Letting AI agents query my databases without ever giving them the credentials

Описание и применение

Агенты ИИ могут выполнять запросы к базам данных, не получая строку подключения, благодаря локальному серверу MCP, который хранит учётные данные в ключевом хранилище ОС и требует ручного подтверждения выполнения SQL.

Задача

AI agents need database access but storing credentials in the agent’s config exposes passwords in plain text.

Результат

Credentials stay secure in the IDE; agents can query databases with human‑in‑the‑loop approval, reducing risk of accidental data modification.

Рабочий процесс

• 1. Agent connects to the local MCP server over STDIO on loopback.
• 2. Agent requests schema or table information via MCP calls (e.g., getSchemaSummary).
• 3. Agent proposes SQL edits; the IDE shows a diff and requires user approval.
• 4. Upon approval, the IDE executes the SQL, displaying the connection and query, and runs only after explicit consent that expires after 120 s.
• 5. Results are limited to 100 rows (max 1,000) and 256 KiB per response.

Доказательства

The IDE already holds my connections (passwords live in the OS keyring). It also runs a local MCP server, so the agent talks to the IDE, not to the database.

Источник

Writes are never automatic. proposeSqlEdit shows a before/after diff in the desktop. executeSql shows the connection and the exact SQL, and runs only after I approve; the approval is bound to that request and expires after 120 s.

Источник

Results are bounded (default 100 rows, max 1,000, 256 KiB per response).

Источник