narekmalk/safedb-mcp

Overview

A secure MCP server that enables AI agents to query databases with read-only access. It enforces SQL guardrails, table allowlists, PII masking, and maintains audit logs to prevent data leaks.

Best for

Best for
Developers building AI agents that need safe, auditable database querying.

Use cases

• Give AI agents safe read-only database access
• Enforce query restrictions and PII redaction
• Audit all database queries made by agents

How to use

Install

npx @safedb/safedb-mcp init --output safedb.yaml

Tools exposed

• list_schemas
• list_tables
• describe_table
• run_readonly_query
• explain_query
• get_safedb_policy

Tested with

Claude Desktop, Cursor

Example client config

database:\n  type: postgres\n  url: ${DATABASE_URL}\nsafety:\n  default_limit: 100\n  max_limit: 1000\n  statement_timeout_ms: 5000\n  allow_explain: true\naccess:\n  schemas:\n    public:\n      allow_tables:\n        - users\n        - orders\n        - products\n      deny_tables:\n        - secrets\n      column_masks:\n        users.email: email\n        users.phone: partial\n        users.password_hash: redact\n        users.ssn: redact\naudit:\n  path: safedb-audit.jsonl

Notes

A secure MCP server that enables AI agents to query databases with read-only access. It enforces SQL guardrails, table allowlists, PII masking, and maintains audit logs to prevent data leaks.

6 stars on GitHub. Last updated 2026-05-27. Licensed MIT.

Use cases

• Give AI agents safe read-only database access
• Enforce query restrictions and PII redaction
• Audit all database queries made by agents

Pros

• Prevents accidental writes or destructive queries
• Allows fine-grained control over which tables can be accessed
• Adds PII masking to protect sensitive data

Cons

• Limited adoption with only 6 GitHub stars
• Requires setup and configuration of guardrails
• May add latency to AI agent workflows

Indexed from awesome-mcp-servers-punkpeye and enriched against its public facts.