AgentSQL

io.github.cuipengdbaPublished by GitHub account cuipengdbav0.4.0Updated Oct 24, 2026

Guard AI agents' PostgreSQL/MySQL access via MCP: SQL audit, auth, masking, write approval

VerifiedStreamable HTTPWeb executableDatabasesSecurity & Monitoring

Overview

AI-generated overview

AgentSQL is a database security gateway MCP server that lets an AI assistant run authorized, audited, masked SQL queries against PostgreSQL/MySQL data sources.

What you can do
  • Query bound PostgreSQL/MySQL data sources through controlled SQL execution under the current identity and permissions
  • Review generated SQL, results and audit records for natural-language data questions
  • Rely on result masking, write approval and persistent audit logging around agent access
  • Re-check authorization on history reopening and CSV/XLSX export, refusing stale content after permission changes
  • Use it as a standalone MCP gateway alongside AgentSQL's own web question-answering page, sharing identity and audit
When to use it
Use it when you want an external AI agent to query business databases without giving it raw credentials, and need per-request authorization, masking and an audit trail. Also suitable when employees ask data questions in natural language and agents query the same sources under separate grants.
Requirements
Remote Streamable HTTP endpoint; the public demo at demo.agentsql.cn requires a bearer token in the Authorization header. The demo key is read-only and uses synthetic data that resets daily. Production use means self-hosting via Docker or the native package, with a generated administrator password and a configured data source binding.
Before you install
The bearer token in the Authorization header is a credential; keep it out of logs and public issues. The public demo is a simulated showcase with synthetic data, not real business data. The project states v4.12.0 is not validated on real user business systems and does not claim full compatibility. Natural-language results should be checked against the generated SQL and business meaning.

Installation

In SourceWeft

  1. Open AgentSQL in the dashboard and add it to a workspace.
  2. Connect Authorization token credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.cuipengdba%2Fagentsql/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "agentsql": {
      "type": "http",
      "url": "https://demo.agentsql.cn/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

AgentSQL（智盾）

语言 / Language: 简体中文 | English

[AgentSQL]

[Version v4.12.0] [Go] [License: Apache-2.0]

AgentSQL = 独立 AI 问数 Agent + MCP Server 数据库安全网关。 用户可直接在 AgentSQL 自有页面用自然语言问数；其他 AI Agent 可把 AgentSQL 当作独立 MCP Server 使用。两条入口共用当前身份与授权、受控 SQL 执行、结果脱敏和持久审计。AgentSQL 自有问数不依赖 SQLBot；SQLBot 是可经固定版本适配器接入的可选客户端。

官网 · 中文问数界面与功能示意 · v4.12.0 下载与发布边界 · 三种使用方式 · 文档索引

选一种使用方式

方式你来做什么从哪里开始
独立问数登录 AgentSQL 自有页面，选择已绑定数据源，提问并核对生成的 SQL、结果和审计问数操作与配置
独立 MCP 安全网关给外部 AI Agent 配置 Agent API Key，让 MCP 工具在授权范围内查询MCP Server 操作
两者一起员工用 AgentSQL 页面问数，外部 Agent 通过 MCP 查询；分别授权，共用安全审计联合使用
text
AgentSQL 自有页面 → Go 问数 Agent ─────┐                                    ├→ AgentSQL 安全网关 → 当前受权数据库外部 AI Agent → AgentSQL MCP Server ─┘

