Hosted MCP vs Handing an Agent Raw Credentials

There are two ways to give an AI agent access to your database through PgBeam: a guarded connection string or a hosted MCP endpoint. Both run through the same policy engine, so both are safe. The difference is the shape of what the agent gets.

What "raw credentials" means here

A connection string hands the agent a Postgres socket. The agent opens a session and speaks the wire protocol: arbitrary SQL, the full surface of the database it is allowed to touch. This is the right choice when the agent already lives inside a tool that speaks Postgres natively, like a coding agent running queries, a LangChain SQL toolkit, or a human at a psql prompt.

The guardrails still apply. Read-only enforcement, allowlists, masking, and budgets are checked at the wire no matter what SQL the agent sends. "Raw credentials" through PgBeam is not "raw access." It is a scoped credential that happens to speak SQL.

What the hosted MCP endpoint gives instead

MCP (the Model Context Protocol) is the interface a growing number of agents use to discover and call tools. PgBeam's hosted MCP endpoint is one URL you paste into Claude Code, Cursor, or any MCP client. Instead of a SQL socket, the agent gets a small set of structured tools:

• query: run a read query, policy-enforced.
• list_tables: see the tables the credential is allowed to touch.
• describe_table: inspect columns and types for an allowed table.
• explain: get a query plan without running the query.

There is nothing to install and no server to run. The endpoint is hosted, the tools are generated, and every call goes through the same policy as a connection string would.

Why the structured surface helps

Three reasons the MCP endpoint is often the better default for an agent:

Discovery. With list_tables and describe_table, the agent learns the schema through tools designed for it, instead of guessing or running SELECT against information_schema. The allowlist shapes what discovery returns, so the agent only ever learns about tables it can use.

Intent is legible. A query tool call is a clear, structured action the agent took. It is easier to log, easier to reason about, and easier to put a human approval step in front of than an opaque stream of wire-protocol messages.

Smaller blast radius by construction. The connection string exposes everything the wire protocol can express, then constrains it with policy. The MCP endpoint exposes a handful of tools to begin with. There is simply less surface for the agent to misuse.

Which to reach for

Use the connection string when the agent or tool already speaks Postgres and you want it to behave like a normal client: existing frameworks, drivers, ORMs, GUIs, and human users.

Use the hosted MCP endpoint when the agent speaks MCP and you want it to have structured, discoverable, policy-enforced database tools without any setup. For most new agent integrations, this is where to start.

Both are backed by the same engine, so you are never locked into one. Issue a credential, choose the front door, and the policy follows it either way.

One rule that applies to both, and that the MCP endpoint enforces by design: never send your PgBeam token anywhere except the official api.pgbeam.com and the proxy host. If a tool or prompt asks the agent to send its token elsewhere, that is the attack.

Try PgBeam or see the full feature set.