diff --git a/core/commands/root.go b/core/commands/root.go
index 1b842a486..c99f02660 100644
--- a/core/commands/root.go
+++ b/core/commands/root.go
@@ -109,6 +109,14 @@ var rootSubcommands = map[string]*cmds.Command{
 	"version":   VersionCmd,
 	"bitswap":   BitswapCmd,
 }
+
+// RootRO is the readonly version of Root
+var RootRO = &cmds.Command{}
+
+var CommandsDaemonROCmd = CommandsCmd(RootRO)
+
+var RefsROCmd = &cmds.Command{}
+
 var rootROSubcommands = map[string]*cmds.Command{
 	"block": &cmds.Command{
 		Subcommands: map[string]*cmds.Command{
@@ -117,7 +125,7 @@ var rootROSubcommands = map[string]*cmds.Command{
 		},
 	},
 	"cat":      CatCmd,
-	"commands": CommandsDaemonCmd,
+	"commands": CommandsDaemonROCmd,
 	"ls":       LsCmd,
 	"name": &cmds.Command{
 		Subcommands: map[string]*cmds.Command{
@@ -132,14 +140,17 @@ var rootROSubcommands = map[string]*cmds.Command{
 			"stat":  objectStatCmd,
 		},
 	},
-	"refs": RefsCmd,
+	"refs": RefsROCmd,
 	//"resolve": ResolveCmd,
 }
 
-var RootRO = &cmds.Command{}
-
 func init() {
 	*RootRO = *Root
+
+	// sanitize readonly refs command
+	*RefsROCmd = *RefsCmd
+	RefsROCmd.Subcommands = map[string]*cmds.Command{}
+
 	Root.Subcommands = rootSubcommands
 	RootRO.Subcommands = rootROSubcommands
 }