Secure AI Agent Database Access with db-mcp-gateway

Introduction

AI agents increasingly need to read data from production databases to provide context-aware responses. Directly embedding database credentials in code or configuration files creates a high-risk surface for credential leakage. The db-mcp-gateway solves this problem by acting as a self-hosted Model Context Protocol (MCP) gateway that isolates credentials and enforces fine-grained access control.

Security Model

The gateway follows three core security principles: credential isolation, identity-driven access, and immutable audit trails. Credentials never leave the gateway process, and every query is routed through a strict authentication and authorization flow. This design eliminates the risk of passwords appearing in logs, error messages, or AI responses.

Credential Isolation

Database URLs and passwords are stored only inside the gateway container. AI agents interact with the gateway via MCP commands such as run_query and sample_table. The gateway returns only the result set, never the connection string. This guarantees that a compromised agent cannot exfiltrate credentials.

# Example grant configuration
grants:
  - group: backend-devs
    databases: [production_postgres]
    actions: [query_read]
    constraints:
      schemas: [public, analytics]
      row_limit: 1000
      require_reason: true

The YAML file lives in version control, enabling GitOps workflows and peer review of permission changes.

SSO Integration

The gateway supports browser-based SSO flows for Okta, Google Workspace, Entra, Authentik, and Keycloak. No embedded browsers are required; the agent redirects the user to the identity provider, which returns a token that the gateway validates in real time. Group membership is mapped to the grants defined in the YAML file, providing a single source of truth for access policies.

Audit Trail

Every query is recorded in a PostgreSQL audit log with the following fields:

• SSO user identity
• Group and grant used
• Timestamp and query text
• Result row count
• Reason provided (if required)

These logs are immutable and can be exported for compliance reporting. While the gateway is not certified against any framework, the audit trail supports SOC 2, HIPAA, and ISO 27001 evidence collection.

Config-as-Code Permissions

Permissions are expressed as code in the grants section of the configuration file. Because the file is stored in a repository, changes go through pull-request review, ensuring that any modification to database access is auditable and reversible. The gateway does not expose an in-band admin UI, reducing attack surface.

Deployment

Deploying the gateway is straightforward:

# Pull the latest image
docker pull ghcr.io/developerz-ai/db-mcp-gateway:1.1.1

# Run with your config
docker run -p 8080:8080 \
  -v $(pwd)/config.yaml:/app/config.yaml \
  ghcr.io/developerz-ai/db-mcp-gateway:1.1.1

The container runs a single PostgreSQL instance for state and audit logs. It supports PostgreSQL and MongoDB backends; attempts to connect to MySQL or MSSQL are rejected at boot time.

Use Cases

• Platform/SRE Teams: Provide AI-driven monitoring dashboards without exposing credentials.
• Backend Developers: Enable natural-language queries against production data while keeping passwords on the host.
• Security Officers: Gain full visibility into who accessed which data and when, satisfying audit requirements.

Conclusion

The db-mcp-gateway offers a practical, security-first approach to AI-enabled database access. By keeping credentials inside the gateway, integrating with existing SSO providers, and recording an immutable audit trail, it lets teams adopt AI agents in production environments with confidence. The open-source repository includes full documentation and example configurations.

Explore the project on GitHub: https://github.com/developerz-ai/db-mcp-gateway