Gadwal
Coming soon

MCP for databases

A database MCP server that asks before it writes

Give Claude, Cursor or Codex access to your databases without giving them the keys to production.

Review panel: AI clients want 3 changes on Shop – Staging. An update of 2 product prices and an insert can be approved; a DELETE from sessions is flagged Destructive and offers Back Up and Run.
Three AI changes waiting for review. The destructive one is flagged and backs up the table before it runs.

Gadwal has an MCP server built in. Turn it on, connect your AI app from Settings (one click for most apps), and it can explore your schema, read rows and run queries across every connection you allow: Postgres, MySQL, MariaDB, SQLite, DuckDB, D1, ClickHouse and BigQuery.

Layers of protection

  1. Local only. The server listens on 127.0.0.1, is off by default, checks the Origin header and gives each AI app its own revocable token, stored in your Keychain.
  2. Per-connection AI levels. Off, Read-only, Ask before write or Full. Production connections default to Read-only, and raising them needs a confirmation.
  3. Read-only enforced by the server. Where the engine supports it, AI reads run in a read-only session, so a query with side effects still can't write.
  4. A statement classifier that understands each dialect's comments, quoting and dollar-quotes, and treats anything it can't classify as a write.
  5. Staged writes. On “Ask before write”, changes go to a review panel with the exact SQL and an estimate of affected rows. Approve, edit or reject; the AI is told the outcome.
  6. Destructive statements always need you, at every level, and trigger a backup of the affected tables first (BigQuery uses its built-in 7-day time travel instead).
  7. Hidden columns. AI apps can't read, search or name them: they're removed from results and table descriptions, and SQL that mentions them is refused. On Postgres, also give the AI a database role that can't read them.
  8. Limits. 200 rows per result by default, 2 KB per cell, 256 KB per answer, and a rate limit per AI app.
  9. An activity log of every call, kept 180 days and exportable to CSV.

Tools the AI gets

Listing connections, schemas and tables; describing tables and getting DDL; sampling rows; read queries, EXPLAIN and BigQuery cost estimates; searching schema and values; structured inserts, updates and deletes; DDL; checking on pending changes; and WordPress tools.

Set up your AI app.

Questions

What is MCP?

The Model Context Protocol is an open standard that lets AI apps call tools provided by other programs. Gadwal provides database tools over MCP.

Why not just give the AI a connection string?

Then it has every permission that database user has, with no review and no log. Gadwal sits in between: it decides per connection what the AI may do, stages writes for you, and records every call.

Does Gadwal include an AI model?

No. You use the AI app you already have. Gadwal has no API keys and sends nothing to any AI provider itself.