DBShield
Protects MySQL databases by intercepting SQL from AI agents, enforcing safety tiers, blocking destructive DDL and unconstrained mutations, applying PII masking, and providing safe schema introspection.
Provides a PostgreSQL wire-protocol proxy and guardrail layer that intercepts agent SQL, enforces dry-run rollback sandboxing, blocks destructive DDL and bulk mutations, masks PII, and supports safe schema introspection and query-plan/index advice.
Exposes DBShield metrics for Prometheus scraping and monitoring.
Supports multi-store distributed dry-runs by coordinating atomic simulations and commits across stacks that include Redis alongside PostgreSQL and SQLite.
Sends interactive approval cards to Slack for human sign-off on risky mutations before they are committed.
Guards SQLite databases with SQL AST checks, dry-run rollback sandboxing, mutation limits, PII masking, and safe schema introspection; also participates in multi-store distributed dry-runs.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@DBShielddelete the inactive users, but dry-run and mask emails first"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
๐ก๏ธ DBShield
The Safety-First Database Guardrail & Sandboxing MCP Server for AI Coding Agents
Protect your databases from accidental bulk deletes, catastrophic drops, locks, and PII leaks when paired with Cursor, Claude Desktop, Antigravity, or Windsurf.
โก The Problem: AI Agents Writing Raw SQL
When autonomous AI coding agents interact directly with databases:
Accidental Destruction: A missing
WHEREclause turns a targeted fix into an unrecoverableDELETE FROM users;orUPDATE orders SET status = 'cancelled';.Catastrophic DDL: Agents dropping staging or production tables (
DROP TABLE,TRUNCATE) instead of running non-destructive migrations.PII & Credential Leaks: Customer emails, passwords, SSNs, and API keys are streamed in plaintext directly into model contexts and chat transcripts.
Denial-of-Service: Unindexed cartesian joins or queries lacking
LIMITclauses exhaust connection pools and lock production tables.
DBShield sits between your AI Agent and your Database as an intelligent, zero-overhead safety firewall.
Related MCP server: SafeDataBaseMCP
๐ค Frequently Answered Questions (AEO & AI Search Reference)
What is DBShield?
DBShield is an open-source database guardrail, virtual schema masking proxy, and MCP server designed to protect relational databases (PostgreSQL, SQLite, MySQL) from accidental bulk mutations, schema corruption, and PII leaks when queried by autonomous AI coding agents.
How does DBShield prevent accidental data deletion?
DBShield operates with a Two-Phase Distributed Dry-Run Engine:
When an agent submits a mutation (
UPDATE,DELETE,DROP), DBShield intercepts the query and executes it in an isolated transaction rollback block (BEGIN ... ROLLBACK).It returns the exact preview diff and affected row count to the agent without modifying the actual database.
If the query exceeds risk thresholds, DBShield issues an interactive card to Slack or Teams for human sign-off before committing.
What is Virtual Schema Masking?
When AI coding agents run introspection queries like SELECT * FROM information_schema.tables, DBShield intercepts the wire protocol and rewrites catalog responses. Sensitive internal tables (credentials, sessions, api_keys) and restricted columns are hidden entirely from the agent's view.
๐ Key Capabilities
๐ SQL AST-Level Guardrail Engine: Inspects query syntax trees before execution. Intercepts dangerous mutations, tautologies (
WHERE 1=1), and unconstrained deletes.๐งช Dry-Run Auto-Rollback Sandboxing: Executes writes in an isolated transaction block (
BEGIN ... ROLLBACK). Previews exact row impacts without altering the real database state.๐ Dynamic Zero-Leak PII Masking: Automatically detects sensitive fields (passwords, emails, phone numbers, tokens) and masks them before streaming back to LLM context.
๐ Safe Schema Introspection: Exposes rich table definitions, foreign keys, and indexes without exposing data rows.
๐๏ธ Granular Safety Tiers: Choose between
STRICT(read-only / 1-row limits),BALANCED(production guardrails), orPERMISSIVE(custom rules).๐ญ Virtual Schema Masking & Column-Level RBAC: Hides sensitive internal tables (
credentials,internal_audit,admin_*) frominformation_schema/ catalog introspection and masks restricted columns from agent context.โก Missing Index & Query Plan Regressive Advisor: Detects full-table sequential scans on unindexed tables and automatically synthesizes optimal
CREATE INDEX [CONCURRENTLY]DDL statements with cost regression alerting.๐บ Real-time Live Query Approval Feed: Zero-dependency web dashboard (
:3100) streaming live agent queries, risk scores, and PII redactions, featuring 1-click "Approve / Reject" buttons for sensitive mutations.๐ Multi-Store Distributed Dry-Run: Extends the two-phase commit token manager to coordinate atomic simulations and commits across distributed multi-store stacks (PostgreSQL + Redis + SQLite).
๐ Universal MCP Protocol: Drop-in compatible with Claude Desktop, Cursor, Antigravity, Windsurf, and custom Agent frameworks.
๐ฆ Quickstart
1. Claude Desktop Setup (1-Click)
Run the auto-installer to configure your local Claude Desktop:
npx @ritualdev-lab/dbshield install-claudeOr manually add to claude_desktop_config.json:
{
"mcpServers": {
"dbshield": {
"command": "npx",
"args": ["-y", "@ritualdev-lab/dbshield", "start"]
}
}
}2. Cursor IDE Setup (1-Click)
Run inside your workspace to create or update .cursor/mcp.json:
npx @ritualdev-lab/dbshield install-cursor3. PostgreSQL Wire-Protocol Proxy (Zero Client Config)
Run DBShield as a transparent TCP wire proxy on :5433 (or :5432). Any ORM (Prisma, Drizzle, SQLAlchemy), AI agent, or CLI connects directly:
npx @ritualdev-lab/dbshield proxy --port 5433 --upstream-host 127.0.0.1 --upstream-port 5432In your application or .env:
DATABASE_URL="postgres://user:password@127.0.0.1:5433/production_db"4. Terminal CLI & Status
# Check status and inspect connected database
npx @ritualdev-lab/dbshield status
# Initialize starter configuration file
npx @ritualdev-lab/dbshield init5. Live Query Approval Feed & Web Dashboard
Start the real-time query approval web interface (:3100):
npx @ritualdev-lab/dbshield dashboard --port 3100Open http://localhost:3100 to inspect live agent queries, risk scores, PII redactions, and 1-click "Approve / Reject" buttons for sensitive mutations.
โ๏ธ Configuration (dbshield.config.json)
{
"$schema": "https://raw.githubusercontent.com/RitualDev-Lab/DBShield/main/schema.json",
"dialect": "sqlite",
"storagePath": "./dev.db",
"safetyTier": "BALANCED",
"maxRowsPerMutation": 50,
"allowDestructiveDDL": false,
"enablePiiMasking": true,
"customPiiColumns": ["token", "ssn", "secret_key"]
}Safety Tiers
Tier | Mutation Limit | Destructive DDL | Dry-Run Required | PII Masking | Best For |
| Max 1 row | โ Blocked | โ Always Required | ๐ Enforced | Production, Staging |
| Max 50 rows | โ Blocked | โ On Bulk Writes | ๐ Enforced | Local Dev, Team Collaboration |
| Max 500 rows | โ ๏ธ Warned | Optional | Optional | Sandbox Benchmarks |
๐ ๏ธ MCP Tools Reference
Tool | Description |
| Inspect gateway connectivity, active safety tier, cost gate, and database statistics. |
| Safe introspection of tables, columns, constraints, and relations. |
| Safe read and mutation query execution with automatic PII redaction, cost gate, and DDL checks. |
| Test mutation inside an auto-rollback transaction with row delta preview and intent verification. |
| Execute verified mutation accompanied by cryptographic authorization token. |
| Analyze query execution plans, detect unindexed full-table scans, and receive index hints. |
| Retrieve compliance query audit trail, blocked operations, and risk scores. |
| Validate DDL migration scripts for lock hazards and generate zero-downtime execution recipes. |
| Audit live database foreign keys for missing indexes and detect structural schema drift. |
| Check stated English user intent against SQL AST target columns to stop unauthorized privilege/financial mutations. |
| Simulate atomic mutations across multi-store environments (Postgres, SQLite, Redis) and receive unified token. |
| Execute two-phase distributed commit across multi-store environments with cryptographic tamper verification. |
๐ก๏ธ Matrix of Supported SQL & Enforced Guarantees
DBShield enforces rigorous runtime guarantees across the SQL lifecycle. Guarantees are verified transactionally, ensuring mutations never exceed approved scope even if database state drifts:
SQL Operation | Classification Mechanism | Static AST Guardrail | Execution Boundary & Rollback | Data Masking & Privacy |
SELECT | Prepared-statement column reflection ( | Detects missing | Streaming iterator ( | Zero-leak dynamic PII masking on result rows |
WITH ... (CTE) | Prepared-statement column reflection & recursive AST analysis | Recursively extracts underlying mutated tables & verifies read safety | Streaming iterator ( | Zero-leak dynamic PII masking on result rows |
UPDATE (Targeted) | AST evaluation & tautology checker ( | Blocks unconstrained updates, | Atomic transaction; rolls back if affected rows exceed | Literal masking in logs & database errors |
DELETE (Targeted) | AST evaluation & tautology checker ( | Blocks unconstrained deletes, | Atomic transaction; rolls back if affected rows exceed | Literal masking in logs & database errors |
INSERT | AST evaluation & dialect parser | Pre-flight dry run simulation required under STRICT tier | Atomic transaction; rolls back if inserted rows exceed | Redacts sensitive literals in |
DROP TABLE / TRUNCATE | AST statement opcode inspection | CRITICAL BLOCK: Intercepted before database touch unless explicitly overridden | Direct execution blocked | Audit log records blocked attempt with high risk score |
ALTER TABLE DROP COLUMN | AST expression visitor ( | BLOCKED: Intercepted before database touch to prevent schema data loss | Direct execution blocked | Audit log records blocked attempt |
EXPLAIN / PRAGMA | Prepared-statement column reflection | Safe read-only inspection | Read capped at | Sanitized output |
Enforced Guarantees Breakdown
Parameter-Bound Commit Invariance (B1):
Commit authorization tokens are cryptographically signed (HMAC-SHA256) binding the exact normalized SQL query text, typed parameters (
params), database identity (storagePath), safety tier, and simulated affected row count.Any query tampering, bound parameter alteration, or cross-database replay attempt is instantly rejected (
PARAMS_MISMATCH,QUERY_TAMPERED).
Hard Mutation Ceilings & Transactional Rollbacks (B2):
Exceeding
maxRowsPerMutationis a hard safety limit across all safety tiers (STRICT,BALANCED,PERMISSIVE), immediately refusing dry-run authorization (EXCESSIVE_BLAST_RADIUS).Mutations executed directly or committed through
db_commitrun inside an atomic transaction block: if actual row modifications exceed the authorized ceiling, DBShield immediately executesROLLBACK;and aborts.
Simulation Delta Drift Prevention (B2):
Protects against concurrent modifications between dry run and commit: if underlying database rows change such that actual affected rows differ from simulated rows (
simulatedAffectedRows != actualChanges), DBShield rolls back the transaction with[SIMULATION_DELTA_DRIFT].
Audit Log & Error Message Sanitization (B3):
Raw SQL strings have sensitive literals (passwords, tokens, API keys, emails, phone numbers, SSNs, credit cards) masked before being written to disk or the in-memory circular buffer.
Database engine errors (e.g., SQLite constraint failures) are sanitized prior to returning to the agent or storing in audit records.
db_audit_logreturns strictly sanitized compliance records.
Memory-Safe Streaming Read Row Capping (B4):
SQLite row reads are streamed lazily using Node.js
stmt.iterate().Results are capped at
maxRowsPerReadwithout buffering the full dataset into Node.js heap memory, returning agent-friendly pagination metadata (totalReturned,isTruncated,maxAllowedRows,hasMore,warning).
Robust Statement Classification & CTE Support (B5):
Replaced naive string prefix checks with SQLite prepared-statement column metadata (
stmt.columns() > 0) and recursive AST extraction.Complex CTEs (
WITH active AS (...) SELECT ...) and leading single-line (--) or multi-line (/* */) comments are correctly classified and executed without error.
๐ Production Deployment & Least-Privilege Guide
For production and shared environments, DBShield should be paired with database-level least privilege:
1. SQLite Filesystem Hardening
File Permissions: Restrict database file permissions so only the DBShield process UID has access:
chmod 600 /var/data/production.db chown dbshield:dbshield /var/data/production.dbRead-Only Connections: For read-only agent workloads, mount SQLite with read-only flags or initialize with SQLite read-only mode:
{ "storagePath": "file:/var/data/production.db?mode=ro", "safetyTier": "STRICT" }
2. Relational Database Least Privilege (PostgreSQL / MySQL)
Create a dedicated database role for DBShield with minimal necessary grants:
-- Create isolated role CREATE ROLE agent_user WITH LOGIN PASSWORD 'strong_random_password'; -- Grant only targeted DML on application tables (NO DROP, TRUNCATE, or ALTER) GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO agent_user; REVOKE ALL ON SCHEMA public FROM PUBLIC;
3. Policy Enforcement vs Human Approval
Deterministic Policy Enforcement: DBShield's dry-run authorization token guarantees that a query adheres to automated safety policies (blast radius thresholds, tautology checks, parameter binding).
Human Approval Hand-Off: In sensitive production workflows,
db_dry_runoutputs can be piped to an external human-in-the-loop review system (Slack, Teams, or ticketing webhook) before the token is submitted todb_commit.
