MCPBridge

Most tools that let an AI assistant talk to a database just hand it a raw connection and hope for the best. MCPBridge takes the opposite approach: it treats every query an assistant like Claude or Cursor sends the way a careful DBA would treat a request from a new hire, checked, logged, and never trusted with anything destructive by default.

Every statement is read before it’s allowed anywhere near the database. Comments and string tricks that might hide a DROP or a sneaky multi-statement payload get stripped away first, so nothing slips past the filter in disguise. Reads run inside their own locked-down transaction as a second line of defence, and any that forget a LIMIT are automatically capped so one careless query can’t flood the whole conversation with rows.

Writes get treated even more carefully. Nothing an assistant sends is ever executed straight away: it’s staged first, run past the query planner to estimate how many rows it would actually touch, and handed back with a risk rating. Only a separate, explicit confirmation lets it through, and anything that looks like a bulk delete or an UPDATE with no WHERE clause needs the human to acknowledge the risk a second time before it happens. Unconfirmed writes simply expire.

Behind the scenes, every action (successful, blocked, rate-limited, or failed) gets written to an audit trail, with any passwords or credentials scrubbed out before they ever reach a log line. A rate limiter turns away excess requests before they even reach the database, so a runaway loop can’t quietly rack up connections. MCPBridge also learns the shape of the database it’s connected to: table sizes, foreign-key relationships, indexes, and sample data, all cached briefly so repeated questions don’t hit the catalog every time. And because assistants sometimes behave strangely, it keeps a quiet eye on its own audit log for the kind of patterns that suggest something other than normal use, like a sudden burst of queries against one table, or a sweep through sequential IDs at 3am.

Under the hood it’s built as a set of independent, testable features rather than one big service, each with its own behavioural specification and test suite, which made it possible to reason about a genuinely sensitive piece of infrastructure with some confidence. Point it at Claude Desktop, Claude Code, Cursor, or Windsurf, and it just shows up as a set of tools the assistant can use. The safety model is what happens quietly in between.