MCP server

A bounded SQL tool for AI agents.

Safe Boundary runs as a local stdio MCP server and connects directly to PostgreSQL. Every query tool call passes through the SQL parser, masking engine, read-only gate, and audit writer.

Get early access
Review the security model →

Why this exists

Keep the agent useful without making the database permissive

The MCP surface exposes query and schema-description tools, blocks non-read-only statements, denies dangerous functions, masks configured fields, and applies row and byte limits to returned results.

Agent information supplied through environment settings is recorded for attribution. It helps investigations, but is not a substitute for cryptographically verified workload identity or a scoped database credential.

What it does

Concrete controls, stated precisely.

01

Local, direct connection

The npm package runs beside the MCP client and uses DATABASE_URL directly; credentials do not pass through Spectral Core infrastructure.

02

Bounded reads

Read-only enforcement, dangerous-function denial, masking, row caps, and per-process session budgets constrain the tool path.

03

Local-first audit

Every tool call is appended to rotating local JSONL. An optional console uplink is best-effort; the local file remains authoritative.

How it works

A visible enforcement sequence.

  1. 1

    Configure

    Add the package command and database URL to the MCP client.

  2. 2

    Identify

    Set stable agent attribution metadata for the environment.

  3. 3

    Constrain

    Choose masking rules and row/byte ceilings appropriate for the job.

  4. 4

    Review

    Inspect local audit records and optionally mirror them to the console.

Protected when

  • ✓SQL issued through Safe Boundary MCP tools
  • ✓Results covered by configured column rules
  • ✓Individual process sessions within configured row and byte budgets

Important boundaries

  • —Another SQL tool or direct credential can bypass this path
  • —Agent IDs are locally supplied attribution, not verified workload credentials
  • —Usage budgets reset with the MCP process and are not durable cross-session quotas

Continue the story

Related Safe Boundary pages

Security model →

Understand trust boundaries, credentials, identity, and bypass conditions.

Agent attribution →

Use stable agent metadata without calling it authentication.

PostgreSQL wire proxy →

Protect application, ORM, psql, and BI traffic on the PostgreSQL protocol.

Test the boundary on a real access path.

Start in observe mode, validate the policy against representative traffic, and move to enforcement with explicit bypass controls.

Get early access