# PgBeam

> Safe Postgres access for AI agents and humans. A scoped connection string and a hosted MCP endpoint with read-only enforcement, table allowlists, row-level policies, PII masking, query budgets, a kill-switch, a full audit trail, SCRAM auth, anomaly detection, webhook and SIEM audit export, instant branches with always-rollback dry-run, and safe-migration linting. Works with any Postgres, with zero code changes.

Canonical URL: https://pgbeam.com/llms.txt. Last updated: 2026-09-13T21:28:27.983Z.

This is a navigation index. It carries the judgement an agent needs before it commits to PgBeam (what the product is, which jobs it fits, which jobs it does not, and the published enforcement limits) and links out to everything else.

Three ways to read any page on this site as Markdown rather than HTML:

- Append `.md` to the URL: `https://pgbeam.com/pricing.md`, `https://pgbeam.com/docs/masking.md`.
- Send `Accept: text/markdown`.
- Append `?mode=agent` to the URL, when you cannot set request headers.

Every Markdown document opens with a YAML frontmatter block carrying its `title`, `description`, `canonical` URL and `last-updated` date. The `llms.txt` files are the exception: that format specifies an H1 as its first element, so they carry the same facts in the heading, the summary blockquote and the line under it.

## When to use PgBeam

The moment PgBeam is for is the one where something you do not fully trust is about to be handed a Postgres connection string. These are the jobs it is built for:

- **Giving a coding agent access to a real database.** Claude Code, Cursor, or an in-house agent needs to read production or staging Postgres, and the alternative is pasting a DSN that can also write and drop. Issue a scoped credential instead: read-only by default, table allowlists, a per-credential query budget, and a kill-switch that does not require rotating a database role. https://pgbeam.com/for/claude-cursor-database-access
- **Shipping an agent or MCP tool over a database you do not own.** Your product runs against your users' Postgres and you would rather not hold their raw credentials. Back it with the hosted per-project MCP endpoint so the guardrails, not your code, are the boundary. https://pgbeam.com/for/mcp-postgres-server
- **Running a natural-language-to-SQL or chat-with-your-data feature.** The model writes the SQL, so the query text is untrusted by construction. Read-only enforcement, max-rows, statement timeouts, and masking bound what a bad generation can do. https://pgbeam.com/for/ai-analytics-agents
- **Keeping customer PII out of the model context.** Columns matched by `schema.table.column` are redacted, nulled, or hashed inside the proxy, so the raw value never reaches the agent, the model provider, or your own logs. https://pgbeam.com/for/pii-masking-for-llm-database-access
- **Isolating tenants on a shared multi-tenant database.** Row-level filters are appended to the agent's query on the wire, so a support or workflow agent working one customer's ticket cannot read another customer's rows. https://pgbeam.com/for/support-copilots
- **Running fleets of autonomous agents against customer databases.** Per-tenant credentials, query and egress budgets, anomaly detection, and revocation of one credential without touching the others. https://pgbeam.com/for/autonomous-workflows
- **Letting an agent write, carefully.** Approval queues for statements a human has to sign off on, always-rollback sandbox branches for dry runs, shadow writes, and migration linting that refuses a lock-taking DDL.
- **Answering "what did the agent actually run".** Every statement is recorded with its decision, reason, rows, bytes, latency, region and credential in a hash-chained audit log, exportable to Splunk HEC, Datadog, Elastic, or an HMAC-signed webhook. This is usually the thing that unblocks a security reviewer.
- **Enforcing where your database host cannot.** Enforcement lives in the Postgres wire protocol, so the same policy applies on RDS, Aurora, Supabase, Neon or self-hosted, with no extension, no migration, and no application code change.

For the whole product in one document, read the launch post: https://pgbeam.com/blog/launching-pgbeam.md. For an agent that has decided to use PgBeam, the operating instructions (which front door to pick, how to authenticate, which tool to call first) are at https://pgbeam.com/AGENTS.md, and the step-by-step setup is at https://pgbeam.com/skill.md.

## When not to use PgBeam

Saying this plainly is cheaper for everyone than a failed evaluation:

- **You only want a connection pooler.** With no agent and no untrusted client, the guardrails are the entire product and the extra hop buys you little. PgBouncer, PgCat, or your host's own pooler is the better answer.
- **Your database is not Postgres.** Enforcement is written against the Postgres wire protocol. MySQL, MongoDB, and warehouses that do not speak Postgres wire are out of scope.
- **You need the whole stack inside your own environment.** The data plane can run in your VPC on the Scale plan, but the control plane, policy engine and dashboard stay hosted by PgBeam. A fully air-gapped deployment is not served today.
- **You need a compliance certificate in hand.** Masking, a tamper-evident hash-chained audit log, SSO and SCIM, and per-organization data residency are shipped and real. SOC 2 Type II and HIPAA certifications are not.
- **Your database host's own agent controls already cover you.** PgBeam's advantage is that it works on any Postgres. If everything you have lives on one host whose built-in read-only and masking suffice, you do not need PgBeam yet.

