---
title: "PgBeam guides"
description: "How to give an AI agent access to a real database without regretting it. Each guide leads with the approach that needs no product, then states what that approach does not cover."
canonical: "https://pgbeam.com/guides"
last-updated: "2026-09-07T00:00:00.000Z"
---

# Guides

> How to give an AI agent access to a real database without regretting it. Each guide leads with the approach that needs no product, with the SQL, then states what that approach does not cover.

- [The read-only escape in @modelcontextprotocol/server-postgres](https://pgbeam.com/guides/server-postgres-mcp-sql-injection.md) (updated 2026-09-07): The archived reference Postgres MCP server can be escaped out of its read-only transaction with one semicolon. The reproduction, what a read-only role does and does not stop, and what to run instead.
- [Migrating off @modelcontextprotocol/server-postgres](https://pgbeam.com/guides/migrate-off-server-postgres-mcp.md) (updated 2026-09-07): The archived reference Postgres MCP server has a read-only escape and no maintainer. Which replacement to pick, the config for each, and why rotating the credential matters more than the swap.
- [How to give Claude Code read-only access to a production database](https://pgbeam.com/guides/claude-code-read-only-postgres.md) (updated 2026-09-03): Create a Postgres role that only holds SELECT, point Claude Code at it, and prove it holds. The full SQL, the MCP config, and the four things a read-only role still does not cover.
- [How to mask PII before it reaches an LLM](https://pgbeam.com/guides/mask-pii-before-it-reaches-an-llm.md) (updated 2026-09-03): Mask at the database boundary, not in the prompt. The full SQL for a Postgres masking view, the grants people get wrong, and the hash-equality oracle that defeats it, demonstrated.
- [How to audit what an agent ran against your database](https://pgbeam.com/guides/audit-what-an-agent-ran-against-your-database.md) (updated 2026-09-03): Turn on statement logging, give the agent its own role, and read the log. The exact config, real log output, and the four questions a Postgres log cannot answer about an agent.