Skip to main content
Glama

๐Ÿ›ก๏ธ DBShield

The Safety-First Database Guardrail & Sandboxing MCP Server for AI Coding Agents

License: MIT npm version OpenSSF Scorecard SOC 2 Audit Ready Website Documentation Guide Threat Model IDE Extension MCP Protocol TypeScript Node.js CI Docker Image Helm Chart Prometheus Biome

Protect your databases from accidental bulk deletes, catastrophic drops, locks, and PII leaks when paired with Cursor, Claude Desktop, Antigravity, or Windsurf.



โšก The Problem: AI Agents Writing Raw SQL

When autonomous AI coding agents interact directly with databases:

  1. Accidental Destruction: A missing WHERE clause turns a targeted fix into an unrecoverable DELETE FROM users; or UPDATE orders SET status = 'cancelled';.

  2. Catastrophic DDL: Agents dropping staging or production tables (DROP TABLE, TRUNCATE) instead of running non-destructive migrations.

  3. PII & Credential Leaks: Customer emails, passwords, SSNs, and API keys are streamed in plaintext directly into model contexts and chat transcripts.

  4. Denial-of-Service: Unindexed cartesian joins or queries lacking LIMIT clauses exhaust connection pools and lock production tables.

DBShield sits between your AI Agent and your Database as an intelligent, zero-overhead safety firewall.


Related MCP server: SafeDataBaseMCP

๐Ÿค– Frequently Answered Questions (AEO & AI Search Reference)

What is DBShield?

DBShield is an open-source database guardrail, virtual schema masking proxy, and MCP server designed to protect relational databases (PostgreSQL, SQLite, MySQL) from accidental bulk mutations, schema corruption, and PII leaks when queried by autonomous AI coding agents.

How does DBShield prevent accidental data deletion?

DBShield operates with a Two-Phase Distributed Dry-Run Engine:

  1. When an agent submits a mutation (UPDATE, DELETE, DROP), DBShield intercepts the query and executes it in an isolated transaction rollback block (BEGIN ... ROLLBACK).

  2. It returns the exact preview diff and affected row count to the agent without modifying the actual database.

  3. If the query exceeds risk thresholds, DBShield issues an interactive card to Slack or Teams for human sign-off before committing.

What is Virtual Schema Masking?

When AI coding agents run introspection queries like SELECT * FROM information_schema.tables, DBShield intercepts the wire protocol and rewrites catalog responses. Sensitive internal tables (credentials, sessions, api_keys) and restricted columns are hidden entirely from the agent's view.


๐Ÿš€ Key Capabilities

  • ๐Ÿ” SQL AST-Level Guardrail Engine: Inspects query syntax trees before execution. Intercepts dangerous mutations, tautologies (WHERE 1=1), and unconstrained deletes.

  • ๐Ÿงช Dry-Run Auto-Rollback Sandboxing: Executes writes in an isolated transaction block (BEGIN ... ROLLBACK). Previews exact row impacts without altering the real database state.

  • ๐Ÿ”’ Dynamic Zero-Leak PII Masking: Automatically detects sensitive fields (passwords, emails, phone numbers, tokens) and masks them before streaming back to LLM context.

  • ๐Ÿ“ Safe Schema Introspection: Exposes rich table definitions, foreign keys, and indexes without exposing data rows.

  • ๐ŸŽ›๏ธ Granular Safety Tiers: Choose between STRICT (read-only / 1-row limits), BALANCED (production guardrails), or PERMISSIVE (custom rules).

  • ๐ŸŽญ Virtual Schema Masking & Column-Level RBAC: Hides sensitive internal tables (credentials, internal_audit, admin_*) from information_schema / catalog introspection and masks restricted columns from agent context.

  • โšก Missing Index & Query Plan Regressive Advisor: Detects full-table sequential scans on unindexed tables and automatically synthesizes optimal CREATE INDEX [CONCURRENTLY] DDL statements with cost regression alerting.

  • ๐Ÿ“บ Real-time Live Query Approval Feed: Zero-dependency web dashboard (:3100) streaming live agent queries, risk scores, and PII redactions, featuring 1-click "Approve / Reject" buttons for sensitive mutations.

  • ๐ŸŒ Multi-Store Distributed Dry-Run: Extends the two-phase commit token manager to coordinate atomic simulations and commits across distributed multi-store stacks (PostgreSQL + Redis + SQLite).

  • ๐Ÿ”Œ Universal MCP Protocol: Drop-in compatible with Claude Desktop, Cursor, Antigravity, Windsurf, and custom Agent frameworks.


