A
licenseNot graded
qualityD
maintenanceConnects AI assistants to PostgreSQL databases with production-grade safety features including query validation, guarded writes, rate limiting, and audit logging.
3
MIT
Safe DB Gateway
by Chantichalla
Provides a security-hardened gateway for querying PostgreSQL databases, enforcing read-only access, PII masking, rate limits, and human-approved write operations via expiring tokens.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Safe DB Gateway Show me the top 5 customers by total spend"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Database Gateway
Quickstart · Tools · Access Control · Security · Contributing · License
AI agents need database access, but a raw connection lets them leak PII, wreck schema, or obey injected instructions. This gateway sits between the agent and Postgres — reads are validated and masked, writes need a human, and every action is audited.
Quickstart
Prerequisites: Python 3.10+, Docker.
pip install -r requirements.txt
python setup.py init --demo
python setup.py upPaste the printed block from mcp-servers.json into Claude Desktop. Or install directly:
pipx install git+https://github.com/Chantichalla/Database-MCP.git
database-gatewayOwn database? python setup.py init (wizard) or set DB_HOST / DB_PORT / DB_NAME with DB_SEED=empty.
Related MCP server: MCP Warehouse Server
Tools
Tool | Access | Description |
| all | Validated read-only SQL. Max 100 rows, 2s timeout, PII masked |
| all | Allowed tables with row estimates |
| all | Columns, types, primary and foreign keys |
| all | Up to 3 masked sample rows |
| editor, admin | Dry-run plan + expiring token. Executes nothing |
| admin | Executes a proposal with the operator key |
| all | Health, quarantine state, quotas |
| all | Recent audit events |
| admin | Clear quarantine without restart |
Access Control
One line in roles.yaml sets the deployment's access level:
Role | Reads | Propose | Approve | Manage |
| ✅ | ❌ | ❌ | ❌ |
| ✅ | ✅ | ❌ | ❌ |
| ✅ | ✅ | ✅ | ✅ |
Enforced twice — at the tool layer and by dedicated Postgres roles. Invalid config fails closed to reader.
Security
SQL validated by AST: SELECT-only, table whitelist, dangerous functions blocked
PII masked in a security-barrier view, before any SQL function sees the data
3 violations → 15-minute write quarantine (reads keep working, survives restarts)
Writes need a human operator key plus a 5-minute single-use token
Append-only audit log; credentials scrubbed from all logs and errors
See SECURITY.md for reporting vulnerabilities
Testing
$env:PYTHONPATH='C:\DB_MCP' # or export PYTHONPATH=/path/to/repo
python tests/test_chinook_gateway.py # 28 end-to-end tests, live Postgres
python -m unittest discover -s testsConfiguration
File | Purpose |
| Connection strings, secrets, thresholds. Never committed |
| Role definitions and table grants |
| Local Postgres 16 stack with demo data |
License
Apache-2.0. See LICENSE.
Available Tools
9 toolsapply_mutationA
Authenticated Human-in-the-Loop (HITL) Execution Tool: Executes a previously vetted mutation proposal IF AND ONLY IF a valid operator approval key is provided. The LLM cannot self-approve; a human administrator must provide the secret key.
Inputs: proposal_token (required), operator_approval_key (required). Returns: result
describe_tableB
Returns column names, data types, and primary key constraints for an accessible table.
Inputs: table_name (required). Returns: result
get_audit_summaryA
Read-only audit summary: returns the last N gateway audit events.
Lets the operator ask 'what happened in the last 10 minutes' without opening files manually.
Inputs: n. Returns: result
get_gateway_healthA
Returns the real-time health, anomaly circuit breaker state, and quota usage of the database gateway.
Inputs: no named parameters. Returns: result
list_accessible_tablesA
Lists the tables the agent is permitted to query, along with descriptions. Prevents the LLM from hallucinating queries against internal/restricted tables.
Inputs: no named parameters. Returns: result
propose_mutationA
Human-in-the-Loop (HITL) Proposal Tool: Submits a proposed data mutation (INSERT, UPDATE, DELETE) for review. Does NOT execute the mutation. Generates a proposal token and dry-run query plan.
Inputs: sql (required). Returns: result
reset_quarantineA
Management tool (admin role only): clears the session quarantine.
Lets the owner recover the gateway without restarting the process. Never gated by the circuit breaker itself.
Inputs: no named parameters. Returns: result
safe_queryA
Safely executes a read-only SQL query against the database.
Guarantees:
Anomaly circuit breaker: Tracks security violations and quarantines abusive sessions.
Rate limiter: Maximum 30 queries/minute and 15s cumulative compute budget.
Static AST validation: Blocks SQL injection, multi-statements, and writable CTEs.
Strict table whitelisting.
Automatic row limit clamping (max 100 rows).
Native execution timeout and memory streaming.
Dynamic PII masking on sensitive fields.
Inputs: sql (required). Returns: result
sample_rowsA
Returns up to 3 representative rows from an accessible table. Lets the agent see real data shapes before writing queries. Same read pipeline as safe_query: throttle gate, whitelist, role read-scope, AST validation, PII masking, audit.
Inputs: table_name (required). Returns: result
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
A4.1/5.0
Scored across 9 tools
Disambiguation5/5
Each tool maps to a clearly distinct responsibility: health, read querying, schema/metadata inspection, sampling, mutation proposal, mutation execution, audit, and quarantine recovery. The phase separation between propose_mutation and apply_mutation is especially unambiguous.
Naming Consistency4/5
Most tools follow a verb_noun snake_case pattern (get_, list_, describe_, sample_, propose_, apply_, reset_). safe_query is the one exception because it is an adjective-noun phrase rather than a verb-first action, but it is still clear and consistent in style.
Tool Count5/5
Nine tools is well-scoped for a database gateway. Each tool covers a distinct part of the workflow without redundancy, and no tool feels like filler.
Completeness5/5
The set covers the full intended lifecycle: read-only querying, table discovery, schema inspection, data sampling, HITL mutation proposal and approval-gated execution, health monitoring, audit, and quarantine recovery. Minor optional additions like proposal listing are not necessary for the core workflow.
Maintenance
ActivitySlowing
ResponsivenessNo recent community issues
Related MCP Connectors
Safe, read-only Postgres and MySQL access for AI agents. Audit log + column-level controls.
Query PostgreSQL databases in plain English — LLM-generated, safety-validated SQL.
Deterministic safety, correctness & cost gate that vets Postgres SQL before your AI agent runs it.
Query 40 databases from Claude, ChatGPT, or Cursor — on any device. Read-only, encrypted, audited.
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceEnables AI agents to query a Postgres data warehouse through a governed, read-only SQL interface with policy enforcement, row limits, schema-level PII isolation, and a full audit trail.1-
- AlicenseNot gradedqualityBmaintenanceEnables AI assistants to query Postgres as the signed-in person through OAuth 2.1/OIDC, with database-enforced read-only queries, PII masking, human-approved writes, and a tamper-evident audit log.23Apache 2.0
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to query a Postgres database read-only through a policy layer rather than a raw connection string. Enforces table and column allowlists, row limits, mandatory predicates, PII masking and append-only audit logging, while refusing writes, joins, subqueries and unlisted functions.MIT