Why we stopped letting AI agents connect directly to the database
The request usually sounds like this: "the agent needs to query the ERP". And the first reaction from whoever runs IT is the right one: nobody wants to hand a production database username and password to software that decides on its own which query to run. The risk isn't theoretical — it's a malformed query at peak time, a sensitive field exposed in a reply, a credential leaking into a log. This…
Zihin removed direct database connections for AI agents due to security concerns. Users no longer provide database credentials to software that autonomously generates queries. The removed features include the db_config type and db_event trigger, replaced by an alternative data flow. The new process involves three components: Zihin Replay, MCP Bridge, and Zihin Tunnel.
Replay maintains a read-only copy of agreed-upon tables inside the user's network, separate from the production database. The MCP Bridge provides contract-based, read-only queries tailored to specific business domains, eliminating the need for agents to write their own SQL. Zihin Tunnel allows outbound-only connections over port 443, ensuring secure transport without opening inbound ports or requiring VPN configurations.
The design ensures that database credentials remain within the user's network and that agents cannot write to the ERP. All data access is recorded, with policies enforcing confidentiality, availability, and governance.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
