DEV Community

developerz.ai
developerz.ai

Posted on

Secure AI-Driven Database Access with db-mcp-gateway

Secure AI-Driven Database Access with db-mcp-gateway

Introduction

AI agents often need to read data from production databases to provide context-aware responses. Directly embedding database URLs in agent code creates a large attack surface because credentials can be leaked through logs, error messages, or source control. The db-mcp-gateway solves this problem by acting as a broker between agents and databases, ensuring that credentials never leave the gateway.

Core Security Model

The gateway follows three core principles:

  1. Credential Isolation - All database passwords are stored inside the gateway container. Agents receive only query results, never connection strings. No log line contains a credential.
  2. Identity & Access Control - Authentication is performed via SSO providers such as Okta, Google Workspace, Entra, Authentik, or Keycloak. Permissions are expressed in a YAML file that maps groups to databases, actions, and constraints.
  3. Audit Trail - Every request is recorded with the SSO user, group, grant, and query details. The audit logs are persisted in PostgreSQL and can be queried through the get_query_history endpoint.

Example Grant Configuration 

grants:
  - group: backend-devs
    databases: [production_postgres]
    actions: [query_read]
    constraints:
      schemas: [public, analytics]
      row_limit: 1000
      require_reason: true
Enter fullscreen mode Exit fullscreen mode

The above grant allows members of the backend-devs group to execute read-only queries on the production_postgres database, limited to the public and analytics schemas and a maximum of 1,000 rows per query. The require_reason flag forces the agent to supply a justification, which is stored in the audit log.

SSO Integration

The gateway supports browser-based SSO flows without requiring an embedded browser inside the agent. When an agent initiates a query, the gateway redirects the request to the configured SSO provider. After successful authentication, the provider returns a token that the gateway validates in real time. This ensures that only actively authenticated users can access the database.

Auditable Queries

Every query passes through the run_query endpoint and is logged with the following fields:

  • Timestamp
  • SSO user ID
  • Group
  • Grant name
  • Executed SQL
  • Row count
  • Execution duration These logs can be retrieved via get_query_history, enabling security teams to perform forensic analysis or generate compliance reports.

Deployment Overview

Deploying the gateway is straightforward:

# Pull the latest image
Docker pull ghcr.io/developerz-ai/db-mcp-gateway:1.1.1

# Run with your config
Docker run -p 8080:8080 \
  -v $(pwd)/config.yaml:/app/config.yaml \
  ghcr.io/developerz-ai/db-mcp-gateway:1.1.1
Enter fullscreen mode Exit fullscreen mode

The gateway runs in a single Docker container, stores its state and audit logs in PostgreSQL, and supports PostgreSQL and MongoDB as backend databases. MySQL and MSSQL are rejected at boot, keeping the focus on modern data stores.

Benefits for Target Audiences

  • Platform/SRE Teams - Centralized control of AI-driven database access without credential sprawl.
  • Backend Developers - Safe, natural-language querying of production data without handling passwords.
  • Security Officers - Full attribution of every query, group-based permissions, and configurable constraints.

Conclusion

db-mcp-gateway provides a pragmatic approach to securing AI-driven database access. By isolating credentials, leveraging SSO for authentication, and maintaining a comprehensive audit trail, it helps organizations meet compliance objectives while keeping development workflows simple. The project is open source and ready for production use. Visit the repository for more details: https://github.com/developerz-ai/db-mcp-gateway

Top comments (0)