SafeSelect MCP

CLI / VISUAL GUIDE

SafeSelect command gallery

A visual tour of the CLI, grouped by the job each command helps you finish.

Every image comes from the SafeSelect CLI or the disposable demo fixture. Use the command text below the image as the copyable version; the output is the part worth studying.

Import connections

import-dbeaver

Import a DBeaver export into .safeselect/.

safeselect import-dbeaver ~/Downloads/connections.zip

The importer keeps the connection shape while leaving passwords outside project files.

import-dbeaver: The importer keeps the connection shape while leaving passwords outside project files.View full size ↗

Import connections

import-compose

Discover PostgreSQL services from Docker Compose.

safeselect import-compose --path .

Compose discovery turns an existing local service into a project environment.

import-compose: Compose discovery turns an existing local service into a project environment.View full size ↗

Import connections

import-compass

Import MongoDB Compass connections.

safeselect import-compass --path ~/.config/MongoDB Compass

Compass imports preserve MongoDB connection details without exposing credentials.

import-compass: Compass imports preserve MongoDB connection details without exposing credentials.View full size ↗
3 captures · Select a command above

Prepare the project

config

Validate, inspect and maintain project configuration.

safeselect config show --project demo --environment postgres

Configuration show reports a safe, redacted policy summary before the server starts.

config: Configuration show reports a safe, redacted policy summary before the server starts.View full size ↗

Prepare the project

driver

Register and verify JDBC drivers.

safeselect driver list

The driver registry shows the vendor and local verified artifact.

driver: The driver registry shows the vendor and local verified artifact.View full size ↗

Prepare the project

agent

Detect clients and install their MCP entry.

safeselect agent detect

Detection lists available clients before an explicit project-scoped MCP install.

agent: Detection lists available clients before an explicit project-scoped MCP install.View full size ↗
3 captures · Select a command above

Verify and diagnose

check

Test configuration, secrets, tunnels, sidecar and backend connectivity.

safeselect check

Checks follow convention and inspect every environment unless one is selected deliberately.

check: Checks follow convention and inspect every environment unless one is selected deliberately.View full size ↗

Verify and diagnose

doctor

Print concise findings with stable diagnostic codes.

safeselect doctor

Doctor turns a failed connection into a short next action instead of a log wall.

doctor: Doctor turns a failed connection into a short next action instead of a log wall.View full size ↗

Verify and diagnose

posture

Inspect the effective PostgreSQL security posture.

safeselect posture --strict

Posture shows the effective read-only policy, limits and database posture before agent use.

posture: Posture shows the effective read-only policy, limits and database posture before agent use.View full size ↗
3 captures · Select a command above

Manage a connection

serve

Start the local MCP server for a project environment.

safeselect serve

The server speaks local stdio: the MCP initialize response exposes SafeSelect capabilities, not a network listener.

serve: The server speaks local stdio: the MCP initialize response exposes SafeSelect capabilities, not a network listener.View full size ↗

Manage a connection

connect

Test a temporary JDBC connection.

safeselect connect

Connect verifies the temporary JDBC sidecar against the live fixture without taking over an active MCP session.

connect: Connect verifies the temporary JDBC sidecar against the live fixture without taking over an active MCP session.View full size ↗

Manage a connection

disconnect

Close a temporary JDBC connection.

safeselect disconnect

Disconnect cleanly closes the temporary JDBC sidecar and reports the completed lifecycle step.

disconnect: Disconnect cleanly closes the temporary JDBC sidecar and reports the completed lifecycle step.View full size ↗

Manage a connection

reconnect

Restart the sidecar and verify connectivity.

safeselect reconnect

Reconnect restarts the sidecar and verifies the live fixture instead of hiding a stale database.

reconnect: Reconnect restarts the sidecar and verifies the live fixture instead of hiding a stale database.View full size ↗
4 captures · Select a command above

Explore SQL: discover, inspect and diagnose

list_tables

Discover PostgreSQL tables through MCP.

list_tables({"schema":"public"})

Real MCP response, formatted as a table: five synthetic relations in public. Discover exact names before inspecting columns.

list_tables: Real MCP response, formatted as a table: five synthetic relations in public. Discover exact names before inspecting columns.View full size ↗

Explore SQL: discover, inspect and diagnose

describe_table

Inspect column names, types and nullability through MCP.