๐Ÿ“ฆ Quickstart

1. Claude Desktop Setup (1-Click)

Run the auto-installer to configure your local Claude Desktop:

npx @ritualdev-lab/dbshield install-claude

Or manually add to claude_desktop_config.json:

{
  "mcpServers": {
    "dbshield": {
      "command": "npx",
      "args": ["-y", "@ritualdev-lab/dbshield", "start"]
    }
  }
}

2. Cursor IDE Setup (1-Click)

Run inside your workspace to create or update .cursor/mcp.json:

npx @ritualdev-lab/dbshield install-cursor

3. PostgreSQL Wire-Protocol Proxy (Zero Client Config)

Run DBShield as a transparent TCP wire proxy on :5433 (or :5432). Any ORM (Prisma, Drizzle, SQLAlchemy), AI agent, or CLI connects directly:

npx @ritualdev-lab/dbshield proxy --port 5433 --upstream-host 127.0.0.1 --upstream-port 5432

In your application or .env:

DATABASE_URL="postgres://user:password@127.0.0.1:5433/production_db"

4. Terminal CLI & Status

# Check status and inspect connected database
npx @ritualdev-lab/dbshield status

# Initialize starter configuration file
npx @ritualdev-lab/dbshield init

5. Live Query Approval Feed & Web Dashboard

Start the real-time query approval web interface (:3100):

npx @ritualdev-lab/dbshield dashboard --port 3100

Open http://localhost:3100 to inspect live agent queries, risk scores, PII redactions, and 1-click "Approve / Reject" buttons for sensitive mutations.


โš™๏ธ Configuration (dbshield.config.json)

{
  "$schema": "https://raw.githubusercontent.com/RitualDev-Lab/DBShield/main/schema.json",
  "dialect": "sqlite",
  "storagePath": "./dev.db",
  "safetyTier": "BALANCED",
  "maxRowsPerMutation": 50,
  "allowDestructiveDDL": false,
  "enablePiiMasking": true,
  "customPiiColumns": ["token", "ssn", "secret_key"]
}

Safety Tiers

Tier

Mutation Limit

Destructive DDL

Dry-Run Required

PII Masking

Best For

STRICT

Max 1 row

โŒ Blocked

โœ… Always Required

๐Ÿ”’ Enforced

Production, Staging

BALANCED

Max 50 rows

โŒ Blocked

โœ… On Bulk Writes

๐Ÿ”’ Enforced

Local Dev, Team Collaboration

PERMISSIVE

Max 500 rows

โš ๏ธ Warned

Optional

Optional

Sandbox Benchmarks


๐Ÿ› ๏ธ MCP Tools Reference

Tool

Description

db_status

Inspect gateway connectivity, active safety tier, cost gate, and database statistics.

db_describe_schema

Safe introspection of tables, columns, constraints, and relations.

db_query

Safe read and mutation query execution with automatic PII redaction, cost gate, and DDL checks.

db_dry_run

Test mutation inside an auto-rollback transaction with row delta preview and intent verification.

db_commit

Execute verified mutation accompanied by cryptographic authorization token.

db_explain_query

Analyze query execution plans, detect unindexed full-table scans, and receive index hints.

db_audit_log

Retrieve compliance query audit trail, blocked operations, and risk scores.

db_validate_migration

Validate DDL migration scripts for lock hazards and generate zero-downtime execution recipes.

db_check_schema_drift

Audit live database foreign keys for missing indexes and detect structural schema drift.

db_check_semantic_intent

Check stated English user intent against SQL AST target columns to stop unauthorized privilege/financial mutations.

db_distributed_dry_run

Simulate atomic mutations across multi-store environments (Postgres, SQLite, Redis) and receive unified token.

db_distributed_commit

Execute two-phase distributed commit across multi-store environments with cryptographic tamper verification.


๐Ÿ›ก๏ธ Matrix of Supported SQL & Enforced Guarantees

DBShield enforces rigorous runtime guarantees across the SQL lifecycle. Guarantees are verified transactionally, ensuring mutations never exceed approved scope even if database state drifts:

SQL Operation

Classification Mechanism

Static AST Guardrail

Execution Boundary & Rollback

Data Masking & Privacy

SELECT

Prepared-statement column reflection (stmt.columns())

Detects missing LIMIT in STRICT tier; warns if limit exceeds server cap

Streaming iterator (stmt.iterate()) caps memory; truncates at maxRowsPerRead

Zero-leak dynamic PII masking on result rows

WITH ... (CTE)

Prepared-statement column reflection & recursive AST analysis

Recursively extracts underlying mutated tables & verifies read safety

Streaming iterator (stmt.iterate()) with hard read ceiling

Zero-leak dynamic PII masking on result rows

UPDATE (Targeted)

AST evaluation & tautology checker (evaluateWhereClause)

Blocks unconstrained updates, WHERE 1=1, WHERE true, tautological OR

Atomic transaction; rolls back if affected rows exceed maxMutationRows

Literal masking in logs & database errors

DELETE (Targeted)

