diff --git a/.config/claude-rc/README.md b/.config/claude-rc/README.md
index b047e8e..a8e9df9 100644
--- a/.config/claude-rc/README.md
+++ b/.config/claude-rc/README.md
@@ -1,7 +1,7 @@
 # Always-on Remote Control
 
 Reference copy of a machine setup: Claude Code Remote Control running as its own system user `claude-rc`, so my
-projects' read-only MCP servers (now: negsplit) can be used from the Claude app on the phone. One user and one
+projects' read-only MCP servers (now: negsplit, ens-forecast) can be used from the Claude app on the phone. One user and one
 session (`data`) for all projects. The user holds only read-only database logins; Bash runs sandboxed without
 network and can't read them (only the MCP servers, which run outside the sandbox, do). Nothing secret in this
 folder: the ntfy topic lives only in `/etc/claude-rc-notify.env`.
@@ -14,6 +14,12 @@ Needs `claude-code`, `bubblewrap`, `socat` and each project's MCP server install
   ```
   mariadb -u root -p -e "ALTER USER 'garmin_ro'@'localhost' WITH MAX_STATEMENT_TIME 30;"
   ```
+- ens-forecast: the installed `ens-forecast-mcp` (with `python-mcp` and `python-mysqlclient`) and the `weather_ro`
+  grant from its `sql/weather_grants.sql`; the same safety net:
+
+  ```
+  mariadb -u root -p -e "ALTER USER 'weather_ro'@'localhost' WITH MAX_STATEMENT_TIME 30;"
+  ```
 
 ## Setup
 
@@ -37,6 +43,13 @@ doas install -d -o claude-rc -g claude-rc -m 700 /var/lib/claude-rc/.config/negs
 doas install -o claude-rc -g claude-rc -m 600 config.toml /var/lib/claude-rc/.config/negsplit/config.toml
 ```
 
+ens-forecast (`weather_ro`): only the `[readonly]` section of my own config, so the password never shows:
+
+```
+doas install -d -o claude-rc -g claude-rc -m 700 /var/lib/claude-rc/.config/ens-forecast
+awk '/^\[/ { keep = ($0 == "[readonly]") } keep' ~/.config/ens-forecast/config.toml | doas install -o claude-rc -g claude-rc -m 600 /dev/stdin /var/lib/claude-rc/.config/ens-forecast/config.toml
+```
+
 Log in, trust the folder and enable Remote Control once, interactively:
 
 ```
diff --git a/.config/claude-rc/mcp.json b/.config/claude-rc/mcp.json
index f2743bf..33c25bd 100644
--- a/.config/claude-rc/mcp.json
+++ b/.config/claude-rc/mcp.json
@@ -3,6 +3,9 @@
     "negsplit": {
       "command": "negsplit",
       "args": ["mcp"]
+    },
+    "ens-forecast": {
+      "command": "ens-forecast-mcp"
     }
   }
 }
diff --git a/.config/claude-rc/project-settings.json b/.config/claude-rc/project-settings.json
index bb8f9a0..bf877ab 100644
--- a/.config/claude-rc/project-settings.json
+++ b/.config/claude-rc/project-settings.json
@@ -5,6 +5,7 @@
     "disableAutoMode": "disable",
     "allow": [
       "mcp__negsplit",
+      "mcp__ens-forecast",
       "Read(~/.local/share/negsplit/charts/**)"
     ],
     "deny": [