Let Claude work on your database — safely.

Hand AI agents scoped MCP tools that inherit your permissions. They get useful access; they never get a raw connection.

Start free

No raw SQL

MCP tools only reach SchemaRegistry, the PermissionCompiler, and the DataEngineProvider — never a raw connection.

Compiled permissions

Every AI request runs through the same RBAC + Filter AST as your users. No privileged backdoor.

Dry-run writes

Mutations can be previewed with explain plans before anything touches data.

Approval gates

Destructive operations drop into an approval queue instead of executing.

# MCP tool call — governed, not raw SQL
await sf.mcp.plan({
  op: 'add_index',
  collection: 'posts',
  field: 'slug',
});

// → explain plan + affected rows,
// → destructive? queued for approval

Enforced, not advisory

A repo guard (check-mcp-data-access) fails CI if any MCP code touches a raw connection.
The Filter AST is shared across RBAC, Studio, REST, SDK, flows, and MCP — one policy, everywhere.
Audit events are redacted and every token is hash-only at rest.

Get started

Give your agents safe data access.

Start free