narekmalk avatar

Safedb Mcp

narekmalk/safedb-mcp

Connects Claude to Postgres, MySQL, MariaDB, or SQLite databases with AST-based read-only guardrails. Exposes six MCP tools: list_schemas, list_tables, describe_table, run_readonly_query, explain_query, and get_safedb_policy. The SQL parser blocks writes, enforces table allowlists and denylists, caps row counts, and masks PII fields using redact, email, partial, or hash strategies before returning results. Every query attempt lands in a JSONL audit log. Reach for this when you want AI agents to inspect and query production databases without risking mutations or credential leaks. Ships with a CLI, Docker support, and YAML config with environment variable expansion for connection strings.

GitHub stars
6
tools
6
auth
Secret needed
transport
STDIO
env var
1
last updated
May 23, 2026

Tools

6 tools

Public tool metadata for what this MCP can expose to an agent.

list_schemasLists the schemas visible under the configured access policy.

Lists the schemas visible under the configured access policy.

No parameter schema in public metadata yet.

list_tablesLists tables in a schema that are allowed by the access policy.

Lists tables in a schema that are allowed by the access policy.

No parameter schema in public metadata yet.

describe_tableDescribes the columns of an allowed table.

Describes the columns of an allowed table.

No parameter schema in public metadata yet.

run_readonly_queryRuns a validated read-only SQL query with row limits and masking applied.

Runs a validated read-only SQL query with row limits and masking applied.

No parameter schema in public metadata yet.

explain_queryReturns the execution plan for a read-only query.

Returns the execution plan for a read-only query.

No parameter schema in public metadata yet.

get_safedb_policyReturns the active SafeDB access policy.

Returns the active SafeDB access policy.

No parameter schema in public metadata yet.

Sponsors

Configuration

YOUR_API_KEY*secret

Your API key for the service

Readme

SafeDB MCP

CI npm version safedb-mcp MCP server

SafeDB MCP is a secure Model Context Protocol server that lets AI agents inspect and query Postgres, MySQL, MariaDB, and SQLite with strict read-only guardrails. It is designed for teams that want useful database access without handing an agent unrestricted production credentials.

Direct database credentials are dangerous for agents because a single bad prompt, tool call, or generated SQL statement can mutate data, exfiltrate sensitive columns, or run expensive queries. SafeDB MCP puts a policy layer between the agent and your database: only configured schemas and tables are visible, SQL is parsed and validated before execution, row counts are capped, results are masked, and every query attempt is audited.


View the full README on GitHub

Details

Repository
github.com/narekmalk/safedb-mcp
Package
@safedb/safedb-mcp
Transport
STDIO
Auth
Required
Registry
MCP registry, active