MCP server

A bounded SQL tool for AI agents.

Safe Boundary runs as a local stdio MCP server and connects directly to PostgreSQL. Every query tool call passes through the SQL parser, masking engine, read-only gate, and audit writer.

Get early access
Review the security model →

Why this exists

Keep the agent useful without making the database permissive

The MCP surface exposes query and schema-description tools, blocks non-read-only statements, denies dangerous functions, masks configured fields, and applies row and byte limits to returned results.

Agent information supplied through environment settings is recorded for attribution. It helps investigations, but is not a substitute for cryptographically verified workload identity or a scoped database credential.

What it does

Concrete controls, stated precisely.

Local, direct connection

The npm package runs beside the MCP client and uses DATABASE_URL directly; credentials do not pass through Spectral Core infrastructure.

Bounded reads

Read-only enforcement, dangerous-function denial, masking, row caps, and per-process session budgets constrain the tool path.

Local-first audit

Every tool call is appended to rotating local JSONL. An optional console uplink is best-effort; the local file remains authoritative.

MCP setup

Make the local tool boundary visible to the operator.

Illustrative configuration only: use your client’s MCP format and keep the database credential scoped to the intended read path.

Illustrative client entry

{
  "command": "npx",
  "args": ["@spectralcore/safe-boundary-mcp"],
  "env": {
    "DATABASE_URL": "postgresql://readonly@db.internal/app",
    "SB_AGENT_ID": "analyst-tool"
  }
}

Review before enabling

Allow: query, schema
Deny: writes, dangerous functions
Limit: rows and bytes per process
Audit: local JSONL is authoritative

How it works

A visible enforcement sequence.

  1. Configure

    Add the package command and database URL to the MCP client.

  2. Identify

    Set stable agent attribution metadata for the environment.

  3. Constrain

    Choose masking rules and row/byte ceilings appropriate for the job.

  4. Review

    Inspect local audit records and optionally mirror them to the console.

Protected when

  • ✓SQL issued through Safe Boundary MCP tools
  • ✓Results covered by configured column rules
  • ✓Individual process sessions within configured row and byte budgets

Important boundaries

  • •Another SQL tool or direct credential can bypass this path
  • •Agent IDs are locally supplied attribution, not verified workload credentials
  • •Usage budgets reset with the MCP process and are not durable cross-session quotas

Continue the story

Related Safe Boundary pages

Security model →

Understand trust boundaries, credentials, identity, and bypass conditions.

Agent attribution →

Use stable agent metadata without calling it authentication.

PostgreSQL wire proxy →

Protect application, ORM, psql, and BI traffic on the PostgreSQL protocol.

Test the boundary on a real access path.

Start in observe mode and validate the policy against representative traffic before you enforce it. That gives the team evidence for each decision, along with explicit bypass controls for the cases that need a deliberate exception.

Get early access