db-mcp-gateway

Your AI agent needs to read the production database. The connection string is the one thing you cannot hand it.

Give an agent a database URL and that credential now lives on a laptop, in a config file, in shell history, and in whatever the agent decides to echo back. Rotating it means finding every copy. And every query it runs is attributed to nobody.

db-mcp-gateway holds the credential instead.It is a self-hosted MCP server your team deploys once. Developers point their agent at one URL. The gateway authenticates them through the SSO you already run, checks each query against permissions reviewed by pull request, and commits an append-only audit row before any result goes back.

v1.5.0 — stable, in production use.One image, one YAML file, and one Postgres for the gateway's own state:

docker pull ghcr.io/developerz-ai/db-mcp-gateway:1.5.0

Public on GHCR, no auth needed to pull. Multi-arch (linux/amd64,linux/arm64), built reproducibly from avgit tag.:latesttracks the newest release; pin the version in production. Compatibility policy inwebsite/docs/deployment/releasing.md, deployment inwebsite/docs/deployment/quickstart.md.

claude mcp add --transport http db-gateway --scope project https://db.internal.acme.com

- MCP tool surface—list_servers,list_databases,describe_schema,sample_table,run_query,explain,get_query_history.
- OIDC SSO— Any OIDC-compliant identity provider (e.g. Okta, Google Workspace, Entra, Authentik, Keycloak). Browser-flow login from the agent.
- Read-only by default, writes opt-in per grant— per-database least-privilege roles; aquery_writegrant permits data writes (INSERT/UPDATE/DELETE), never schema changes. Statement timeouts and row caps enforced at the DBandgateway layer.
- Permissions in YAML— group × server × database × action, with per-grant constraints (require_reason,row_limit,statement_timeout_ms, allow/deny schemas, time windows). Reviewed by PR, with the full change history git already gives you.
- Synchronous audit log— user, SQL, reason, row count, duration, outcome. The write commitsbefore*the response is sent; if it fails, the request fails. Retained in the gateway's Postgres with a configurable TTL and an hourly pruner, with optionalstdout/syslogstream sinks for feeding an existing log pipeline or SIEM. Archive to object storage and OTLP streaming areroadmap Phase 4, not shipped.
- Boring deployment—docker pull, one YAML file, and one Postgres for the gateway's own state. The databases your agents query are your existing ones; thelocal quickstartstands up a throwaway target too, so you can try it end to end without pointing at anything real. No agent runtime, no query builder, no credential vault to operate.

┌─────────┐ MCP/HTTPS ┌──────────────┐ pg wire ┌──────────┐ │ agent │ ──────────────▶ │ gateway │ ────────────▶ │ target │ │ (Claude │ bearer: jwt │ │ ro role per │ DBs │ │ Code) │ ◀────────────── │ authz+audit │ ◀──────────── │ │ └─────────┘ tool result └──────┬───────┘ result rows └──────────┘ │ ▼ ┌──────────────┐ │ state DB │ │ (sessions + │ │ audit log) │ └──────────────┘

Maritime intelligence for tracking vessels, analysing ports, and exploring ship data.