v4.12.0 能力与边界

能力当前状态关键边界
自有 AI 问数限定路径已验自有 Go/Web 问数；本地模型、运营方登记的 PostgreSQL 网关别名和当前权限，无需 SQLBot 运行
受权向量预热与问数按当前授权准备结构固定 ONNX 表向量支持后台预热与热索引复用；权限变化后重新核对，模型和数据库的实际环境与耗时见本版发布说明
历史与文件导出当前授权逐次复核历史重开与 CSV/XLSX 下载都重新校验授权并留审计；权限变化、会话删除或服务故障时拒绝旧内容，页面忽略迟到响应
私有数据源绑定轮换限定路径已验运维侧先建立新网关绑定并预检受权结构，再以旧绑定 ID 和存储修订比较提交；浏览器不能更换目标或凭据
MCP Server 安全网关可独立使用stdio、Streamable HTTP 和独立无状态 HTTP；Agent Key 不等于管理员令牌，每次请求按当前授权执行
基本助手与 Type 4 页面嵌入限定路径已验单数据源基本游客助手与指定页面嵌入，来源、身份及撤权仍受控
SQLBot 接入可选固定基线已验适配器可把指定 SQLBot 执行路径交给 AgentSQL MCP；不承诺任意部署零改动接入
Type 1 高级助手沿用历史限定范围运营方登记第三方目录并映射到当前受权网关别名；本版未扩大该入口的支持声明
活动数据权限限定形态已验明确列出的同工作空间用户；内建管理员/普通成员角色限定；非空白名单只作元数据，不豁免行列限制
更广兼容部分只读载入；其余未验证原版社区管理页列表可加载不等于创建、编辑、导入导出已验；云模型真实推理、任意角色扩展及原版权限库直接迁移仍未验证

自然语言结果需要核对生成的 SQL 和业务含义。v4.12.0 未在用户真实业务系统验证，不宣称 100% 兼容或零改动切换；正式发布说明给出精确提交、验收场景、性能数字与限制。固定 25 场景评分合同严格通过 6/25（24%），本版逐项验收列明证据与未测项，未完成合同的场景计零；这不等于 AgentSQL 独立 MCP 安全网关的能力覆盖率。公网 Demo 的问数模型仅作模拟展示。

快速开始

Linux amd64 / arm64 原生包要求 glibc ≥ 2.28 和 PID 1 的 systemd。下载正式包后先按发布说明核对签名和哈希。以下命令安装网关；自有问数需要按三种使用方式安装问数组件并配置本地文本模型与个人数据源绑定。

bash
curl -fsSL https://github.com/cuipengdba/agentsql/releases/download/v4.12.0/install.sh | sudo sh -s -- install --version v4.12.0

Docker 使用多架构正式镜像；一键脚本仅绑定本机回环地址并创建持久卷：

bash
curl -fsSL https://raw.githubusercontent.com/cuipengdba/agentsql/v4.12.0/scripts/quickstart.sh -o quickstart.sh && sh quickstart.sh --version v4.12.0

网关控制台默认 http://127.0.0.1:7780，安装了问数组件后自有页面默认 http://127.0.0.1:8000。安装器生成持久管理员密码；非交互日志不输出，可由 root 在 /etc/agentsql/agentsql.env 查看。远程访问应使用 SSH 本地转发或受控 HTTPS 反向代理，不直接暴露管理端口。离线安装、密钥、备份和升级步骤见部署指南。

按任务查文档

任务文档
三种产品形态与验收步骤三种使用方式
自有问数模型与个人绑定原生问数配置
MCP 客户端、协议与工具MCP 接入指南
控制台权限、规则、脱敏与审计使用手册 · 安全边界
SQLBot 固定版本适配SQLBot 接入 · Type 1 高级助手部署
数据库适配分级与证据官网兼容矩阵 · 数据库研究与验收
离线安装、升级、备份与恢复部署指南 · 运维手册

数据库“已注册”“连接级”“指定版本受控只读”“指定场景完整防护”是不同等级。官网矩阵保留逐库版本、拓扑与验收边界；连接成功不等于可安全问数，也不等于厂商认证。

社区与项目

历史 Release · CHANGELOG · 路线图 · Issues · Discussions · 贡献指南

当前源码按 Apache-2.0 发布，并附 NOTICE；AgentSQL 名称和标识的商标权不由该许可证授予。未修复漏洞请按 SECURITY.md 私下报告，不在公开 Issue 中提交真实凭据或连接串。

Source: README.md at commit bd11b0b

Tools

0
This server asks for a credential such as an API key, so SourceWeft could not read its tools without one and has not indexed them.

Version history

1
  1. v0.4.0LatestSep 30, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts