┌──────────────┐                                                        
│              │         ┌─────────────────────────────────────────────┐
│   AI Agent   │         │                                             │     ┌──────────────┐
│  (Claude,    │         │          MCP-DB-RESULTS-ANONYMIZER          │┌───►│  PostgreSQL  │
│   Codex...)  │         │                                             ││    └──────────────┘
│              │         │  1. Receives the agent's query              ││    ┌──────────────┐
│  NEVER sees  │         │  2. Executes the query on the DB            │├───►│    MySQL     │
│  the real    │         │  3. Detects PII columns (schema+regex)      ││    └──────────────┘
│  data        │◄──MCP──►│  4. Pseudonymizes (Faker + seed hash)       ││    ┌──────────────┐
│              │         │  5. Returns faked data                      │├───►│  SQL Server  │
│  NEVER knows │         │                                             ││    └──────────────┘
│  the         │         │  Credentials stored server-side             ││    ┌──────────────┐
│  credentials │         │  Consistent mapping in local SQLite         │└───►│   MongoDB    │
│              │         │                                             │     └──────────────┘
│              │         └─────────────────────────────────────────────┘
└──────────────┘                                │
                                                ▼
                                        ┌──────────────┐
                                        │ Local SQLite │
                                        │ (hashed      │
                                        │  mappings)   │
                                        └──────────────┘

git clone https://github.com/dnjfr/mcp-db-results-anonymizer.git
cd mcp-db-results-anonymizer
bash install.sh

projects/
├── mcp-db-results-anonymizer/      ← source code (this repo)
└── db-results-anonymizer-infra/    ← created by the installer

# Your docker-compose.yml
services:
  postgres:
    image: postgres:16
    container_name: mcp_postgres
    networks:
      - mcp-db-results-anonymizer-network

networks:
  mcp-db-results-anonymizer-network:
    external: true

databases:
  my_database:
    type: postgresql
    host: mcp_postgres          # container name
    port: 5432
    user: ${POSTGRES_USER}
    password: ${POSTGRES_PASSWORD}
    database: my_database

I wrote a query on demo_employees but it crashes.
Can you explain why and fix it?

SELECT e.emp_no, e.first_name, e.last_name, s.salary, t.title
FROM employees e
JOIN salaries s ON e.emp_no = s.emp_no
JOIN titles t ON e.emp_no = t.emp_no
WHERE e.hire_date > '1995-01-01'
  AND t.to_date = '9999-01-01'
  AND s.to_date = '9999-01-01'
ORDER BY s.salary DESC
LIMIT 5;

I'll check the real schema of demo_employees to identify the errors in your query.

Let me check the schema of the three tables used in your query.

● Called mcp-db-results-anonymizer 3 times

Your query contains 5 errors related to the actual database schema. Here are the details:

┌─────┬───────────────────────────┬──────────────────────────────────┬───────────────────────────────────────────────────────────────────────────────┐
│  #  │  Error in your query      │         Correct value            │                                  Explanation                                  │
├─────┼───────────────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┤
│ 1   │ FROM employees e          │ FROM employees.employee e        │ The table is employees.employee (schema employees, table employee)            │
├─────┼───────────────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┤
│ 2   │ JOIN salaries s           │ JOIN employees.salary s          │ The table is employees.salary (not salaries)                                  │
├─────┼───────────────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┤
│ 3   │ JOIN titles t             │ JOIN employees.title t           │ The table is employees.title (not titles)                                     │
├─────┼───────────────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┤
│ 4   │ e.emp_no / s.emp_no /     │ e.id / s.employee_id /           │ The primary key of employee is id, and the foreign key in salary and title    │
│     │ t.emp_no                  │ t.employee_id                    │ is employee_id                                                                │
├─────┼───────────────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────┤
│ 5   │ s.salary                  │ s.amount                         │ The salary column is called amount, not salary                                │
└─────┴───────────────────────────┴──────────────────────────────────┴───────────────────────────────────────────────────────────────────────────────┘

Here is the corrected query:

SELECT e.id, e.first_name, e.last_name, s.amount, t.title
FROM employees.employee e
JOIN employees.salary s ON e.id = s.employee_id
JOIN employees.title t ON e.id = t.employee_id
WHERE e.hire_date > '1995-01-01'
  AND t.to_date = '9999-01-01'
  AND s.to_date = '9999-01-01'
ORDER BY s.amount DESC
LIMIT 5;

Do you want me to run it to verify it works?

● Called mcp-db-results-anonymizer

The query works, here are the 5 results:

┌────────┬────────────┬───────────┬─────────┬──────────────┐
│   id   │ first_name │ last_name │ amount  │    title     │
├────────┼────────────┼───────────┼─────────┼──────────────┤
│ 77152  │ Josette    │ Techer    │ 147 777 │ Senior Staff │
├────────┼────────────┼───────────┼─────────┼──────────────┤
│ 96407  │ Lorraine   │ Vaillant  │ 137 374 │ Senior Staff │
├────────┼────────────┼───────────┼─────────┼──────────────┤
│ 458302 │ Camille    │ Fontaine  │ 143 984 │ Staff        │
├────────┼────────────┼───────────┼─────────┼──────────────┤
│ 298341 │ Michelle   │ Dupuy     │ 137 960 │ Staff        │
├────────┼────────────┼───────────┼─────────┼──────────────┤
│ 276755 │ Daniel     │ Merle     │ 111 490 │ Senior Staff │
└────────┴────────────┴───────────┴─────────┴──────────────┘

Warning: Names and monetary amounts are pseudonymized by the database anonymization proxy. 
These are not the actual data-the IDs are reliable, but PII values (such as names and salaries) are 
replaced with realistic fake data on every query.

mcp-db-results-anonymizer/          ← source code (Docker Hub: dnjfr/mcp-db-results-anonymizer)
├── src/
│   ├── server.py                   # MCP entry point (FastMCP)
│   ├── config.py                   # YAML config loader
│   ├── database/                   # SQL + MongoDB connectors
│   ├── detection/                  # Pattern matching, SQL lineage, value scan
│   ├── anonymizer/                 # Faker pseudonymization + numeric perturbation
│   ├── storage/                    # Local SQLite (hashed mappings)
│   ├── security/                   # SQL validation, Bearer auth, rate limiting
│   └── tools/                      # MCP tools (query, metadata, fixtures)
├── scripts/                        # Shared security hooks (all agents)
├── infra/                          # Templates for the installer
├── docs/                           # Detailed documentation
├── install.sh                      # Interactive installer
├── config.example.yaml             # Configuration template
├── Dockerfile                      # MCP server image
└── Makefile                        # Docker Hub build/push + MCP registration