diff --git a/packages/xen-api/src/cli.js b/packages/xen-api/src/cli.js
index 834ffdf45..dde74bb27 100755
--- a/packages/xen-api/src/cli.js
+++ b/packages/xen-api/src/cli.js
@@ -41,10 +41,11 @@ const usage = `Usage: xen-api <url> <user> [<password>]`
 
 const main = coroutine(function * (args) {
   const opts = minimist(args, {
-    boolean: ['help', 'verbose'],
+    boolean: ['help', 'read-only', 'verbose'],
 
     alias: {
       help: 'h',
+      'read-only': 'ro',
       verbose: 'v'
     }
   })
@@ -73,7 +74,11 @@ const main = coroutine(function * (args) {
     })
   }
 
-  const xapi = createClient({url, auth: {user, password}})
+  const xapi = createClient({
+    url,
+    auth: { user, password },
+    readOnly: opts.ro
+  })
   yield xapi.connect()
 
   const repl = createRepl({
diff --git a/packages/xen-api/src/index.js b/packages/xen-api/src/index.js
index 39e6bc805..c62937672 100644
--- a/packages/xen-api/src/index.js
+++ b/packages/xen-api/src/index.js
@@ -195,6 +195,8 @@ export class Xapi extends EventEmitter {
       this._fromToken = ''
       this._objects.clear()
     })
+
+    this._readOnly = Boolean(opts.readOnly)
   }
 
   get sessionId () {
@@ -272,7 +274,9 @@ export class Xapi extends EventEmitter {
 
   // High level calls.
   call (method, ...args) {
-    return this._sessionCall(method, args)
+    return this._readOnly
+      ? Promise.reject(new Error(`cannot call ${method}() in read only mode`))
+      : this._sessionCall(method, args)
   }
 
   // Nice getter which returns the object for a given $id (internal to