DEV Community

developerz.ai
developerz.ai

Posted on

Secure AI Agent Database Access with db-mcp-gateway

Secure AI Agent Database Access with db-mcp-gateway

Introduction

AI agents that need to read production data must do so without exposing database credentials. db-mcp-gateway provides a self-hosted Model Context Protocol (MCP) gateway that isolates credentials, enforces identity-based access, and records a complete audit trail. The gateway is deployed as a single Docker container and works with PostgreSQL and MongoDB back-ends.

Security Model

The security model rests on three pillars: credential isolation, end-to-end identity, and config-as-code permissions. Each pillar is implemented directly in the gateway code and does not rely on external services beyond the configured SSO provider.

Credential Isolation

Database passwords and connection strings live only inside the gateway process. AI agents receive query results, never a connection string. No log line contains a URL or password, and the gateway never returns credentials in error messages. This eliminates the most common leakage vector where a developer accidentally prints a connection string to a console.

SSO Integration

The gateway supports Okta, Google Workspace, Entra, Authentik, and Keycloak. Authentication happens through a browser-based SSO flow; the agent does not embed a browser. After a successful login the gateway maps the SSO user to a group defined in the YAML configuration. Group membership drives the permissions granted to the agent.

# Example grant configuration
grants:
  - group: backend-devs
    databases: [production_postgres]
    actions: [query_read]
    constraints:
      schemas: [public, analytics]
      row_limit: 1000
      require_reason: true
Enter fullscreen mode Exit fullscreen mode

The require_reason flag forces the agent to include a justification for each query, which is stored in the audit log.

Audit Trail

Every query is written to a PostgreSQL audit table with the following fields: timestamp, SSO user, group, database, schema, query text, row count, and optional reason. Because the audit log lives in a separate database, it cannot be tampered with by the AI agent. Security officers can query the audit table to produce compliance reports.

# Retrieve query history via the MCP tool
curl -X POST https://gateway.example.com/get_query_history \
  -H "Authorization: Bearer <token>" \
  -d '{"user":"alice@example.com"}'
Enter fullscreen mode Exit fullscreen mode

Config-as-Code Permissions

Permissions are expressed in a single YAML file that can be version-controlled. Changes are reviewed through pull requests, ensuring that any modification to database access is auditable. The gateway does not expose an in-band admin UI, reducing the attack surface.

Deployment

Deploying db-mcp-gateway is straightforward. Pull the Docker image, mount the configuration file, and start the container. The gateway stores its state and audit logs in a PostgreSQL instance.

# Pull the latest image
docker pull ghcr.io/developerz-ai/db-mcp-gateway:1.1.1

# Run with your config
docker run -p 8080:8080 \
  -v $(pwd)/config.yaml:/app/config.yaml \
  ghcr.io/developerz-ai/db-mcp-gateway:1.1.1
Enter fullscreen mode Exit fullscreen mode

Use Cases

  • Platform/SRE teams can grant AI agents read-only access to production databases without ever distributing passwords.
  • Backend developers can prototype queries using natural language while the gateway enforces row limits and schema restrictions.
  • Security and compliance officers gain a tamper-evident audit trail that ties every query to an authenticated SSO identity.

Conclusion

db-mcp-gateway addresses the core security concerns of AI-driven data access: credential leakage, unauthenticated queries, and lack of auditability. By combining credential isolation, SSO-driven authentication, and config-as-code permissions, the gateway enables safe integration of AI agents with production databases. The project is open source and available on GitHub.

GitHub repository

Top comments (0)