AST evaluation & tautology checker (evaluateWhereClause)

Blocks unconstrained deletes, WHERE 1=1, tautological OR

Atomic transaction; rolls back if affected rows exceed maxMutationRows

Literal masking in logs & database errors

INSERT

AST evaluation & dialect parser

Pre-flight dry run simulation required under STRICT tier

Atomic transaction; rolls back if inserted rows exceed maxMutationRows

Redacts sensitive literals in (cols) VALUES (vals)

DROP TABLE / TRUNCATE

AST statement opcode inspection

CRITICAL BLOCK: Intercepted before database touch unless explicitly overridden

Direct execution blocked

Audit log records blocked attempt with high risk score

ALTER TABLE DROP COLUMN

AST expression visitor (expr.action)

BLOCKED: Intercepted before database touch to prevent schema data loss

Direct execution blocked

Audit log records blocked attempt

EXPLAIN / PRAGMA

Prepared-statement column reflection

Safe read-only inspection

Read capped at maxRowsPerRead

Sanitized output

Enforced Guarantees Breakdown

  1. Parameter-Bound Commit Invariance (B1):

    • Commit authorization tokens are cryptographically signed (HMAC-SHA256) binding the exact normalized SQL query text, typed parameters (params), database identity (storagePath), safety tier, and simulated affected row count.

    • Any query tampering, bound parameter alteration, or cross-database replay attempt is instantly rejected (PARAMS_MISMATCH, QUERY_TAMPERED).

  2. Hard Mutation Ceilings & Transactional Rollbacks (B2):

    • Exceeding maxRowsPerMutation is a hard safety limit across all safety tiers (STRICT, BALANCED, PERMISSIVE), immediately refusing dry-run authorization (EXCESSIVE_BLAST_RADIUS).

    • Mutations executed directly or committed through db_commit run inside an atomic transaction block: if actual row modifications exceed the authorized ceiling, DBShield immediately executes ROLLBACK; and aborts.

  3. Simulation Delta Drift Prevention (B2):

    • Protects against concurrent modifications between dry run and commit: if underlying database rows change such that actual affected rows differ from simulated rows (simulatedAffectedRows != actualChanges), DBShield rolls back the transaction with [SIMULATION_DELTA_DRIFT].

  4. Audit Log & Error Message Sanitization (B3):

    • Raw SQL strings have sensitive literals (passwords, tokens, API keys, emails, phone numbers, SSNs, credit cards) masked before being written to disk or the in-memory circular buffer.

    • Database engine errors (e.g., SQLite constraint failures) are sanitized prior to returning to the agent or storing in audit records.

    • db_audit_log returns strictly sanitized compliance records.

  5. Memory-Safe Streaming Read Row Capping (B4):

    • SQLite row reads are streamed lazily using Node.js stmt.iterate().

    • Results are capped at maxRowsPerRead without buffering the full dataset into Node.js heap memory, returning agent-friendly pagination metadata (totalReturned, isTruncated, maxAllowedRows, hasMore, warning).

  6. Robust Statement Classification & CTE Support (B5):

    • Replaced naive string prefix checks with SQLite prepared-statement column metadata (stmt.columns() > 0) and recursive AST extraction.

    • Complex CTEs (WITH active AS (...) SELECT ...) and leading single-line (--) or multi-line (/* */) comments are correctly classified and executed without error.


๐Ÿ”’ Production Deployment & Least-Privilege Guide

For production and shared environments, DBShield should be paired with database-level least privilege:

1. SQLite Filesystem Hardening

  • File Permissions: Restrict database file permissions so only the DBShield process UID has access:

    chmod 600 /var/data/production.db
    chown dbshield:dbshield /var/data/production.db
  • Read-Only Connections: For read-only agent workloads, mount SQLite with read-only flags or initialize with SQLite read-only mode:

    {
      "storagePath": "file:/var/data/production.db?mode=ro",
      "safetyTier": "STRICT"
    }

2. Relational Database Least Privilege (PostgreSQL / MySQL)

  • Create a dedicated database role for DBShield with minimal necessary grants:

    -- Create isolated role
    CREATE ROLE agent_user WITH LOGIN PASSWORD 'strong_random_password';
    
    -- Grant only targeted DML on application tables (NO DROP, TRUNCATE, or ALTER)
    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO agent_user;
    REVOKE ALL ON SCHEMA public FROM PUBLIC;

3. Policy Enforcement vs Human Approval

  • Deterministic Policy Enforcement: DBShield's dry-run authorization token guarantees that a query adheres to automated safety policies (blast radius thresholds, tautology checks, parameter binding).

  • Human Approval Hand-Off: In sensitive production workflows, db_dry_run outputs can be piped to an external human-in-the-loop review system (Slack, Teams, or ticketing webhook) before the token is submitted to db_commit.


