Secure AI Agent Database Access with db-mcp-gateway

Introduction

Database access for AI agents often raises concerns about credential leakage and auditability. db-mcp-gateway addresses these concerns by acting as a self-hosted MCP (Model Context Protocol) gateway. The gateway isolates credentials, integrates with enterprise SSO providers, and records a complete audit trail. This article explains the security model, configuration approach, and deployment steps.

Security Model

The gateway follows three core principles: credential isolation, identity-driven access control, and immutable audit logging. Credentials never leave the gateway process, and AI agents receive only query results. Every request passes through a layered flow: AI Agent → MCP Protocol → Gateway → Database. The gateway enforces least-privilege roles and row limits at the database level.

Credential Isolation

Database passwords are stored only inside the gateway container. No connection string appears in logs, error messages, or API responses. This eliminates the risk of accidental exposure on developer laptops or CI pipelines. The gateway also prevents agents from requesting credentials directly.

SSO Integration

Supported SSO providers include Okta, Google Workspace, Entra, Authentik, and Keycloak. Authentication occurs via a browser-based flow; no embedded browsers are required. The gateway validates the user in real time and maps the user to a group defined in the grant configuration. Group membership drives permission decisions.

Audit Trail

Every query is recorded with the following fields: timestamp, SSO user, group, database, schema, query text, and optional reason. The audit log is stored in PostgreSQL and can be queried through the get_query_history endpoint. This immutable record satisfies compliance investigations without requiring external tooling.

Config-as-Code Grants

Permissions are expressed in a YAML file that can be version-controlled. An example grant looks like this:

grants:
  - group: backend-devs
    databases: [production_postgres]
    actions: [query_read]
    constraints:
      schemas: [public, analytics]
      row_limit: 1000
      require_reason: true

The grant limits the group to read-only queries on specific schemas, caps rows returned, and forces a reason field. Changes to the file are reviewed through pull requests, providing a GitOps workflow.

Deployment

Deploy the gateway as a single Docker container. The image is available at ghcr.io/developerz-ai/db-mcp-gateway:1.1.1. A minimal start command is:

docker pull ghcr.io/developerz-ai/db-mcp-gateway:1.1.1
 run -p 8080:8080 -v $(pwd)/config.yaml:/app/config.yaml ghcr.io/developerz-ai/db-mcp-gateway:1.1.1

The container runs a PostgreSQL instance for state and audit logs. It supports PostgreSQL and MongoDB backends; other databases are rejected at boot.

Using the MCP Tool Surface

The gateway exposes several commands:

• list_databases - shows available databases.
• describe_schema - returns table structures.
• sample_table - previews data before querying.
• run_query - executes SELECT statements safely.
• explain - provides query optimization hints.
• get_query_history - retrieves audit records.

Each command respects the grant constraints and logs the activity.

Compliance Considerations

While db-mcp-gateway is not a certified product, it supports compliance efforts by providing immutable audit logs and fine-grained access control. Organizations can integrate the audit data with their SIEM solutions to meet reporting requirements.

Conclusion

db-mcp-gateway offers a practical way to give AI agents database access without compromising credentials. By combining credential isolation, SSO-driven authentication, and a full audit trail, the gateway meets the security expectations of Platform/SRE teams, backend developers, and security officers. Deploy the container, configure grants as code, and start protecting your production databases today.

For more details and source code, visit the GitHub repository: https://github.com/developerz-ai/db-mcp-gateway