Stop giving AI agents raw database connection strings.
Give them SchemaBrain instead — a read-only trust and intelligence layer where the agent never writes SQL, PII is refused before the query runs, and every call lands in a tamper-evident audit log.
Works with Claude Desktop · Claude Code · Cursor · Windsurf · any MCP host
SchemaBrain compiles every query from definitions you control — no path from a prompt to raw SQL at your database.
Three guarantees that close the trust gap between AI agents and your database:
- Read-only by architecture — twelve MCP tools, none of which can write. No
execute()tool, noquery()tool, no path from agent prompt to a write at your database. - PII-aware refusal at retrieval — PII tags propagate from the physical schema through joins and metrics. If a query touches a blocked category, SchemaBrain refuses before the database is queried.
- Cryptographic audit chain — every call, refusal, and recovery is recorded in a SHA256-hashed append-only log (best-effort: a disk-full or no-writer configuration logs a warning and continues rather than failing the query).
audit verifyexits non-zero if any past row was rewritten.