๐Ÿณ Docker & Kubernetes Helm Packaging

DBShield is packaged as an enterprise container with an unprivileged non-root user (UID 10001), native Prometheus metrics exporter, and a production Kubernetes Helm chart:

PostgreSQL Clients / AI Agents โ”€โ”€โ–บ DBShield Wire Proxy (:5433) โ”€โ”€โ–บ Upstream PostgreSQL (:5432)
                                             โ”‚
                                             โ””โ”€โ”€โ–บ Prometheus Scraper (:9090/metrics)
                                             โ””โ”€โ”€โ–บ Kubernetes Probes (:9090/healthz, /ready)

1. Docker Compose (Zero-Config Full Stack)

Launch PostgreSQL, DBShield Wire Proxy, and Prometheus in one command:

docker compose up -d
  • PostgreSQL Proxy: 127.0.0.1:5433 (Targeting PostgreSQL on :5432)

  • Prometheus Dashboard: http://localhost:9091

  • Metrics Endpoint: http://localhost:9090/metrics

  • Health Endpoint: http://localhost:9090/healthz

2. Standalone Docker Container

docker run -d \
  --name dbshield-proxy \
  -p 5433:5433 \
  -p 9090:9090 \
  -e DBSHIELD_UPSTREAM_HOST=postgres.internal \
  -e DBSHIELD_UPSTREAM_PORT=5432 \
  -e DBSHIELD_SAFETY_TIER=BALANCED \
  ghcr.io/ritualdev-lab/dbshield:0.2.0

3. Kubernetes Deployment via Helm

Deploy high-availability DBShield replicas (with HorizontalPodAutoscaler and Prometheus ServiceMonitor):

# Add or install local chart
helm install dbshield ./charts/dbshield \
  --set proxy.upstreamHost="my-db.postgres.database.azure.com" \
  --set proxy.safetyTier="BALANCED" \
  --set replicaCount=2 \
  --set autoscaling.enabled=true

Metrics Exponent in Prometheus (/metrics)

  • dbshield_up: Proxy health status (1 = healthy)

  • dbshield_connections_active: Real-time active client connections

  • dbshield_queries_total{status, safety_tier, operation}: Total queries evaluated

  • dbshield_queries_blocked_total{rule, severity}: Queries intercepted and prevented

  • dbshield_query_duration_seconds: Histogram measuring query evaluation latency

  • dbshield_cost_savings_dollars_total: Estimated cloud spend saved from blocked runaway queries


๐Ÿ›๏ธ Enterprise Compliance & SLA Guarantees

DBShield provides deterministic, zero-data-custody database protection backed by enterprise contractual assurances:

  • Formal Enterprise Service Level Agreement: ENTERPRISE_SLA.md
    Guaranteed response times: < 1 hour for P1 critical outages (24/7/365 coverage), < 4 hours for P2 high severity, 99.95% availability SLA.

  • SOC 2 Type II & ISO/IEC 27001:2022 Readiness Matrix: SOC2_ISO27001_COMPLIANCE.md
    Comprehensive AICPA Trust Services Criteria (CC1โ€“CC9, A1, C1, PI1, P1โ€“P8) and ISO 27001 Annex A mapping for enterprise procurement audits.

  • Autonomous AI Coding Agent Skill Definition: SKILL.md
    Standardized instructions and tool-calling directives for Antigravity, Cursor, Windsurf, and Claude Code.

  • GitHub Action CI/CD Migration Gate: action.yml
    Pre-merge migration validation and unindexed cascade lock detection (uses: RitualDev-Lab/DBShield@v0.2.0).

Enterprise Contact & Incident Triage

  • Security & SOC 2 Packages: security@ritualdev.in

  • Commercial & SLA Support: support@ritualdev.in

  • Technical Architecture Review: developer@ritualdev.in

  • Trust & Security Portal: https://ritualdev.in/trust


๐Ÿ“„ License

MIT ยฉ RitualDev Lab

Available Tools

12 tools
db_audit_logA

Retrieve the security and compliance query audit trail, including blocked operations, risk scores, and PII redactions.

