Safe Postgres forAI agents
Hand your agent a scoped connection string instead of your superuser one. PgBeam enforces the rules in the wire and logs every query it runs.
No credit card. 14-day trial. Works with RDS, Aurora, Neon, Supabase, or self-hosted.
Connecting agent…
PgBeam decides every statement at the wire.
CLI
$ curl -fsSL https://pgbeam.com/install | shAI Agents
Learns to install, auth, and use PgBeamRead https://pgbeam.com/skill.md and follow instructionsWhat does your agent actually need from your database?
Same Postgres, same drivers, same queries. One different credential, and a policy in the path.
- A superuser connection string, inside an LLM loop
- One hallucinated UPDATE or DROP from data loss
- Customer PII flowing into the model context
- No ceiling on an agent that starts looping
- No per-agent record of what actually ran
- Revoking access means rotating the role
- A scoped credential, read-only by default
- Writes and DDL rejected before the database sees them
- PII masked in flight, your app still reads real values
- Query budgets and row caps enforced per credential
- Every statement logged with its decision and reason
- Revoked in one click, or killed mid-session
How do you give an agent safe access?
Four steps, all of them between the agent and your database. Nothing changes inside Postgres.
Issue a scoped agent credential
Connect your database once. Each agent gets its own connection string and MCP URL, never your real credentials.
Scoped, revocable, kill-switchable. Your real database credentials never leave PgBeam.
Attach a policy
Allow the tables, mask the columns, cap the volume. Edits hot-reload, so they land on the agent's next query.
Enforcement happens in the wire
Every statement is parsed and checked before your database sees it. Blocked queries come back with a reason an LLM can act on.
SELECT id, email FROM usersmaskedemail hashed before it leaves the wire
UPDATE orders SET status = 'paid'blockedSELECT * FROM internal_secretsblockedSELECT count(*) FROM ordersallowedAudit every query
Each statement is recorded with its decision, rows, and latency. Read it in the dashboard, export it, or kill the agent mid-session.
What can an agent actually run under a policy?
Type a statement, or pick one. It is evaluated against the example policy exactly the way the wire does it.
allowed, but sensitive columns are rewritten before results leave the wire: users.email → hash. The agent can still join and group on them.
Policy in force
Every statement is checked against this policy in the wire before it reaches the database. Change the query on the left to see the decision.
What does one policy let you control?
Set the rules once. They apply to the connection string and the MCP endpoint alike, on any Postgres host.
Scoped credentials
A username and password per agent. Your real database credentials never move.
Hosted MCP endpoint
One URL for Claude Code, Cursor, or any MCP client. Ten tools, no install.
Read-only enforcement
INSERT, UPDATE, DELETE, and DDL refused before your database sees them.
Table and column allowlists
The agent reaches what you allow. Everything else is blocked at the wire.
PII masking
Redact, null, or hash columns in flight. Masked values still join and group.
Budgets and row caps
A looping agent hits a ceiling instead of your primary.
Kill-switch
Stop one agent or every agent instantly. No credential rotation.
Tamper-evident audit
Every statement hash-chained, with export to Splunk, Datadog, and Elastic.
Zero code changes
Swap the host in your connection string. Drivers and ORMs connect unchanged.
Weighing this against something else? Compare covers a read-only role, PgBouncer, RDS Proxy, and a DIY MCP server, and use cases covers what people build with it.
Does a proxy in the path slow you down?
Not by much, and often the opposite. The gateway is a globally distributed wire-protocol proxy, so the guardrails arrive with the things a proxy is good at.
- Connection pooling
- Absorbs the connections agents leak, so a fleet of them does not exhaust your primary.
- Query caching
- Absorbs the questions agents re-ask, served from the edge without touching Postgres.
- 12 global metros
- Traffic is routed to the nearest one, so the guardrails cost little wherever you run.
The whole mechanism, from the TLS handshake to the audit row, is written up on how PgBeam works.
First-query latency, measured live from serverless functions right now. MISS pays a pooled connect; HIT is served from the cache.
Running live benchmarks
Measuring real latency from global regions
What do people ask before signing up?
Give your agent Postgres it can't wreck
Connect a database, issue a credential, and watch the audit log fill up. No credit card. 14-day trial.