## Limits to know before building on it

These are published rather than left to be discovered:

- Table allowlists and row filters cannot see through views. Allowlist views explicitly, and never allowlist a view over a row-filtered table.
- Column-level restriction is done with masking. There is no separate column allowlist.
- `SET search_path` is refused for agent credentials, because it would let a query step around a relation allowlist.
- Binary-format result columns mask to NULL. Text-format columns get a redaction token.
- Query budgets are counted per region, so they are a close approximation rather than a globally coordinated counter.
- Approval holds apply on the simple-query path. A covered statement sent over the extended (prepared-statement) protocol fails closed and asks to be resubmitted as a simple query, rather than committing unreviewed.

## For AI agents

PgBeam is itself an MCP product. If you are an AI agent, these are the doors in:

- [Hosted MCP endpoint](https://pgbeam.com/docs/mcp): `https://{project}.proxy.pgbeam.app/mcp`, streamable HTTP, bearer auth (`Authorization: Bearer pba_…`). Ten tools: briefing, query, validate_sql, list_tables, describe_table, explain, schema_catalog and my_permissions, each policy-enforced and audited, plus search_docs and read_doc for the PgBeam docs themselves.
- [Agent instructions](https://pgbeam.com/AGENTS.md): you have decided to use PgBeam: which front door to pick, how to authenticate, which tool to call first.
- [Agent quickstart skill](https://pgbeam.com/skill.md): install the CLI, authenticate, link a project, connect. Written for a coding agent to follow on its own.
- [Agent authentication guide](https://pgbeam.com/auth.md): provision a scoped agent credential (the `pba_` MCP token and a SCRAM Postgres login), rotate it, and use the kill-switch.
- [MCP server card](https://pgbeam.com/.well-known/mcp/server-card.json): tools, transport and auth, as JSON.
- [Full corpus](https://pgbeam.com/llms-full.txt): every documentation page as one plain-text document. Large by design; use a section index below if you want one area.

## Section indexes

A scoped `llms.txt` per product area, each generated from that area's own pages. Fetch one instead of the full corpus when you only need one area:

- [Documentation index](https://pgbeam.com/docs/llms.txt): every concept and how-to page, with the four reference trees linked below.
- [REST API index](https://pgbeam.com/api/llms.txt): every control-plane endpoint reference, plus the OpenAPI 3.1 spec and the management MCP.
- [CLI index](https://pgbeam.com/docs/cli/llms.txt): every `pgbeam` command reference.
- [TypeScript SDK index](https://pgbeam.com/docs/ts-sdk/llms.txt): every method of the TypeScript client.
- [Go SDK index](https://pgbeam.com/docs/go-sdk/llms.txt): every method of the Go client.
- [Blog index](https://pgbeam.com/blog/llms.txt): engineering posts on agent safety, wire-level enforcement, pooling and caching.
- [Guides index](https://pgbeam.com/guides/llms.txt): answer-shaped how-tos, each starting with the approach that needs no product.

## Start here in the docs

The pages that answer most questions. The complete list of every documentation page is at https://pgbeam.com/docs/llms.txt