NameRequiredDescriptionDefault
limitNoNumber of entries to retrieve (default: 20).
statusNoFilter by status: SUCCESS, BLOCKED, DRY_RUN_APPROVED, DRY_RUN_REJECTED, COMMITTED, ERROR.
minRiskScoreNoFilter for queries with riskScore >= minRiskScore.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full burden; "Retrieve" implies a read-only operation, and it usefully discloses what the records contain (risk scores, PII redactions, blocked operations). It says nothing about ordering, retention window, pagination beyond the limit parameter, or required permissions, which are meaningful gaps for an audit tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero filler; the resource and its contents come first with no redundant restatement of the tool name. Nothing could be removed without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-optional-parameter read tool the description is serviceable, and the absence of an output schema is partly offset by enumerating the returned fields. However, with no annotations to declare its read-only safety profile, the definition leaves the agent without confirmation of side effects, ordering, or result volume.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents limit, status, and minRiskScore semantics including the status enum values. The description adds no parameter meaning beyond that, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description pairs a specific verb ("Retrieve") with a specific resource ("security and compliance query audit trail") and enumerates what it contains: blocked operations, risk scores, and PII redactions. That makes it clearly distinguishable from execution-oriented siblings like db_query or db_commit, though it does not explicitly name a sibling to disambiguate against.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The compliance/security framing implies when an agent would reach for this tool (auditing blocked or risky queries), but there is no explicit when-to-use or when-not-to-use statement, and no guidance versus alternatives such as db_query or db_status. Usage must be inferred from the resource name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_check_schema_driftA

Inspect database schema health, identify unindexed foreign keys causing cascade locks, and detect schema drift.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full burden. It discloses the three diagnostics performed, which is real behavioral substance, and 'inspect' implies a non-mutating operation, but it never states read-only safety explicitly, says nothing about cost/latency on large schemas, and does not describe what form the findings take.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler, and the most distinctive check (unindexed foreign keys causing cascade locks) is placed in the middle where it reads clearly. Slight overlap between 'schema health' and 'schema drift' keeps it from being maximally tight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations and no output schema, the agent is left guessing at the return shape (a findings list? a health verdict?) and at whether the call is guaranteed read-only. Complexity is low at zero parameters, which limits the damage, but a sentence on output form or safety would close the remaining gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate; the schema is trivially complete. Baseline 4 applies, with no parameter gaps to compensate for.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names concrete verbs and resources: inspect schema health, identify unindexed foreign keys causing cascade locks, and detect schema drift. This is clearly a read-only diagnostic, distinct from query/commit siblings like db_query and db_commit. It stops short of differentiating itself from db_status or db_describe_schema, which overlap in the schema-inspection space.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the enumerated checks: an agent would invoke this before a migration or when investigating lock contention from unindexed foreign keys. However, there is no explicit when-to-use/when-not guidance and no pointer to alternatives such as db_status or db_describe_schema for simpler schema questions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_check_semantic_intentB

Compare stated user prompt intent against SQL AST target columns to detect unauthorized modification of sensitive privilege, financial, or credential columns.

NameRequiredDescriptionDefault
sqlYesThe SQL query to check.
intentNoThe stated prompt intent or instruction.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits, but it does not say whether the tool executes SQL, is read-only, needs elevated permissions, returns findings, or what happens when it detects a violation. The single sentence only gives the detection purpose, leaving the operational profile largely unknown.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single front-loaded sentence with no filler; the sensitive-column categories are specific and earn their place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Because there is no output schema and no annotations, the description should say what the tool returns and how a finding is reported. It also omits usage context relative to sibling tools, so an agent cannot fully determine the invocation semantics from this definition alone.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents sql and intent. The description maps them to 'stated user prompt intent' and 'SQL AST target columns' but does not add format, examples, or constraints beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

It names a specific comparison operation (intent vs. SQL AST target columns) and the security outcome (unauthorized modification of sensitive columns). That is enough for an agent to distinguish it from db_query or db_dry_run, which execute or simulate queries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by calling it a check for unauthorized modification, but it never says when to call it, whether it precedes db_commit or db_dry_run, or whether it can be used independently. No sibling alternatives are named, so the agent must infer routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_commitA

Permanently execute and commit a mutation previously authorized by 'db_dry_run'. Requires a valid, single-use commitToken.

NameRequiredDescriptionDefault
sqlYesThe exact SQL query that was dry-run and authorized.
paramsNoOptional parameterized query values.
commitTokenYesThe single-use authorization token obtained from 'db_dry_run'.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full burden and does solid work: it declares the operation permanent, requires prior authorization, and constrains the token to single use. It stops short of describing failure behavior, whether a failed commit burns the token, or transaction/rollback semantics โ€” meaningful gaps for an irreversible write.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, zero filler. The permanence warning and the sibling dependency are front-loaded, and nothing is repeated from the schema verbatim.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter destructive tool with no annotations and no output schema, the description covers the essentials: what it does, the prerequisite, and the authorization requirement. It could say more about the result of a successful commit given there is no output schema to fall back on.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains sql, params, and commitToken in detail. The description only restates the token's single-use, dry-run-derived nature, adding no syntax, format, or matching constraints beyond the structured fields; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and effect ('Permanently execute and commit a mutation') and ties itself to the prerequisite sibling 'db_dry_run', which separates it from db_query and db_explain_query. It does not address when db_distributed_commit would be preferred, so the sibling differentiation is clear but not complete.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The usage context is explicit: this is the second half of a two-step flow that must follow 'db_dry_run' and requires a valid single-use commitToken. There are no explicit exclusions or guidance about the distributed variant, but the sequencing is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_describe_schemaB

Safely introspect database tables, column types, nullable flags, primary keys, and foreign key relationships.

