Safe Postgres forAI agents
Hand your agent a scoped connection string instead of your superuser one. PgBeam enforces the rules in the wire and logs every query it runs.
No credit card. 14-day trial. Works with RDS, Aurora, Neon, Supabase, or self-hosted.
Connecting agent…
PgBeam decides every statement at the wire.
CLI
$ curl -fsSL https://pgbeam.com/install | shAI Agents
Learns to install, auth, and use PgBeamRead https://pgbeam.com/skill.md and follow instructionsYour agent does not need your whole database
Same Postgres, same drivers, same queries. One different credential, and a policy in the path.
- A superuser connection string, inside an LLM loop
- One hallucinated UPDATE or DROP from data loss
- Customer PII flowing into the model context
- No ceiling on an agent that starts looping
- No per-agent record of what actually ran
- Revoking access means rotating the role
- A scoped credential, read-only by default
- Writes and DDL rejected before the database sees them
- PII masked in flight, your app still reads real values
- Query budgets and row caps enforced per credential
- Every statement logged with its decision and reason
- Revoked in one click, or killed mid-session
Safe agent access in four steps
All of it happens between the agent and your database. Nothing changes inside Postgres.
Issue a scoped agent credential
Connect your database once. Each agent gets its own connection string and MCP URL, never your real credentials.
Scoped, revocable, kill-switchable. Your real database credentials never leave PgBeam.
Attach a policy
Allow the tables, mask the columns, cap the volume. Edits hot-reload, so they land on the agent's next query.
Enforcement happens in the wire
Every statement is parsed and checked before your database sees it. Blocked queries come back with a reason an LLM can act on.
SELECT id, email FROM usersmaskedemail hashed before it leaves the wire
UPDATE orders SET status = 'paid'blockedSELECT * FROM internal_secretsblockedSELECT count(*) FROM ordersallowedAudit every query
Each statement is recorded with its decision, rows, and latency. Read it in the dashboard, export it, or kill the agent mid-session.
See exactly what an agent can and cannot run
Type a statement, or pick one. It is evaluated against the example policy exactly the way the wire does it.
allowed, but sensitive columns are rewritten before results leave the wire: users.email → hash. The agent can still join and group on them.
Policy in force
Every statement is checked against this policy in the wire before it reaches the database. Change the query on the left to see the decision.
One policy engine, enforced at the wire
Set the rules once. They apply to the connection string and the MCP endpoint alike, on any Postgres host.
Scoped credentials
A username and password per agent. Your real database credentials never move.
Hosted MCP endpoint
One URL for Claude Code, Cursor, or any MCP client. Eight tools, no install.
Read-only enforcement
INSERT, UPDATE, DELETE, and DDL refused before your database sees them.
Table and column allowlists
The agent reaches what you allow. Everything else is blocked at the wire.
PII masking
Redact, null, or hash columns in flight. Masked values still join and group.
Budgets and row caps
A looping agent hits a ceiling instead of your primary.
Kill-switch
Stop one agent or every agent instantly. No credential rotation.
Tamper-evident audit
Every statement hash-chained, with export to Splunk, Datadog, and Elastic.
Zero code changes
Swap the host in your connection string. Drivers and ORMs connect unchanged.
A real proxy, not a speed bump
The gateway runs on a globally distributed wire-protocol proxy. The guardrails come with the things a proxy is good at.
- Connection pooling
- Absorbs the connections agents leak, so a fleet of them does not exhaust your primary.
- Query caching
- Absorbs the questions agents re-ask, served from the edge without touching Postgres.
- 12 global metros
- Traffic is routed to the nearest one, so the guardrails cost little wherever you run.
First-query latency, measured live from serverless functions right now. MISS pays a pooled connect; HIT is served from the cache.
Running live benchmarks
Measuring real latency from global regions
Give your agent Postgres it can't wreck
Connect a database, issue a credential, and watch the audit log fill up. No credit card. 14-day trial.