diff --git a/CHANGELOG.md b/CHANGELOG.md
index f236a554..367dc4cd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ Status of the `main` branch. Changes prior to the next official version change w
   - `GetSymbolsOverviewTool`: ignored paths were not respected in LSP variant (fix in `SolidLanguageServer`)
   - Fix: Duplicate comments in re-saved YAML configuration files #1285
   - Security: Forbid `".."` in memory names to disallow accessing files outside dedicated memory directories
+  - Security: Restrict querying of external projects to read-only tools
 
 * JetBrains:
   - `Move` and `SafeDelete` tools: transform empty string to None (counteracts client errors)
diff --git a/src/serena/project_server.py b/src/serena/project_server.py
index ef88e883..11aa7b36 100644
--- a/src/serena/project_server.py
+++ b/src/serena/project_server.py
@@ -89,6 +89,8 @@ class ProjectServer:
         project = self._get_project(req.project_name)
         with self._agent.active_project_context(project):
             tool = self._agent.get_tool_by_name(req.tool_name)
+            if not tool.is_readonly():
+                raise ValueError(f"Tool '{req.tool_name}' is not read-only and cannot be executed via the query_project route")
             params = json.loads(req.tool_params_json)
             return tool.apply_ex(**params)