- [Getting Started](https://pgbeam.com/docs): Give an AI agent safe, scoped, audited access to your Postgres. Enforcement is in the wire protocol, so it works with any Postgres and no code changes.
- [How It Works](https://pgbeam.com/docs/how-it-works): How PgBeam enforces agent policy in the PostgreSQL wire protocol, between an AI agent and your database, with no code changes and any Postgres host.
- [Quickstart](https://pgbeam.com/docs/quickstart): Connect an AI agent to your Postgres safely in two minutes. Issue a scoped credential, attach a read-only policy, and watch the audit log.
- [Agent Credentials](https://pgbeam.com/docs/agent-credentials): Scoped, revocable Postgres credentials and MCP tokens for AI agents. The agent never sees your real database credentials.
- [Hosted MCP server](https://pgbeam.com/docs/mcp): A hosted MCP endpoint that gives AI agents policy-enforced database tools. Paste one URL into Claude Code, Cursor, or any MCP client. No server to run.
- [Connection String](https://pgbeam.com/docs/connection-string): Give an AI agent a scoped Postgres connection string. Every driver, ORM, and agent framework works unchanged, with policy enforced in the wire protocol.
- [Policies](https://pgbeam.com/docs/policies): A policy profile is the named bundle of rules PgBeam enforces for an agent credential. Access mode, allowlists, masking, budgets, and timeouts.
- [Read-only Enforcement](https://pgbeam.com/docs/read-only): Block every write and DDL statement for an agent credential. Reads pass, writes are rejected in the wire protocol before they reach your database.
- [Table Allowlists](https://pgbeam.com/docs/allowlists): Allow the exact schemas and tables an agent may touch. Anything off the list is blocked in the wire protocol.
- [Row-level Policies](https://pgbeam.com/docs/row-level-policies): Scope a credential to a slice of a table with a WHERE predicate. PgBeam appends the filter to every statement so an agent or analyst only ever sees its own rows.
- [PII Masking](https://pgbeam.com/docs/masking): Redact, null, or hash sensitive columns in agent results. Applied in flight, so your app sees real values and the agent never does.
- [Query Budgets](https://pgbeam.com/docs/budgets): Cap queries per window and rows per result for an agent credential. Runaway loops and full-table scans hit a ceiling instead of your database.
- [Kill-switch](https://pgbeam.com/docs/kill-switch): Stop one agent or every agent on a project instantly. The next statement is refused, with no credential rotation.
- [Human-in-the-Loop Approvals](https://pgbeam.com/docs/approvals): Hold an agent's writes and DDL until a human approves them. Approve or reject in the dashboard, set auto-approve rules for safe changes, and auto-expire stale requests.
- [Sandbox Writes](https://pgbeam.com/docs/sandbox-writes): Let an agent write freely against an instant, isolated branch of your database, or run every write in always-rollback dry-run mode. Production is never touched.
- [Safe Migrations](https://pgbeam.com/docs/safe-migrations): PgBeam lints DDL for the changes that lock tables or lose data. Table rewrites, ACCESS EXCLUSIVE locks, missing CONCURRENTLY, unsafe drops and type changes, NOT NULL without a default. Warn or block.
- [SCRAM-SHA-256 Auth](https://pgbeam.com/docs/scram-auth): Authenticate credentials with SCRAM-SHA-256 so the password never crosses the wire. Cleartext-over-TLS stays available as a fallback for clients that need it.
- [Audit Log](https://pgbeam.com/docs/audit-log): Every statement an agent runs, allowed or blocked, recorded with its decision, reason, rows, bytes, latency, and credential.
- [Audit Export](https://pgbeam.com/docs/audit-export): Stream audit events to your own systems. HMAC-signed webhooks for any endpoint, plus native formats for Splunk HEC, Datadog, and Elastic.
- [Anomaly Detection](https://pgbeam.com/docs/anomaly-detection): PgBeam learns each credential's normal behavior and alerts when it drifts. Volume spikes, off-hours access, new query shapes, and error or egress spikes.
- [Error Codes](https://pgbeam.com/docs/error-codes): SQLSTATE error codes returned by PgBeam, what causes them, and how to resolve each one.
- [Troubleshooting](https://pgbeam.com/docs/troubleshooting): Common PgBeam failures, what they usually mean, and step-by-step instructions to diagnose and fix them.
- [Plans and Limits](https://pgbeam.com/docs/plans): Plan tiers, feature comparison, per-plan quotas, overage billing, rate limits, and default settings.

## Developer resources

- [REST API reference](https://pgbeam.com/docs/api): control-plane endpoints for projects, databases, policies, agents, analytics and platform state.
- [OpenAPI 3.1 spec](https://pgbeam.com/openapi.json): the machine-readable description of that API, also reachable as the management MCP at https://api.pgbeam.com/v1/mcp
- [CLI](https://pgbeam.com/docs/cli): install with `curl -fsSL https://pgbeam.com/install | sh` (PowerShell: `irm https://pgbeam.com/install/windows | iex`), or `npm install -g @pgbeam/cli`, or `brew install sferarc/pgbeam/pgbeam`.
- [TypeScript SDK](https://pgbeam.com/docs/ts-sdk)
- [Go SDK](https://pgbeam.com/docs/go-sdk)
- [API catalog](https://pgbeam.com/.well-known/api-catalog): every spec and discovery document we publish, in one place.

## Key pages

- [Features](https://pgbeam.com/features): every PgBeam control for safe Postgres access, with the agent angle and the human angle for each.
- [Pricing](https://pgbeam.com/pricing): plans and limits.
- [Benchmark](https://pgbeam.com/benchmark): live latency measurements from 20 global regions.
- [About](https://pgbeam.com/about): what PgBeam is, who it is for, the principles behind wire-level enforcement, where it runs, and what it does not claim.
- [Security](https://pgbeam.com/security): credentials, least privilege, masking, audit and transport.
- [Contact](https://pgbeam.com/contact): support, sales, security, privacy and legal addresses, and what each one is for.