Use cases
What PgBeam is for
The situations teams reach for PgBeam in, one page each: a hosted MCP server, read-only Postgres for agents, PII masking before an LLM sees a row, analytics agents, support copilots, and autonomous workflows.
Hosted MCP
A hosted MCP server for Postgres
Give any MCP client safe, policy-enforced access to your Postgres. A hosted MCP endpoint with briefing, query, validate_sql, list_tables, describe_table, explain, schema_catalog, and my_permissions tools, plus search_docs and read_doc, read-only enforcement, PII masking, budgets, and a full audit trail. No server to run.
Coding agents
Give Claude and Cursor safe database access
Give Claude Code, Cursor, and other coding agents safe Postgres access. Scoped credentials, read-only enforcement, table allowlists, PII masking, budgets, a kill-switch, and a full audit trail. Works with any Postgres, zero code changes.
Least privilege
Read-only Postgres for AI agents
Give an AI agent strict read-only Postgres access without managing database roles. PgBeam blocks writes and DDL per credential in the wire protocol, with table allowlists, PII masking, and a full audit trail. Works with any Postgres.
Data protection
PII masking for LLM database access
Keep PII out of your LLM context. PgBeam masks sensitive Postgres columns in flight, by schema.table.column, with redact, null, or hash. The agent gets masked values it can still join on; your app reads the real data. Any Postgres, zero code changes.
Use case
Safe Postgres for AI analytics agents
Give an NL-to-SQL or BI agent safe Postgres access. Read-only enforcement, PII masking, max rows, statement timeouts, and query caching, all in the wire protocol. A hallucinated UPDATE fails closed; repeated questions hit cache. Any Postgres.
Use case
Safe Postgres for customer-support copilots
Give a support copilot safe Postgres access. Row-level tenant isolation, PII masking on customer data, read-only with approval-gated writes, and a full audit trail, enforced in the wire protocol. Any Postgres, zero code changes.
Use case
Safe Postgres for autonomous workflows
Run autonomous agents against customer Postgres safely. Provision scoped per-tenant credentials in code, set query budgets and a per-credential kill-switch, and wire anomaly and budget webhooks into your incident pipeline. Any Postgres, zero code changes.
If you already know the shape and want the technique rather than the pitch, the guides start with the approach that needs no product, and compare covers the alternatives.