SafeSelect Inspect, don’t administer.
Discover schemas and collections, inspect bounded results and explain queries. No database write or migration tools.
Database context. Not database control.
Agents can look.
They cannot mutate.
Read-only PostgreSQL & MongoDB access for coding agents.
Debug with real database context, without exposing write tools. SafeSelect MCP puts local, project-scoped policy between your agent and your data.
Open source · Local MCP stdio · macOS & Linux · Java 17+
01 / REQUESTYour coding agentCodex · Claude Code · Cursor · OpenCode
02 / ENFORCESafeSelect MCPPolicy · bounded reads · audit
03 / INSPECTYour databasePostgreSQL · MongoDB
The boundary covers requests through SafeSelect. Use least-privilege database roles and keep direct credentials and alternative write tools away from the agent.
FROM CONNECTION TO CONTEXT
Bring the connection
you already use.
Import from DBeaver, Docker Compose or MongoDB Compass. Check the environment, then install a project-scoped MCP entry.
Follow DBeaver → Codex →Run from your application repository. Start with a development database or sanitized replica. Other installation options.
brew install antonillos/tap/safeselect
safeselect import-dbeaver ~/Downloads/connections.dbp
# Choose staging during import, or use your environment name.
safeselect check --environment staging
safeselect agent install codex --environment staging --local
safeselect agent statusReview imports and policy yourself. Never paste an export or database password into the agent chat.
NARROW BY DESIGN
Visibility without a write surface.
Policy stays local.
Use MCP over stdio, with no MCP network listener. Scope access by project and environment, with row, byte and time limits.
Check the evidence.
Security violations terminate the process. Read the threat model and reproducible tests—including what they do not guarantee.
THE WHOLE ONBOARDING, NOT A MOCKUP
See the first connection.
The recorded walkthrough uses Homebrew, a DBeaver SSH connection, macOS Keychain and OpenCode. It shows a successful read and a rejected write against disposable demo data.
Watch the complete onboarding · animated recording, 6.8 MB
Prefer text? Use the step-by-step Codex guide. The recording uses OpenCode; the guide explains Codex setup separately.
CHOOSE THE RIGHT TOOL
Read-only is a starting point.
A comparison, not a ranking.
DBHub, MongoDB MCP, Postgres MCP Pro and SchemaBrain solve different problems. Compare their documented contracts and tradeoffs.
Compare approaches →Read-only is not a boolean.
Tools, execution controls, sensitive reads, resource limits and failure behavior are separate questions.
Read the checklist →Evidence you can reproduce.
Inspect the adversarial suite and its disposable-fixture contract. A green badge is not a universal security guarantee.
Explore the tests →DELIBERATE LIMITS
Know where it stops.
Does it replace database permissions?
No. Use least-privilege roles. SafeSelect constrains its own tool surface, not other connections, shell access or a compromised host.
Does read-only mean no data exposure?
No. The agent can see authorized results. Choose permitted schemas and collections carefully; use sanitized data when appropriate.
Is this a remote database gateway?
No. MCP runs locally over stdio. PostgreSQL and MongoDB are the supported backends. The embedded Java sidecar requires Java 17+.
BUILD TRUST WITH EVIDENCE
A boundary you can inspect.
Start with the documented guarantees, limits and disposable security fixtures—not a claim that any database connection is risk-free.
Read the Security Proof →Compare approaches →