safedb-mcp — Claude Code MCP server: safe DB queries
This MCP server lets AI agents inspect and query databases under read-only controls. Use it when agents need database context without unrestricted credentials.
claude mcp add safedb-mcp -e YOUR_API_KEY=<YOUR_API_KEY> -- npx -y @safedb/safedb-mcpWhat safedb-mcp does
safedb-mcp connects Claude Code and the other supported clients to Postgres, MySQL, MariaDB, or SQLite. Its MCP tools expose schema and table inspection, table descriptions, read-only queries, query plans, and the active safety policy.
Before execution, SQL is parsed and checked against the configured access rules. The server handles joins, CTEs, nested queries, aliases, and unions when checking table access, while limits, timeouts, and PII masking are set in YAML or JSON. Attempts are written to a JSONL audit log without raw result rows.
Use a dedicated database role with read-only permissions for production access. SafeDB MCP adds a policy layer, but it does not replace least-privilege credentials. Write statements, migrations, stored procedures, and COPY are outside its scope.
What it helps with
- inspect database schemas through an AI agent
- run approved SQL without write access
- mask PII columns before returning rows
- record query attempts without storing raw results
Example prompts for the agent
- List the available schemas and tables in the connected database.
- Describe the
userstable and run a read-only query for recent orders. - Explain the query plan and identify every table it touches.
How to install safedb-mcp
Platform CLI
claude mcp add safedb-mcp -e YOUR_API_KEY=<YOUR_API_KEY> -- npx -y @safedb/safedb-mcpReplace <…> with your own values
Platform CLI
codex mcp add safedb-mcp --env YOUR_API_KEY=<YOUR_API_KEY> -- npx -y @safedb/safedb-mcpReplace <…> with your own values
Config file
{
"mcpServers": {
"safedb-mcp": {
"command": "npx",
"args": [
"-y",
"@safedb/safedb-mcp"
],
"env": {
"YOUR_API_KEY": "<YOUR_API_KEY>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"safedb-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@safedb/safedb-mcp"
],
"env": {
"YOUR_API_KEY": "<YOUR_API_KEY>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e YOUR_API_KEY=<YOUR_API_KEY> safedb-mcp npx -y @safedb/safedb-mcpReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about safedb-mcp
How do I install safedb-mcp in Claude Code?
Run claude mcp add safedb-mcp -e YOUR_API_KEY=<YOUR_API_KEY> -- npx -y @safedb/safedb-mcp.
What does safedb-mcp do?
It gives an AI agent controlled access to schema inspection and read-only SQL for Postgres, MySQL, MariaDB, and SQLite. Policies can limit tables, mask fields, cap rows, and audit requests.
Which database operations are blocked?
Write operations, migrations, stored procedure execution, and COPY are blocked. SQL is checked before execution, and returned rows are capped by the configured limit.