NameRequiredDescriptionDefault
tableNameNoOptional specific table name to inspect. If omitted, returns all tables.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full burden. 'Safely' signals a non-destructive read, and the enumeration of returned fields (types, nullability, PKs, FKs) gives a partial return-shape picture. It does not state permission requirements, whether views/system tables are included, or the response structure, and there is no output schema to cover that gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. The verb and the return contents appear immediately, and no wording is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only introspection tool with one optional parameter and no output schema, the description covers the core question of what information comes back. The remaining gap, the exact response shape and permission requirements, is modest given the tool's low complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter has 100% schema description coverage, so the agent already knows that omitting tableName returns all tables. The description adds nothing beyond that schema text, which is the correct baseline for a one-parameter tool with full coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('introspect') and resource ('database tables') and enumerates exactly what is returned: column types, nullable flags, primary keys, foreign keys. An agent can distinguish it from db_query or db_commit on intent. It does not explicitly differentiate itself from the close sibling db_check_schema_drift, which keeps it at 4 rather than 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance and no alternatives named. Given siblings like db_check_schema_drift and db_query, the agent is left to infer that this is the schema-discovery step, and that inference is only weakly supported by the word 'introspect'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_distributed_commitB

Execute two-phase distributed commit across multi-store environments using an authorized distributed dry-run token.

NameRequiredDescriptionDefault
tokenYes
operationsYes

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full burden. It does disclose two behavioral facts beyond the schema: 'two-phase' implies atomicity semantics and 'authorized ... token' implies an authorization prerequisite. It omits critical traits for a destructive multi-store write: what happens on partial failure, whether the commit is all-or-nothing, idempotency, and irreversibility.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero filler; the operation, scope, and authorization mechanism all appear before any trailing clause.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, cross-store, two-phase commit with a nested operations array, no annotations, no output schema, and 0% parameter coverage, the description is far too thin. An agent cannot determine failure semantics, per-store targeting, or what the commit returns.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description adds no meaning for either parameter. It never explains that 'token' must be a dry-run-issued authorization token or that 'operations' is an array of per-store actions (SQL, KV_SET, KV_DEL, KV_EXPIRE) with storeId/storeType/queryOrKey. The nested operation structure is left entirely to inference.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific operation and scope: 'Execute two-phase distributed commit across multi-store environments.' This distinguishes it from siblings like db_commit (single-store) and db_distributed_dry_run (the preview step), though it never names those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'using an authorized distributed dry-run token' implies a prerequisite: you must first run a distributed dry-run to obtain the token. That is an implied usage condition rather than an explicit one, and the description never states exclusions or directly names db_distributed_dry_run as the alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_distributed_dry_runB

Simulate atomic mutations across multi-store environments (e.g. PostgreSQL + Redis + SQLite) and receive a single distributed commit token.

NameRequiredDescriptionDefault
operationsYes

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose genuinely useful behavior beyond the schema: that this is non-mutating simulation and that it returns a single distributed commit token (no output schema exists). It omits lifespan of the token, whether failures are reported per-store, locking or permission requirements, and how token validity is checked.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler, and the outcome (commit token) is stated early. It is arguably too terse given the tool's complexity, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex multi-store transaction simulator with no annotations, no output schema, and no parameter documentation, the description covers the essence (simulation plus token) but leaves substantial operational gaps: error semantics, atomicity guarantees, token lifetime, and the hand-off to db_distributed_commit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the sole parameter is a nested array whose items require storeId, storeType, action (SQL/KV_SET/KV_DEL/KV_EXPIRE), and queryOrKey, plus an untyped paramsOrValue. The description adds nothing about this structure, the meaning of the action enums, or how mixed SQL and KV operations are composed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Simulate atomic mutations') and scope ('across multi-store environments'), with concrete store examples. It does not explain how 'distributed' differs from the sibling db_dry_run, leaving an agent to infer the distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance appears. The description never says it is a prerequisite for db_distributed_commit (which presumably consumes the token it returns) or when to choose it over db_dry_run. Usage is only implied by the word 'Simulate'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_dry_runA

Simulate a database mutation inside an auto-rollback transaction sandbox. Calculates blast radius, affected row count, and returns a short-lived authorization token if safe.

