Secure AI-Driven Database Access with db-mcp-gateway

Introducing db-mcp-gateway: Secure AI Database Access

AI agents frequently require querying production databases, yet sharing connection strings poses significant security risks. db-mcp-gateway addresses this concern by functioning as a secure, intermediary layer that never exposes actual credentials to the AI agents.

Self-Hosted Docker Container

This gateway is a self-hosted solution, operating within a single Docker container. It supports PostgreSQL and MongoDB as back-end databases. All database passwords are securely stored within the gateway itself. When an AI agent utilizes the MCP protocol to request data, the gateway authenticates the query, executes the operation, and returns solely the resulting data set.

Notably, no log entries or error messages ever contain connection strings, effectively preventing credential leakage from various sources such as laptops, continuous integration pipelines, or the agents themselves.

Streamlined Single Sign-On Authentication

The gateway seamlessly integrates with popular Single Sign-On (SSO) providers including Okta, Google Workspace, Entra, Authentik, and Keycloak. Authentication is facilitated through a straightforward browser-based flow, eliminating the need for embedded browsers. Permissions are granted on a per-group basis, and the gateway verifies user permissions in real-time for each query.

Comprehensive YAML Configuration

Permissions are defined through a YAML file, which is maintained in version control. This facilitates audit-ready reviews and integration with GitOps workflows. The configuration resides inside the gateway, allowing for transparent tracking of changes through Git.

Audit Trail and Compliance

Every executed query generates a detailed log entry, capturing the SSO user, the group they belong to, the granted permissions, timestamp, and the actual SQL command utilized. These audit logs are stored in a dedicated PostgreSQL table within the gateway, creating an immutable historical record. This feature facilitates compliance with various frameworks such as SOC 2, HIPAA, and ISO 27001, as the logs can be exported for reporting purposes.

Config-as-Code for Permissions Management

Permissions within the gateway are defined as code, enabling rigorous review processes through pull requests. Configuration changes are seamlessly integrated via Git, ensuring that the gateway's permissions are managed in the same repository as the gateway's configuration files. This approach minimizes human error and maintains a clear audit trail for all modifications.

Simple Deployment Procedure

Deploying the gateway is straightforward and requires just a few commands:

```

# Pull the latest image

Docker pull ghcr.io/developerz-ai/db-mcp-gateway:1.1.1

# Run the gateway with your configuration

Docker run -p 8080:8080 -v $( pwd ) /config.yaml:/app/config.yaml ghcr.io/developerz-ai/db-mcp-gateway:1.1.1

```

Upon execution, the gateway exposes a single HTTP endpoint that adheres to the MCP protocol. All state and audit logs are stored persistently within a PostgreSQL database managed by the gateway.

Conclusion

db-mcp-gateway offers a security-centric solution for enabling AI agents to access production databases. By keeping sensitive credentials within the gateway, enforcing robust SSO authentication, and meticulously logging each query, it caters to the specific needs of platform and site reliability engineers, backend developers, and security professionals.

Experience the enhanced security and efficiency of db-mcp-gateway and safeguard your data while maintaining AI productivity. For more information, visit the project's GitHub repository.