--- title: "Getting Started" description: "Give an AI agent safe, scoped, audited access to your Postgres. Enforcement is in the wire protocol, so it works with any Postgres and no code changes." canonical: "https://pgbeam.com/docs" last-updated: "2026-09-14T19:37:21.000Z" --- # Getting Started > Give an AI agent safe, scoped, audited access to your Postgres. Enforcement is in the wire protocol, so it works with any Postgres and no code changes. URL: https://pgbeam.com/docs PgBeam is the safe Postgres gateway for AI agents. You hand an agent a scoped connection string or a hosted MCP endpoint instead of a superuser one, and PgBeam enforces what it can do: read-only access, table allowlists, PII masking, query budgets, and a kill-switch. Every query is audited. Enforcement happens at the PostgreSQL wire protocol, so it works with RDS, Aurora, self-hosted, or any managed Postgres, with no extension to install and no change to your schema. Issue a scoped credential, attach a read-only policy, and point your agent at it. No SDK, no protocol shim, no application rewrite. Start with the Quickstart. ## Connect an agent Give an agent safe, read-only access in two minutes. Paste one URL into Claude Code, Cursor, or any MCP client. Ten tools: policy-enforced briefing, query, validate\_sql, list\_tables, describe\_table, explain, schema\_catalog, and my\_permissions, plus search\_docs and read\_doc. A scoped Postgres URL for any driver, ORM, or agent framework. Enforced from the first query. Enforcement in the wire protocol, between the agent and your database. ## The policy you control Block every write and DDL. Reads pass, writes are rejected at the wire. Allow the exact schemas and tables the agent should touch. Redact, null, or hash sensitive columns in flight. The agent never sees raw values. Cap queries per window and rows per result. Runaway loops hit a ceiling. Stop one agent or every agent instantly. No credential rotation. Every statement recorded with its decision, rows, bytes, and latency. ## A real proxy underneath The gateway runs on a globally distributed wire-protocol proxy. Agent traffic gets connection pooling, query caching, replica routing, and edge latency for free. These are supporting features now, not the headline. Absorb the connections agents leak without wiring PgBouncer into every environment. Absorb the questions agents re-ask, with TTL and stale-while-revalidate controls. Route selected reads to replicas instead of treating every query the same. ## How do you connect your own application? The pages above cover giving an **agent** safe access. PgBeam also sits in front of your **own application** for pooling, caching, replicas, and routing. The setup below is that path: point your app at a PgBeam hostname and keep speaking normal PostgreSQL. Your application's passthrough connection is never subject to agent policies. ## Prerequisites Before you begin, you need: A PostgreSQL database reachable from the internet The connection details for that database: host, port, username, password, and database name ## Setup ## Create an account Sign up at dash.pgbeam.com. New accounts start on the Starter plan, which includes a 14-day trial. A default organization is created for you automatically. ## Create a project Create a project in the dashboard. Each project gets a hostname like `abc.proxy.pgbeam.app`. That hostname is what your application will connect to. ## Add your origin database Use **Add Database** in the dashboard and enter the connection details for the database PgBeam should forward traffic to. Field Description Example **Host** Origin database hostname `db.example.com` **Port** PostgreSQL port `5432` **Database name** Database to connect to `mydb` **SSL mode** TLS mode used for the upstream connection `verify-full` `verify-full` is the right default for most managed databases. Only relax it if your provider does not give you a certificate chain your client can verify. PgBeam stores the origin database credentials you enter here. Application user credentials are still checked by the origin database at connection time. ## Replace the host in your connection string Keep the username, password, port, and database name. The hostname is the only required change. ## Run a query At this point your app should already be talking through PgBeam: If that works, the plumbing is done. Pooling and observability are already in the path. Caching is available when you are ready to turn it on. ## When should you turn on caching? Caching starts off disabled for new databases. That is the safer default. Once traffic is flowing, you can enable it for stable reads that benefit from reuse. Open your database in the dashboard and go to **Cache Rules**. PgBeam tracks query shapes automatically, so you can enable caching on the high-frequency reads that are worth it. See the Caching guide for TTL, SWR, bypass rules, and cache annotations. ## Which clients are supported? PgBeam works with any PostgreSQL-compatible client. The docs include concrete setup guides for the tools people ask about most often: Language Drivers and ORMs TypeScript Prisma, Drizzle, Sequelize, TypeORM Python psycopg, SQLAlchemy Go pgx Java JDBC, HikariCP, Spring Boot ## Prefer the terminal? The PgBeam CLI covers the same setup flow: ## Where should you go next? Framework-specific setup instructions and pool sizing guidance. Learn when cache helps, when it bypasses, and how to turn it on safely. Manage PgBeam from the terminal and script the control plane. Call the same REST API used by the dashboard and generated SDK. Understand routing, relay, pooling, and failure behavior.