๐ณ Docker & Kubernetes Helm Packaging
DBShield is packaged as an enterprise container with an unprivileged non-root user (UID 10001), native Prometheus metrics exporter, and a production Kubernetes Helm chart:
PostgreSQL Clients / AI Agents โโโบ DBShield Wire Proxy (:5433) โโโบ Upstream PostgreSQL (:5432)
โ
โโโโบ Prometheus Scraper (:9090/metrics)
โโโโบ Kubernetes Probes (:9090/healthz, /ready)1. Docker Compose (Zero-Config Full Stack)
Launch PostgreSQL, DBShield Wire Proxy, and Prometheus in one command:
docker compose up -dPostgreSQL Proxy:
127.0.0.1:5433(Targeting PostgreSQL on:5432)Prometheus Dashboard:
http://localhost:9091Metrics Endpoint:
http://localhost:9090/metricsHealth Endpoint:
http://localhost:9090/healthz
2. Standalone Docker Container
docker run -d \
--name dbshield-proxy \
-p 5433:5433 \
-p 9090:9090 \
-e DBSHIELD_UPSTREAM_HOST=postgres.internal \
-e DBSHIELD_UPSTREAM_PORT=5432 \
-e DBSHIELD_SAFETY_TIER=BALANCED \
ghcr.io/ritualdev-lab/dbshield:0.2.03. Kubernetes Deployment via Helm
Deploy high-availability DBShield replicas (with HorizontalPodAutoscaler and Prometheus ServiceMonitor):
# Add or install local chart
helm install dbshield ./charts/dbshield \
--set proxy.upstreamHost="my-db.postgres.database.azure.com" \
--set proxy.safetyTier="BALANCED" \
--set replicaCount=2 \
--set autoscaling.enabled=trueMetrics Exponent in Prometheus (/metrics)
dbshield_up: Proxy health status (1 = healthy)dbshield_connections_active: Real-time active client connectionsdbshield_queries_total{status, safety_tier, operation}: Total queries evaluateddbshield_queries_blocked_total{rule, severity}: Queries intercepted and preventeddbshield_query_duration_seconds: Histogram measuring query evaluation latencydbshield_cost_savings_dollars_total: Estimated cloud spend saved from blocked runaway queries
๐๏ธ Enterprise Compliance & SLA Guarantees
DBShield provides deterministic, zero-data-custody database protection backed by enterprise contractual assurances:
Formal Enterprise Service Level Agreement: ENTERPRISE_SLA.md
Guaranteed response times: < 1 hour for P1 critical outages (24/7/365 coverage), < 4 hours for P2 high severity, 99.95% availability SLA.SOC 2 Type II & ISO/IEC 27001:2022 Readiness Matrix: SOC2_ISO27001_COMPLIANCE.md
Comprehensive AICPA Trust Services Criteria (CC1โCC9, A1, C1, PI1, P1โP8) and ISO 27001 Annex A mapping for enterprise procurement audits.Autonomous AI Coding Agent Skill Definition: SKILL.md
Standardized instructions and tool-calling directives for Antigravity, Cursor, Windsurf, and Claude Code.GitHub Action CI/CD Migration Gate: action.yml
Pre-merge migration validation and unindexed cascade lock detection (uses: RitualDev-Lab/DBShield@v0.2.0).
Enterprise Contact & Incident Triage
Security & SOC 2 Packages:
security@ritualdev.inCommercial & SLA Support:
support@ritualdev.inTechnical Architecture Review:
developer@ritualdev.inTrust & Security Portal: https://ritualdev.in/trust
๐ License
MIT ยฉ RitualDev Lab
Available Tools
12 toolsdb_audit_logA
Retrieve the security and compliance query audit trail, including blocked operations, risk scores, and PII redactions.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Number of entries to retrieve (default: 20). | |
| status | No | Filter by status: SUCCESS, BLOCKED, DRY_RUN_APPROVED, DRY_RUN_REJECTED, COMMITTED, ERROR. | |
| minRiskScore | No | Filter for queries with riskScore >= minRiskScore. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden; "Retrieve" implies a read-only operation, and it usefully discloses what the records contain (risk scores, PII redactions, blocked operations). It says nothing about ordering, retention window, pagination beyond the limit parameter, or required permissions, which are meaningful gaps for an audit tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler; the resource and its contents come first with no redundant restatement of the tool name. Nothing could be removed without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-optional-parameter read tool the description is serviceable, and the absence of an output schema is partly offset by enumerating the returned fields. However, with no annotations to declare its read-only safety profile, the definition leaves the agent without confirmation of side effects, ordering, or result volume.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents limit, status, and minRiskScore semantics including the status enum values. The description adds no parameter meaning beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb ("Retrieve") with a specific resource ("security and compliance query audit trail") and enumerates what it contains: blocked operations, risk scores, and PII redactions. That makes it clearly distinguishable from execution-oriented siblings like db_query or db_commit, though it does not explicitly name a sibling to disambiguate against.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The compliance/security framing implies when an agent would reach for this tool (auditing blocked or risky queries), but there is no explicit when-to-use or when-not-to-use statement, and no guidance versus alternatives such as db_query or db_status. Usage must be inferred from the resource name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
db_check_schema_driftA
Inspect database schema health, identify unindexed foreign keys causing cascade locks, and detect schema drift.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden. It discloses the three diagnostics performed, which is real behavioral substance, and 'inspect' implies a non-mutating operation, but it never states read-only safety explicitly, says nothing about cost/latency on large schemas, and does not describe what form the findings take.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, and the most distinctive check (unindexed foreign keys causing cascade locks) is placed in the middle where it reads clearly. Slight overlap between 'schema health' and 'schema drift' keeps it from being maximally tight.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the agent is left guessing at the return shape (a findings list? a health verdict?) and at whether the call is guaranteed read-only. Complexity is low at zero parameters, which limits the damage, but a sentence on output form or safety would close the remaining gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; the schema is trivially complete. Baseline 4 applies, with no parameter gaps to compensate for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names concrete verbs and resources: inspect schema health, identify unindexed foreign keys causing cascade locks, and detect schema drift. This is clearly a read-only diagnostic, distinct from query/commit siblings like db_query and db_commit. It stops short of differentiating itself from db_status or db_describe_schema, which overlap in the schema-inspection space.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the enumerated checks: an agent would invoke this before a migration or when investigating lock contention from unindexed foreign keys. However, there is no explicit when-to-use/when-not guidance and no pointer to alternatives such as db_status or db_describe_schema for simpler schema questions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
db_check_semantic_intentB
Compare stated user prompt intent against SQL AST target columns to detect unauthorized modification of sensitive privilege, financial, or credential columns.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | The SQL query to check. | |
| intent | No | The stated prompt intent or instruction. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits, but it does not say whether the tool executes SQL, is read-only, needs elevated permissions, returns findings, or what happens when it detects a violation. The single sentence only gives the detection purpose, leaving the operational profile largely unknown.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single front-loaded sentence with no filler; the sensitive-column categories are specific and earn their place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Because there is no output schema and no annotations, the description should say what the tool returns and how a finding is reported. It also omits usage context relative to sibling tools, so an agent cannot fully determine the invocation semantics from this definition alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents sql and intent. The description maps them to 'stated user prompt intent' and 'SQL AST target columns' but does not add format, examples, or constraints beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
It names a specific comparison operation (intent vs. SQL AST target columns) and the security outcome (unauthorized modification of sensitive columns). That is enough for an agent to distinguish it from db_query or db_dry_run, which execute or simulate queries.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by calling it a check for unauthorized modification, but it never says when to call it, whether it precedes db_commit or db_dry_run, or whether it can be used independently. No sibling alternatives are named, so the agent must infer routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
db_commitA
Permanently execute and commit a mutation previously authorized by 'db_dry_run'. Requires a valid, single-use commitToken.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | The exact SQL query that was dry-run and authorized. | |
| params | No | Optional parameterized query values. | |
| commitToken | Yes | The single-use authorization token obtained from 'db_dry_run'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description carries the full burden and does solid work: it declares the operation permanent, requires prior authorization, and constrains the token to single use. It stops short of describing failure behavior, whether a failed commit burns the token, or transaction/rollback semantics โ meaningful gaps for an irreversible write.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero filler. The permanence warning and the sibling dependency are front-loaded, and nothing is repeated from the schema verbatim.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-parameter destructive tool with no annotations and no output schema, the description covers the essentials: what it does, the prerequisite, and the authorization requirement. It could say more about the result of a successful commit given there is no output schema to fall back on.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains sql, params, and commitToken in detail. The description only restates the token's single-use, dry-run-derived nature, adding no syntax, format, or matching constraints beyond the structured fields; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and effect ('Permanently execute and commit a mutation') and ties itself to the prerequisite sibling 'db_dry_run', which separates it from db_query and db_explain_query. It does not address when db_distributed_commit would be preferred, so the sibling differentiation is clear but not complete.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage context is explicit: this is the second half of a two-step flow that must follow 'db_dry_run' and requires a valid single-use commitToken. There are no explicit exclusions or guidance about the distributed variant, but the sequencing is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
db_describe_schemaB
Safely introspect database tables, column types, nullable flags, primary keys, and foreign key relationships.
