Secure a Database MCP Server

Database access should be constrained below the agent layer.

Use a dedicated DB role

For analysis use cases, grant SELECT only on required schemas/tables. Avoid connecting as the application owner or superuser.

Prefer parameterized task tools

Narrow tools reduce SQL injection risk and make tenant/row limits easier to enforce than arbitrary SQL execution.

Multi-tenant filters

Derive tenant identity from authenticated context and enforce it in every query. Do not allow the model to choose an arbitrary tenant ID and trust it.

Limit output

Cap rows, columns, runtime, and sensitive fields. A valid query can still leak too much data.