The agent gateway

The reason PgBeam exists. Instead of pasting a DATABASE_URL into an agent and hoping, you issue that agent its own credential and decide what it can do.

Every control runs in the Postgres wire protocol, at the proxy, before your database sees the statement:

• Scoped credentials: a username and password per agent. Your real database credentials never move.
• Read-only enforcement: INSERT, UPDATE, DELETE, and DDL refused outright.
• Table and column allowlists: the agent reaches what you allow and nothing else.
• Column masking: redact, null, or hash a column in flight.
• Query budgets and row caps: an hourly and daily ceiling per credential, so a looping agent hits the ceiling instead of your primary.
• Kill-switch: stop one agent or every agent in a project immediately, with no credential rotation.
• Audit log: every statement recorded, queryable in the dashboard, over the API, and from the CLI.

The same policy applies whether the agent connects over the wire protocol or over the hosted MCP endpoint, which is one URL that works in Claude Code, Cursor, and any other MCP client with no install.

Also in this release: human-in-the-loop approvals for statements you want a person to sign off on, anomaly detection against a per-credential baseline, and webhooks with HMAC signing that emit in Splunk, Datadog, and Elastic formats. Enforcement applies to cached results too, so a masked column stays masked on a cache hit.