`,
   String.raw`pg_catalog.U&"pg_terminate_\+000062ackend"(1)`,
   `U&"pg!005fcancel_backend" UESCAPE '!' (1)`,
 
@@ -358,3 +358,7 @@ describe("SQL-building aggregates are reads", () => {
     expect(r.parseError).toMatch(/Parse error.*Expected RParen/)
   })
 })
+
+test.each(["postgres_execute", "mysql_execute"])("a SELECT calling %s is classified as a write", (fn) => {
+  expect(classify(`SELECT * FROM ${fn}('remote', 'DELETE FROM orders')`, "duckdb")).toBe("write")
+})