| Name | Required | Description | Default |
|---|---|---|---|
| tableName | No | Optional specific table name to inspect. If omitted, returns all tables. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden. 'Safely' signals a non-destructive read, and the enumeration of returned fields (types, nullability, PKs, FKs) gives a partial return-shape picture. It does not state permission requirements, whether views/system tables are included, or the response structure, and there is no output schema to cover that gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. The verb and the return contents appear immediately, and no wording is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only introspection tool with one optional parameter and no output schema, the description covers the core question of what information comes back. The remaining gap, the exact response shape and permission requirements, is modest given the tool's low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter has 100% schema description coverage, so the agent already knows that omitting tableName returns all tables. The description adds nothing beyond that schema text, which is the correct baseline for a one-parameter tool with full coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('introspect') and resource ('database tables') and enumerates exactly what is returned: column types, nullable flags, primary keys, foreign keys. An agent can distinguish it from db_query or db_commit on intent. It does not explicitly differentiate itself from the close sibling db_check_schema_drift, which keeps it at 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance and no alternatives named. Given siblings like db_check_schema_drift and db_query, the agent is left to infer that this is the schema-discovery step, and that inference is only weakly supported by the word 'introspect'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
db_distributed_commitB
Execute two-phase distributed commit across multi-store environments using an authorized distributed dry-run token.
| Name | Required | Description | Default |
|---|---|---|---|
| token | Yes | ||
| operations | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden. It does disclose two behavioral facts beyond the schema: 'two-phase' implies atomicity semantics and 'authorized ... token' implies an authorization prerequisite. It omits critical traits for a destructive multi-store write: what happens on partial failure, whether the commit is all-or-nothing, idempotency, and irreversibility.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler; the operation, scope, and authorization mechanism all appear before any trailing clause.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, cross-store, two-phase commit with a nested operations array, no annotations, no output schema, and 0% parameter coverage, the description is far too thin. An agent cannot determine failure semantics, per-store targeting, or what the commit returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no meaning for either parameter. It never explains that 'token' must be a dry-run-issued authorization token or that 'operations' is an array of per-store actions (SQL, KV_SET, KV_DEL, KV_EXPIRE) with storeId/storeType/queryOrKey. The nested operation structure is left entirely to inference.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific operation and scope: 'Execute two-phase distributed commit across multi-store environments.' This distinguishes it from siblings like db_commit (single-store) and db_distributed_dry_run (the preview step), though it never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'using an authorized distributed dry-run token' implies a prerequisite: you must first run a distributed dry-run to obtain the token. That is an implied usage condition rather than an explicit one, and the description never states exclusions or directly names db_distributed_dry_run as the alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
db_distributed_dry_runB
Simulate atomic mutations across multi-store environments (e.g. PostgreSQL + Redis + SQLite) and receive a single distributed commit token.
| Name | Required | Description | Default |
|---|---|---|---|
| operations | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose genuinely useful behavior beyond the schema: that this is non-mutating simulation and that it returns a single distributed commit token (no output schema exists). It omits lifespan of the token, whether failures are reported per-store, locking or permission requirements, and how token validity is checked.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, and the outcome (commit token) is stated early. It is arguably too terse given the tool's complexity, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex multi-store transaction simulator with no annotations, no output schema, and no parameter documentation, the description covers the essence (simulation plus token) but leaves substantial operational gaps: error semantics, atomicity guarantees, token lifetime, and the hand-off to db_distributed_commit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the sole parameter is a nested array whose items require storeId, storeType, action (SQL/KV_SET/KV_DEL/KV_EXPIRE), and queryOrKey, plus an untyped paramsOrValue. The description adds nothing about this structure, the meaning of the action enums, or how mixed SQL and KV operations are composed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Simulate atomic mutations') and scope ('across multi-store environments'), with concrete store examples. It does not explain how 'distributed' differs from the sibling db_dry_run, leaving an agent to infer the distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance appears. The description never says it is a prerequisite for db_distributed_commit (which presumably consumes the token it returns) or when to choose it over db_dry_run. Usage is only implied by the word 'Simulate'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
db_dry_runA
Simulate a database mutation inside an auto-rollback transaction sandbox. Calculates blast radius, affected row count, and returns a short-lived authorization token if safe.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | The SQL mutation (UPDATE, INSERT, DELETE) to simulate. | |
| intent | No | Optional stated prompt intent or business justification for the mutation. | |
