# safedb-mcp

This MCP server lets AI agents inspect and query databases under read-only controls. Use it when agents need database context without unrestricted credentials.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 9
- Author: narekmalk
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/narekmalk/safedb-mcp
- Updated: 2026-09-23
- HTML: https://affpapa.org/en/nevibecode/mcp/safedb-mcp

## What it does

safedb-mcp connects Claude Code and the other supported clients to Postgres, MySQL, MariaDB, or SQLite. Its MCP tools expose schema and table inspection, table descriptions, read-only queries, query plans, and the active safety policy.

Before execution, SQL is parsed and checked against the configured access rules. The server handles joins, CTEs, nested queries, aliases, and unions when checking table access, while limits, timeouts, and PII masking are set in YAML or JSON. Attempts are written to a JSONL audit log without raw result rows.

Use a dedicated database role with read-only permissions for production access. SafeDB MCP adds a policy layer, but it does not replace least-privilege credentials. Write statements, migrations, stored procedures, and `COPY` are outside its scope.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `YOUR_API_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add safedb-mcp -e YOUR_API_KEY=<YOUR_API_KEY> -- npx -y @safedb/safedb-mcp
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add safedb-mcp --env YOUR_API_KEY=<YOUR_API_KEY> -- npx -y @safedb/safedb-mcp
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "safedb-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "@safedb/safedb-mcp"
            ],
            "env": {
                "YOUR_API_KEY": "<YOUR_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "safedb-mcp": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@safedb/safedb-mcp"
            ],
            "env": {
                "YOUR_API_KEY": "<YOUR_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e YOUR_API_KEY=<YOUR_API_KEY> safedb-mcp npx -y @safedb/safedb-mcp
```
Replace <…> with your own values

## When to use it
- inspect database schemas through an AI agent
- run approved SQL without write access
- mask PII columns before returning rows
- record query attempts without storing raw results

## Example prompts
- List the available schemas and tables in the connected database.
- Describe the `users` table and run a read-only query for recent orders.
- Explain the query plan and identify every table it touches.

## Similar
- [DBHub](https://affpapa.org/en/nevibecode/mcp/dbhub.md) — MCP server · ★ 3730
- [whodb](https://affpapa.org/en/nevibecode/plugins/whodb.md) — plugin · ★ 5042
- [DB Explorer](https://affpapa.org/en/nevibecode/mcp/db-explorer.md) — MCP server · ★ 7
- [drizzle-orm-patterns](https://affpapa.org/en/nevibecode/skills/drizzle-orm-patterns.md) — skill · 5400 installs
- [prisma-expert](https://affpapa.org/en/nevibecode/skills/sickn33-prisma-expert.md) — skill · 4200 installs
- [database-administrator](https://affpapa.org/en/nevibecode/agents/database-administrator.md) — subagent · 452 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md