DEV Community

developerz.ai
developerz.ai

Posted on

Secure AI Agent Database Access with db-mcp-gateway

#mcp #database #security #ai

Secure AI Agent Database Access with db-mcp-gateway

Introduction

AI agents increasingly need to query production databases to provide real-time insights. Direct access, however, risks exposing credentials and breaking compliance policies. db-mcp-gateway solves this problem by acting as a self-hosted Model Context Protocol (MCP) gateway that isolates credentials, enforces SSO authentication, and records every query in an immutable audit log.

Security Model Overview

The gateway follows three core principles: credential isolation, identity-driven access control, and a complete audit trail. Credentials never appear in logs, error messages, or responses. All traffic flows through the gateway, which authenticates each request via an external SSO provider and then forwards the query to the target database using a least-privilege role.

Credential Isolation

Database passwords are stored only inside the gateway container. AI agents receive query results, never connection strings. This eliminates the possibility of credential leakage from a laptop or CI pipeline. The architecture can be visualized as:

AI Agent → MCP Protocol → Gateway → Database
            No Credentials Auth Only Least Privilege
Enter fullscreen mode Exit fullscreen mode

Identity & Access Control

db-mcp-gateway supports Okta, Google Workspace, Entra, Authentik, and Keycloak for SSO. The login flow occurs in the browser, so no embedded browsers are required. Permissions are expressed as YAML grants that map groups to databases, actions, and constraints.

grants:
  - group: backend-devs
    databases: [production_postgres]
    actions: [query_read]
    constraints:
      schemas: [public, analytics]
      row_limit: 1000
      require_reason: true
Enter fullscreen mode Exit fullscreen mode

Each request is tied to an SSO user, and the gateway records the user, group, and grant used for the query.

Audit Trail

All queries are written to a PostgreSQL audit log. The get_query_history endpoint lets administrators retrieve who ran which query, when, and with what result. This built-in trail supports internal compliance reviews without requiring external certifications.

Config-as-Code and GitOps

Permissions live in a YAML file that can be version-controlled. Because there is no in-band admin UI, changes are reviewed via pull requests, providing a clear audit of permission modifications. The gateway itself is a single Docker container, making deployment straightforward.

Deployment Steps

The quick start uses Docker:

# Pull the latest image
Docker pull ghcr.io/developerz-ai/db-mcp-gateway:1.1.1

# Run with your config
Docker run -p 8080:8080 \
  -v $(pwd)/config.yaml:/app/config.yaml \
  ghcr.io/developerz-ai/db-mcp-gateway:1.1.1
Enter fullscreen mode Exit fullscreen mode

The container stores its state and audit logs in a PostgreSQL database. Only PostgreSQL and MongoDB are accepted as target databases; MySQL and MSSQL are rejected at boot to avoid unsupported configurations.

Use Cases

  • Platform/SRE Teams: Provide AI agents with read-only access to production data while keeping credentials hidden.
  • Backend Developers: Query live tables using natural language without embedding passwords in code.
  • Security Officers: Enforce row limits, schema restrictions, and mandatory query reasons, all captured in an immutable log.

Conclusion

db-mcp-gateway offers a pragmatic approach to secure AI-driven database access. By keeping credentials inside a hardened gateway, leveraging existing SSO providers, and providing a full audit trail, it addresses the most common security concerns for AI agents. The project is open source and ready for production use. See the repository for full documentation and examples.

GitHub Repository

Top comments (0)