docs: add CLICKHOUSE_TLS_MODE documentation

- Add CLICKHOUSE_TLS_MODE to README mTLS section with valid options
- Update ClickHouseConfig docstring with TLS_MODE variable

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: vkazmirchuk

README.md

@@ -352,6 +352,12 @@ These variables enable client certificate authentication for ClickHouse servers
   * Default: None
   * Optional if `CLICKHOUSE_CLIENT_CERT` is a `.pem` file containing both the certificate and private key
   * Example: `/path/to/client.key`
+* `CLICKHOUSE_TLS_MODE`: TLS mode for client certificate authentication
+  * Default: None (auto-detected based on `CLICKHOUSE_CLIENT_CERT`)
+  * Valid options:
+    * `"mutual"` - Use client certificate for authentication (default when `CLICKHOUSE_CLIENT_CERT` is set)
+    * `"proxy"` - TLS termination at proxy, use Basic Auth with client certs for TLS only
+    * `"strict"` - Strict TLS mode with Basic Auth
 
 #### chDB Variables
 

mcp_clickhouse/mcp_env.py

@@ -48,6 +48,7 @@ class ClickHouseConfig:
         CLICKHOUSE_CA_CERT: Path to CA certificate file for SSL verification (default: None)
         CLICKHOUSE_CLIENT_CERT: Path to client certificate file for mTLS authentication (default: None)
         CLICKHOUSE_CLIENT_CERT_KEY: Path to client private key file for mTLS authentication (default: None)
+        CLICKHOUSE_TLS_MODE: TLS mode for client certificate usage - "mutual", "proxy", or "strict" (default: None)
     """
 
     def __init__(self):