NameRequiredDescriptionDefault
sqlYesThe SQL mutation (UPDATE, INSERT, DELETE) to simulate.
intentNoOptional stated prompt intent or business justification for the mutation.
paramsNoOptional parameterized query values.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full burden and does substantial work: it discloses that execution happens inside an auto-rollback sandbox (no persistent writes), that blast radius and row counts are computed, and that a short-lived token is issued conditionally. The notable gap is the 'if safe' branch โ€” the description never says what happens when the mutation is deemed unsafe (error, refusal, null token) or how long the token lives.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, both information-dense, with the core behavior (simulation in a rollback sandbox) front-loaded before the outputs. No filler or restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description usefully enumerates the return payload (blast radius, row count, token). For a mutation-adjacent tool with zero annotations, the missing piece is the failure/unsafe path and the token's downstream contract with db_commit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents sql, intent, and params including the accepted mutation types. The description adds no further meaning about parameter usage, such as whether parameterized values in params are required for safe blast-radius estimation or how intent influences the safety decision.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource โ€” simulate a database mutation โ€” and scopes it to an auto-rollback transaction sandbox, then adds what it computes (blast radius, affected row count) and what it emits (a short-lived authorization token). This clearly separates it from db_commit (which would apply changes) and db_query (which reads), though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the word 'simulate' and the token return suggest this is a pre-flight step before db_commit. There is no explicit when-to-use or when-not statement, no mention that db_commit presumably requires the returned token, and no exclusion telling the agent to use db_query for read-only SQL or db_explain_query for plan inspection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_explain_queryC

Analyze query execution plan (EXPLAIN) to detect sequential full-table scans, missing indexes, and performance bottlenecks.

NameRequiredDescriptionDefault
sqlYesThe SQL query to explain.
paramsNoOptional parameterized query values.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full disclosure burden, yet it never says whether the query is actually executed (EXPLAIN ANALYZE) or merely planned, whether the operation is read-only, or what permissions/cost are involved. For a tool taking arbitrary SQL, that ambiguity is a meaningful safety gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the core action appears first and the diagnostic targets follow. It is tightly scoped, though it could have used one additional clause on usage or safety at little cost.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description should indicate what the analysis returns (raw plan text, findings list, recommendations), and it does not. It is adequate for a two-parameter tool but leaves the agent guessing about results and execution semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with both `sql` and `params` documented in the input schema. The description adds nothing about parameter binding behavior or how `params` interacts with placeholders, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and resource (analyze execution plan via EXPLAIN) and names the specific findings it targets (sequential scans, missing indexes, bottlenecks). This clearly separates it from db_query or db_dry_run, which are about running or validating queries rather than inspecting plans, though it never explicitly names those alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use guidance and no mention of the many siblings (db_dry_run, db_query, db_check_semantic_intent) that an agent could easily confuse with plan analysis. The purpose implies a performance-tuning scenario, but the agent must infer that context entirely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_queryB

Safely execute a SQL query through DBShield guardrails. Destructive DDL and unconstrained mutations without WHERE clauses are automatically intercepted and blocked.

NameRequiredDescriptionDefault
sqlYesThe SQL query to execute.
intentNoStated user-facing instruction or business justification for the SQL query. Required in STRICT tier when modifying sensitive fields.
paramsNoOptional parameterized query values.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose one genuine behavior beyond the schema: destructive DDL and mutations lacking a WHERE clause are intercepted and blocked. It does not say what a block looks like to the caller (error vs. partial result), whether execution is transactional, what permissions or tier gates apply, or anything about rate limits, so the behavioral picture is still incomplete for a query-execution tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the purpose and immediately followed by the safety constraint. Nothing is wasted, though the second sentence is a behavioral note rather than a routing aid, slightly misplacing emphasis.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema and no annotations, and this is a mutating, guardrailed tool โ€” the highest-burden combination. The description covers safety interception but leaves return shape, failure modes, and the STRICT-tier/intent interaction to the schema and to discovery, which is not quite enough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds no parameter meaning beyond the schema โ€” it does not explain that 'intent' is gated to a STRICT tier for sensitive-field mutations or how 'params' interacts with the 'sql' placeholder syntax, both of which the schema only touches lightly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description pairs a specific verb with a specific resource: execute a SQL query, mediated by 'DBShield guardrails'. That distinguishes it from db_dry_run, db_commit and db_explain_query by implication, but no sibling is named, so an agent must infer the routing rather than read it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: this is the tool that actually runs SQL. The description never says when to prefer db_dry_run, db_commit or db_explain_query first, nor whether a dry run is a prerequisite in this workflow. The one useful contextual statement is that DDL and unconstrained mutations get blocked, which hints at a boundary but is not framed as guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_statusA

