--- title: "PgBeam: safe Postgres access for AI agents" description: "Hand an agent a scoped connection string or a hosted MCP endpoint. PgBeam enforces read-only access, table allowlists, PII masking, query budgets and a kill-switch in the PostgreSQL wire protocol, audits every query, and works with any Postgres." canonical: "https://pgbeam.com/" last-updated: "2026-09-14T04:17:03.254Z" --- # PgBeam: Safe Postgres access for AI agents Hand an agent a scoped connection string or a hosted MCP endpoint. PgBeam enforces read-only access, table allowlists, PII masking, query budgets, and a kill-switch in the PostgreSQL wire protocol, audits every query, and works with any Postgres. Zero code changes. ## Why Nobody wants to hand an AI agent a superuser connection string. PgBeam sits in the wire between the agent and the database and decides what the agent is allowed to do. Enforcement happens at the protocol, not inside the database, so it works with RDS, Aurora, self-hosted, or any managed Postgres. ## Who it is for Teams shipping an AI agent or copilot that has to read or write a real Postgres, at the moment they are about to hand it a connection string. In practice that is the platform or AI engineer who holds the credential and owns the incident if the agent misbehaves, and the engineering lead or security owner who has to approve agent access to production before it ships. The same controls apply to a person at a psql prompt, so an analyst credential and an agent credential are configured the same way. Not a fit: databases that do not speak the PostgreSQL wire protocol (MySQL, Mongo), and teams that need a compliance certificate in hand today, since PgBeam is not SOC 2 or HIPAA certified. ## Capabilities - Scoped agent credentials: per-agent username/password, revocable, kill-switchable. - Hosted MCP endpoint: one URL with ten tools, `briefing`, `query`, `validate_sql`, `list_tables`, `describe_table`, `explain`, `schema_catalog`, `my_permissions`, `search_docs`, and `read_doc`. - Read-only enforcement: block INSERT/UPDATE/DELETE/DDL per credential. - Table allowlists: anything off the list is blocked at the wire. - PII masking: redact, null, or hash sensitive columns in flight. - Query budgets and row caps: cap queries per window and rows per result. - Kill-switch: stop one agent or every agent on a project instantly. - Full audit trail: every statement with its decision, reason, rows, bytes, and latency. - Near-zero code changes: standard drivers, ORMs, and agent frameworks connect with a connection-string host swap. The serverless HTTP driver (@neondatabase/serverless) needs a one-line fetchEndpoint override. ## Links - About, including what PgBeam does not claim: https://pgbeam.com/about - Features: https://pgbeam.com/features - Pricing: https://pgbeam.com/pricing - Docs: https://pgbeam.com/docs - Hosted MCP: https://pgbeam.com/docs/mcp - Agent skill: https://pgbeam.com/skill.md - How PgBeam works, the mechanism end to end: https://pgbeam.com/architecture.md - Launch announcement, dated: https://pgbeam.com/blog/launching-pgbeam.md - Blog index: https://pgbeam.com/blog.md ## FAQ ### How does PgBeam enforce what an agent can do? Enforcement happens in the PostgreSQL wire protocol, between the agent and your database. PgBeam parses every statement an agent sends, checks it against the policy attached to that credential (read-only, table allowlists, masking, budgets), and only forwards it if it is allowed. Blocked statements never reach your database. ### Does PgBeam work with my Postgres? Yes. Enforcement is at the wire, not inside the database, so PgBeam works with RDS, Aurora, self-hosted Postgres, or any managed provider. There is no extension to install and no change to your schema. ### Do I need to change my code? No. The agent gets a scoped connection string or a hosted MCP URL. Every PostgreSQL driver, ORM, and agent framework works unmodified. Your own application keeps using its existing connection untouched. ### How does PII masking work? You name the columns to protect and choose redact, null, or hash. PgBeam rewrites those values in the result before they leave the wire, so the agent receives masked data it can still join and group on. Your application reads the real values. ### Can I revoke an agent's access? Yes, instantly. Revoke a single credential or hit the kill-switch to stop one agent or every agent on a project. The next statement is refused. No credential rotation and no database changes required. ### What is in the audit log? Every statement an agent runs, allowed or blocked, with the decision, reason, rows, bytes, latency, and credential. Filter and export it in the dashboard. Recent entries are queryable in the control plane and archived for retention. ### What MCP tools does the hosted endpoint expose? Ten tools: briefing (the schema, the credential's limits, and how to query within them in one call), query, validate_sql, list_tables, describe_table, explain, schema_catalog, and my_permissions (which tells the agent what its credential may do, so it does not find out by being blocked), each enforced against the same policy engine as the connection string, plus search_docs and read_doc for looking up how PgBeam works. An agent connected over MCP gets the same guardrails. Paste the URL into Claude Code, Cursor, or any MCP client. No install. ### Is there an SLA or uptime guarantee? Uptime commitments and support terms are part of Enterprise plans. Contact sales@pgbeam.com to discuss an SLA for your team. ### What happens if I exceed my limits? Overage is billed at $0.10 per 1K queries above your daily limit on all plans. Data transfer overage is $0.20/GB on all tiers. No surprises: usage is tracked in your dashboard. ### Can I switch plans at any time? Yes. Upgrade or downgrade any time from your dashboard. Upgrades take effect immediately. Downgrades take effect at the end of the current billing period. ### Does the gateway add pooling and caching? Yes. The gateway runs on a globally distributed wire-protocol proxy, so agent traffic gets connection pooling (which absorbs the connections agents leak) and optional query caching (which absorbs the questions they re-ask) at no extra setup. ### Can I self-host PgBeam? Yes, on the Scale and enterprise plans. The self-hosted (BYOC) data plane runs the PgBeam proxy inside your own VPC or cluster, so agent traffic and your database credentials never leave your network, while the control plane, policy engine, and dashboard stay hosted by PgBeam. The proxy dials home only to fetch policy config and ship the audit trail. See the self-hosted data plane docs to enroll.