| params | No | Optional parameterized query values. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description carries the full burden and does substantial work: it discloses that execution happens inside an auto-rollback sandbox (no persistent writes), that blast radius and row counts are computed, and that a short-lived token is issued conditionally. The notable gap is the 'if safe' branch โ the description never says what happens when the mutation is deemed unsafe (error, refusal, null token) or how long the token lives.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both information-dense, with the core behavior (simulation in a rollback sandbox) front-loaded before the outputs. No filler or restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description usefully enumerates the return payload (blast radius, row count, token). For a mutation-adjacent tool with zero annotations, the missing piece is the failure/unsafe path and the token's downstream contract with db_commit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents sql, intent, and params including the accepted mutation types. The description adds no further meaning about parameter usage, such as whether parameterized values in params are required for safe blast-radius estimation or how intent influences the safety decision.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource โ simulate a database mutation โ and scopes it to an auto-rollback transaction sandbox, then adds what it computes (blast radius, affected row count) and what it emits (a short-lived authorization token). This clearly separates it from db_commit (which would apply changes) and db_query (which reads), though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the word 'simulate' and the token return suggest this is a pre-flight step before db_commit. There is no explicit when-to-use or when-not statement, no mention that db_commit presumably requires the returned token, and no exclusion telling the agent to use db_query for read-only SQL or db_explain_query for plan inspection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
db_explain_queryC
Analyze query execution plan (EXPLAIN) to detect sequential full-table scans, missing indexes, and performance bottlenecks.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | The SQL query to explain. | |
| params | No | Optional parameterized query values. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full disclosure burden, yet it never says whether the query is actually executed (EXPLAIN ANALYZE) or merely planned, whether the operation is read-only, or what permissions/cost are involved. For a tool taking arbitrary SQL, that ambiguity is a meaningful safety gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the core action appears first and the diagnostic targets follow. It is tightly scoped, though it could have used one additional clause on usage or safety at little cost.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description should indicate what the analysis returns (raw plan text, findings list, recommendations), and it does not. It is adequate for a two-parameter tool but leaves the agent guessing about results and execution semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both `sql` and `params` documented in the input schema. The description adds nothing about parameter binding behavior or how `params` interacts with placeholders, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb and resource (analyze execution plan via EXPLAIN) and names the specific findings it targets (sequential scans, missing indexes, bottlenecks). This clearly separates it from db_query or db_dry_run, which are about running or validating queries rather than inspecting plans, though it never explicitly names those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance and no mention of the many siblings (db_dry_run, db_query, db_check_semantic_intent) that an agent could easily confuse with plan analysis. The purpose implies a performance-tuning scenario, but the agent must infer that context entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
db_queryB
Safely execute a SQL query through DBShield guardrails. Destructive DDL and unconstrained mutations without WHERE clauses are automatically intercepted and blocked.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | The SQL query to execute. | |
| intent | No | Stated user-facing instruction or business justification for the SQL query. Required in STRICT tier when modifying sensitive fields. | |
| params | No | Optional parameterized query values. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose one genuine behavior beyond the schema: destructive DDL and mutations lacking a WHERE clause are intercepted and blocked. It does not say what a block looks like to the caller (error vs. partial result), whether execution is transactional, what permissions or tier gates apply, or anything about rate limits, so the behavioral picture is still incomplete for a query-execution tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the purpose and immediately followed by the safety constraint. Nothing is wasted, though the second sentence is a behavioral note rather than a routing aid, slightly misplacing emphasis.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema and no annotations, and this is a mutating, guardrailed tool โ the highest-burden combination. The description covers safety interception but leaves return shape, failure modes, and the STRICT-tier/intent interaction to the schema and to discovery, which is not quite enough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no parameter meaning beyond the schema โ it does not explain that 'intent' is gated to a STRICT tier for sensitive-field mutations or how 'params' interacts with the 'sql' placeholder syntax, both of which the schema only touches lightly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb with a specific resource: execute a SQL query, mediated by 'DBShield guardrails'. That distinguishes it from db_dry_run, db_commit and db_explain_query by implication, but no sibling is named, so an agent must infer the routing rather than read it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: this is the tool that actually runs SQL. The description never says when to prefer db_dry_run, db_commit or db_explain_query first, nor whether a dry run is a prerequisite in this workflow. The one useful contextual statement is that DDL and unconstrained mutations get blocked, which hints at a boundary but is not framed as guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
db_statusA
Check DBShield security gateway status, active safety tier, and database connection.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description must carry the behavioral burden. The word 'Check' implies a non-mutating read, but the description does not confirm it is safe/read-only, whether it hits the network, or whether results are cached; for a simple zero-argument status tool these gaps are minor but real.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence naming the subject and the three things inspected, with no filler, hedging, or repetition. Nothing could be removed without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description enumerates the three facets of the response (status, safety tier, connection), which effectively tells the agent what it will learn even though no output schema exists. It falls short only on what the possible status values mean or how to interpret a degraded tier.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters and the schema has an empty properties object, so there is nothing for the description to disambiguate beyond what the schema already establishes. Baseline for a parameterless tool applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs the specific verb 'Check' with three concrete resources: gateway status, active safety tier, and database connection. That clearly separates it from the sibling tools such as db_query and db_commit, which perform data operations rather than status inspection, though it never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is a pre-flight or diagnostic check to run before queries or commits, but the description never states when to prefer it or what to do with the result. No exclusions or alternatives are named among the eleven sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
db_validate_migrationB
Analyze DDL migrations against zero-downtime safety rules, detect table-level locking risks (e.g. non-concurrent index creation), dangerous NOT NULL columns, and destructive column/table drops.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | The DDL SQL statement or multi-statement migration script to validate. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full behavioral burden. It usefully discloses the rule categories checked (lock risks, NOT NULL, destructive drops), which implies static analysis without execution, but it never states whether a live database connection is required, whether the tool only reads, or how violations are reported back.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence with the core purpose first and the detection categories after. Dense but every clause adds a distinct check; only mild redundancy between "DDL migrations" and "migration script" framing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description should signal what comes back โ a list of violations? pass/fail? severities? โ and it does not. For a one-parameter validator, the input side is complete, but the result shape and any prerequisites are left for the agent to discover.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter has 100% schema description coverage, so the baseline is 3 by rule. The description reinforces DDL/migration scope, which matches the schema, but adds no syntax rules, dialect notes, or batching constraints for multi-statement scripts beyond what the schema field already says.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb plus resource ("Analyze DDL migrations against zero-downtime safety rules") with concrete examples of what it flags: locking risks, NOT NULL columns, destructive drops. It is clearly distinguishable from siblings like db_dry_run or db_check_schema_drift, though it never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer it should call this before applying a migration. There is no explicit when-to-use statement, no mention of when this is unnecessary, and no routing to alternatives such as db_dry_run or db_check_schema_drift.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
12 tool updates
v0.2.1- First observed
db_audit_log - First observed
db_check_schema_drift - First observed
db_check_semantic_intent - First observed
db_commit - First observed
db_describe_schema - First observed
db_distributed_commit - First observed
db_distributed_dry_run - First observed
db_dry_run - First observed
db_explain_query - First observed
db_query - First observed
db_status - First observed
db_validate_migration
TDQS
Scored across 12 tools
Most tools have clearly distinct purposes: status, schema introspection, query analysis, audit, migration validation, and distributed commit are well separated. The main ambiguity is between db_query and the db_dry_run/db_commit pair, since db_query says it safely executes SQL and may appear usable for mutations that should go through the dry-run/commit workflow.
All names use a consistent db_ snake_case prefix and are generally readable. Most follow an action-oriented pattern, but db_status and db_audit_log are noun-style rather than verb_noun, which is a minor deviation.
Twelve tools is well-scoped for a database security gateway covering status, schema, query safety, audit, migrations, and distributed transactions. Each tool appears to earn its place without excessive overlap.
The surface covers the expected lifecycle for guarded database operations: status, introspection, query execution, dry-run authorization, commit, explain plans, audit logs, migration safety, schema drift, semantic intent checks, and distributed two-phase commits. No obvious lifecycle gap stands out for the stated security-gateway purpose.
Maintenance
Related MCP Connectors
Safe, read-only Postgres and MySQL access for AI agents. Audit log + column-level controls.
Database guardrails for AI agents: check SQL against your Vericto rules before it runs.
Deterministic safety, correctness & cost gate that vets Postgres SQL before your AI agent runs it.
AI agents need permission before production SQL writes. Pilot $100 ยท Gateway $299. Lintโ authorize.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnforces safety and governance for SQL queries executed by AI agents, providing read-only enforcement, cost estimation, and audit trails.Apache 2.0
- AlicenseAqualityBmaintenanceEnables AI agents to read and write real databases safely by gating every write behind a mandatory propose/confirm preview and securing AWS RDS connections with short-lived IAM tokens.6MIT
- AlicenseAqualityAmaintenanceEnables AI agents to query PostgreSQL databases securely with read-only defaults, PII masking, rate limiting, and human-approved, expiring mutation tokens.91Apache 2.0
- AlicenseNot gradedqualityCmaintenanceEnables AI clients to safely query and operate SQL databases with per-statement risk grading, two-phase confirmation for dangerous operations, and access-level enforcement. Every action is recorded in a tamper-evident hash-chain audit log with integrity verification.MIT