Secure AI Agent Database Access with db-mcp-gateway

Introduction

AI agents need to query production databases, but exposing connection strings creates a large attack surface. db-mcp-gateway solves this problem by acting as a self hosted gateway that isolates credentials and enforces strict access control. The gateway is open source and can be deployed with a single Docker container.

Security Model

The security model rests on three pillars: credential isolation, identity driven access control and an immutable audit trail. Each pillar is implemented with concrete mechanisms that can be inspected in the source code.

Credential Isolation

Database passwords are stored only inside the gateway process. AI agents never receive a URL or password, and the gateway strips any credential information from logs and error messages. The flow looks like this:

AI Agent → MCP Protocol → Gateway → Database

No credentials travel beyond the gateway, so a compromised agent cannot leak connection strings.

SSO Integration

Authentication is performed through SSO providers such as Okta, Google Workspace, Entra, Authentik or Keycloak. The login flow happens in the browser, eliminating the need for embedded browsers in the agent. After authentication the gateway maps the user to a group and applies the corresponding grant.

grants:
  - group: backend-devs
    databases: [production_postgres]
    actions: [query_read]
    constraints:
      schemas: [public, analytics]
      row_limit: 1000
      require_reason: true

The grant file lives in version control, allowing peer review and audit of permission changes.

Audit Trail

Every query is recorded with the SSO user, group, grant and a timestamp. The audit records are stored in PostgreSQL and can be retrieved with the get_query_history endpoint. This provides a complete, tamper evident log that satisfies compliance reviews without requiring external certifications.

Config-as-Code Permissions

Permissions are defined in a YAML file that is part of the repository. This config-as-code approach aligns with GitOps practices and ensures that changes to database access are tracked alongside application code.

Deployment

Deploying db-mcp-gateway is straightforward:

# Pull the latest image
docker pull ghcr.io/developerz-ai/db-mcp-gateway:1.1.1

# Run with your config
docker run -p 8080:8080 -v $(pwd)/config.yaml:/app/config.yaml ghcr.io/developerz-ai/db-mcp-gateway:1.1.1

The container runs a single PostgreSQL instance for state and audit logs and supports PostgreSQL and MongoDB backends.

Conclusion

For platform teams, backend developers and security officers, db-mcp-gateway offers a practical way to let AI agents access production data without exposing credentials. The combination of credential isolation, SSO driven authentication and a full audit trail makes it a strong building block for secure AI workflows. The source code and documentation are available at https://github.com/developerz-ai/db-mcp-gateway.