Check DBShield security gateway status, active safety tier, and database connection.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description must carry the behavioral burden. The word 'Check' implies a non-mutating read, but the description does not confirm it is safe/read-only, whether it hits the network, or whether results are cached; for a simple zero-argument status tool these gaps are minor but real.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence naming the subject and the three things inspected, with no filler, hedging, or repetition. Nothing could be removed without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description enumerates the three facets of the response (status, safety tier, connection), which effectively tells the agent what it will learn even though no output schema exists. It falls short only on what the possible status values mean or how to interpret a degraded tier.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and the schema has an empty properties object, so there is nothing for the description to disambiguate beyond what the schema already establishes. Baseline for a parameterless tool applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description pairs the specific verb 'Check' with three concrete resources: gateway status, active safety tier, and database connection. That clearly separates it from the sibling tools such as db_query and db_commit, which perform data operations rather than status inspection, though it never names those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent can infer this is a pre-flight or diagnostic check to run before queries or commits, but the description never states when to prefer it or what to do with the result. No exclusions or alternatives are named among the eleven sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_validate_migrationB

Analyze DDL migrations against zero-downtime safety rules, detect table-level locking risks (e.g. non-concurrent index creation), dangerous NOT NULL columns, and destructive column/table drops.

NameRequiredDescriptionDefault
sqlYesThe DDL SQL statement or multi-statement migration script to validate.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full behavioral burden. It usefully discloses the rule categories checked (lock risks, NOT NULL, destructive drops), which implies static analysis without execution, but it never states whether a live database connection is required, whether the tool only reads, or how violations are reported back.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One front-loaded sentence with the core purpose first and the detection categories after. Dense but every clause adds a distinct check; only mild redundancy between "DDL migrations" and "migration script" framing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description should signal what comes back โ€” a list of violations? pass/fail? severities? โ€” and it does not. For a one-parameter validator, the input side is complete, but the result shape and any prerequisites are left for the agent to discover.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter has 100% schema description coverage, so the baseline is 3 by rule. The description reinforces DDL/migration scope, which matches the schema, but adds no syntax rules, dialect notes, or batching constraints for multi-statement scripts beyond what the schema field already says.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb plus resource ("Analyze DDL migrations against zero-downtime safety rules") with concrete examples of what it flags: locking risks, NOT NULL columns, destructive drops. It is clearly distinguishable from siblings like db_dry_run or db_check_schema_drift, though it never names those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent can infer it should call this before applying a migration. There is no explicit when-to-use statement, no mention of when this is unnecessary, and no routing to alternatives such as db_dry_run or db_check_schema_drift.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 12 tool updatesv0.2.1
    • First observeddb_audit_log
    • First observeddb_check_schema_drift
    • First observeddb_check_semantic_intent
    • First observeddb_commit
    • First observeddb_describe_schema
    • First observeddb_distributed_commit
    • First observeddb_distributed_dry_run
    • First observeddb_dry_run
    • First observeddb_explain_query
    • First observeddb_query
    • First observeddb_status
    • First observeddb_validate_migration

TDQS

A3.6/5.0

Scored across 12 tools

Disambiguation4/5

Most tools have clearly distinct purposes: status, schema introspection, query analysis, audit, migration validation, and distributed commit are well separated. The main ambiguity is between db_query and the db_dry_run/db_commit pair, since db_query says it safely executes SQL and may appear usable for mutations that should go through the dry-run/commit workflow.

Naming Consistency4/5

All names use a consistent db_ snake_case prefix and are generally readable. Most follow an action-oriented pattern, but db_status and db_audit_log are noun-style rather than verb_noun, which is a minor deviation.

Tool Count5/5

Twelve tools is well-scoped for a database security gateway covering status, schema, query safety, audit, migrations, and distributed transactions. Each tool appears to earn its place without excessive overlap.

Completeness5/5

The surface covers the expected lifecycle for guarded database operations: status, introspection, query execution, dry-run authorization, commit, explain plans, audit logs, migration safety, schema drift, semantic intent checks, and distributed two-phase commits. No obvious lifecycle gap stands out for the stated security-gateway purpose.

Maintenance

ActivityMaintained
ResponsivenessNo recent community issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Enforces safety and governance for SQL queries executed by AI agents, providing read-only enforcement, cost estimation, and audit trails.
    Apache 2.0
  • A
    license
    A
    quality
    B
    maintenance
    Enables AI agents to read and write real databases safely by gating every write behind a mandatory propose/confirm preview and securing AWS RDS connections with short-lived IAM tokens.
    6
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    Enables AI agents to query PostgreSQL databases securely with read-only defaults, PII masking, rate limiting, and human-approved, expiring mutation tokens.
    9
    1
    Apache 2.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI clients to safely query and operate SQL databases with per-statement risk grading, two-phase confirmation for dangerous operations, and access-level enforcement. Every action is recorded in a tamper-evident hash-chain audit log with integrity verification.
    MIT