Letting AI agents query my databases without ever giving them the credentials

Description and use

AI agents query databases without receiving connection strings; a local MCP server mediates communication, keeping credentials in the IDE’s secure storage and requiring human approval for writes.

Problem

AI agents need database access but storing credentials in the agent’s config exposes passwords in plain text.

Outcome

Credentials stay secure in the IDE; agents can query databases with human‑in‑the‑loop approval, reducing risk of accidental data modification.

Workflow

• 1. Agent connects to the local MCP server over STDIO on loopback.
• 2. Agent requests schema or table information via MCP calls (e.g., getSchemaSummary).
• 3. Agent proposes SQL edits; the IDE shows a diff and requires user approval.
• 4. Upon approval, the IDE executes the SQL, displaying the connection and query, and runs only after explicit consent that expires after 120 s.
• 5. Results are limited to 100 rows (max 1,000) and 256 KiB per response.

Evidence

The IDE already holds my connections (passwords live in the OS keyring). It also runs a local MCP server, so the agent talks to the IDE, not to the database.

Source

Writes are never automatic. proposeSqlEdit shows a before/after diff in the desktop. executeSql shows the connection and the exact SQL, and runs only after I approve; the approval is bound to that request and expires after 120 s.

Source

Results are bounded (default 100 rows, max 1,000, 256 KiB per response).

Source