SQLGuard MCP

A safety layer MCP server that sits between AI agents (Claude Code, Cursor) and your database.

AI agents are powerful but can accidentally run DELETE FROM users or DROP TABLE orders. SQLGuard MCP intercepts every SQL query, classifies it, estimates impact, and requires explicit confirmation before any mutation touches your data.

How it works

Claude/Cursor --> SQLGuard MCP --> [Classify] --> [EXPLAIN] --> [Policy Check] --> DB
                                                    |
                                         Block or ask for confirmation

Quick start

Add to your MCP client config (Claude Code, Cursor, etc.):

{
  "mcpServers": {
    "sqlguard": {
      "command": "npx",
      "args": ["sqlguard-mcp", "--pg", "postgresql://user:pass@localhost/mydb"]
    }
  }
}

Or for SQLite:

{
  "mcpServers": {
    "sqlguard": {
      "command": "npx",
      "args": ["sqlguard-mcp", "--sqlite", "./mydb.sqlite"]
    }
  }
}

What it does

Feature	Description
Query classification	Every query is classified as READ, WRITE, or DESTRUCTIVE
Destructive query blocker	DELETE/DROP/TRUNCATE/ALTER without WHERE are blocked automatically
EXPLAIN interceptor	Runs EXPLAIN before any mutation to show the execution plan
Impact estimation	Estimates rows affected before executing
Human confirmation	WRITE/DESTRUCTIVE queries return analysis and require confirmed: true

MCP tools

Once connected, the AI agent has access to these tools:

Tool	Description
query	Execute SQL with safety checks
explain	Run EXPLAIN without executing
tables	List all tables in the database
schema	Show schema for a specific table
status	Connection status and active rules

Usage examples

Claude Code workflow

The AI agent interacts with your DB through these tools automatically. Example conversation:

You:    Update all inactive users' last_seen to NULL
Claude: [calls query tool with UPDATE users SET last_seen = NULL WHERE active = 0]

SQLGuard returns:
  IMPACT ANALYSIS -- Review before confirming
  ==================================================
  Operation:  UPDATE
  Type:       WRITE
  Tables:     users
  Has WHERE:  Yes

  Estimated rows affected: 1,247
  EXPLAIN output:
  Seq Scan on users (cost=0..450 rows=1247 width=200)

  To execute, call query with confirmed: true

Claude: I found 1,247 inactive users. Should I proceed?

You:    Yes, go ahead
Claude: [calls query with confirmed: true -- executes]
        Rows affected: 1,247. Done.

Blocked query example

Claude: [calls query with DELETE FROM orders]

SQLGuard returns:
  QUERY BLOCKED
  Reason: DELETE without WHERE clause will affect all rows

Security modes

Control how SQLGuard handles different query types via SQLGUARD_MODE env var or --mode flag:

Mode	SELECT	INSERT/UPDATE	DROP/DELETE/TRUNCATE
read-only	Allowed	Blocked	Blocked
strict (default)	Allowed	Dry-run + confirmation	Blocked
permissive	Allowed	Allowed	Allowed (with warning)

Example config with mode

{
  "mcpServers": {
    "sqlguard": {
      "command": "npx",
      "args": ["sqlguard-mcp", "--pg", "postgresql://user:pass@localhost/mydb"],
      "env": {
        "SQLGUARD_MODE": "read-only"
      }
    }
  }
}

Or via CLI flag: npx sqlguard-mcp --pg "..." --mode strict

CLI options

CONNECTION (one required):
  --pg <connection-string>   PostgreSQL connection string
  --sqlite <file>            SQLite file path or :memory:

  Individual PostgreSQL options:
  --host, --port, --database, --user, --password, --ssl

SECURITY MODE:
  --mode <mode>              read-only | strict | permissive (default: strict)

ENVIRONMENT VARIABLES:
  SQLGUARD_PG                PostgreSQL connection string
  SQLGUARD_SQLITE            SQLite file path
  SQLGUARD_MODE              Security mode

Supported databases

Database	Connection
PostgreSQL	--pg "postgresql://user:pass@host/db"
SQLite	--sqlite "./path/to/db.sqlite"

SQLGuard MCP Pro

Need more control? The Pro version adds:

Feature	Description
Audit log	Every query logged to SQLite with timestamp, result, rows affected
Custom rules via YAML	Block specific tables, cap max rows, restrict by time of day
Multiple connections	Connect to several databases simultaneously
Dry-run mode	Preview what a query would do without executing it

Get Pro: https://sealca.gumroad.com/l/sqlguard-mcp

License

MIT — free to use. Pro features require a commercial license.