describe_table({"schema":"public","table":"demo_orders"})

Real MCP response, formatted as a table: eight columns including UUID, JSONB and a timestamp range. No data rows are queried.

describe_table: Real MCP response, formatted as a table: eight columns including UUID, JSONB and a timestamp range. No data rows are queried.View full size ↗

Explore SQL: discover, inspect and diagnose

query

Execute one bounded read-only SQL statement and display its results.

safeselect query --sql "SELECT order_id, status, subtotal FROM public.demo_orders WHERE status = 'paid' LIMIT 3"

The bounded SQL request returns three synthetic fixture rows with row and byte counts; writes remain rejected.

query: The bounded SQL request returns three synthetic fixture rows with row and byte counts; writes remain rejected.View full size ↗

Explore SQL: discover, inspect and diagnose

get_maintenance_diagnostics

Inspect ANALYZE and VACUUM signals without running maintenance.

get_maintenance_diagnostics({"schema":"public"})

Real MCP response: a compact table containing only relations with an ANALYZE, VACUUM, or manual-review recommendation, plus summary counts. This read-only diagnostic never executes maintenance.

get_maintenance_diagnostics: Real MCP response: a compact table containing only relations with an ANALYZE, VACUUM, or manual-review recommendation, plus summary counts. This read-only diagnostic never executes maintenance.View full size ↗
4 captures · Select a command above

Explore NoSQL

list_databases

Discover MongoDB databases through MCP.

list_databases()

Real MCP response: the isolated demo exposes one allowed database. Choose it before discovering collections.

list_databases: Real MCP response: the isolated demo exposes one allowed database. Choose it before discovering collections.View full size ↗

Explore NoSQL

list_collections

Discover collections in an allowed MongoDB database.

list_collections({"database":"safeselect_demo"})

Real MCP response: four synthetic collections are listed without reading documents.

list_collections: Real MCP response: four synthetic collections are listed without reading documents.View full size ↗

Explore NoSQL

discover_document_schema

Infer frequent fields and types from a bounded MongoDB sample.

discover_document_schema({"database":"safeselect_demo","collection":"orders","sample_size":5})

Real MCP response: sampled fields and observed types guide the next bounded read; inference is explicitly non-exhaustive.

discover_document_schema: Real MCP response: sampled fields and observed types guide the next bounded read; inference is explicitly non-exhaustive.View full size ↗

Explore NoSQL

find_documents

Read bounded MongoDB documents with an explicit filter.

find_documents({"database":"safeselect_demo","collection":"orders","filter":{"status":"paid"},"limit":3})

Real MCP response: three paid orders, 994 bytes, returned in 7ms. The filter and limit keep the read bounded.

find_documents: Real MCP response: three paid orders, 994 bytes, returned in 7ms. The filter and limit keep the read bounded.View full size ↗
4 captures · Select a command above
Browse the complete command reference

imports

Import connections

Bring an existing DBeaver, Docker Compose or MongoDB Compass connection into the project.

import-dbeaver

Import a DBeaver export into .safeselect/.

Terminal capture for safeselect import-dbeaver <zip>
The importer keeps the connection shape while leaving passwords outside project files.

safeselect import-dbeaver ~/Downloads/connections.zip

import-compose

Discover PostgreSQL services from Docker Compose.

Terminal capture for safeselect import-compose [--path <path>]
Compose discovery turns an existing local service into a project environment.

safeselect import-compose --path .

import-compass

Import MongoDB Compass connections.

Terminal capture for safeselect import-compass [--path <path>]
Compass imports preserve MongoDB connection details without exposing credentials.

safeselect import-compass --path ~/.config/MongoDB Compass

prepare

Prepare the project

Validate local policy, install drivers and connect an AI client without repeating configuration flags.

config

Validate, inspect and maintain project configuration.

Terminal capture for safeselect config <COMMAND>
Configuration show reports a safe, redacted policy summary before the server starts.

safeselect config show --project demo --environment postgres

driver

Register and verify JDBC drivers.

Terminal capture for safeselect driver <COMMAND>
The driver registry shows the vendor and local verified artifact.

safeselect driver list

agent

Detect clients and install their MCP entry.

Terminal capture for safeselect agent <COMMAND>
Detection lists available clients before an explicit project-scoped MCP install.

safeselect agent detect

diagnose

Verify and diagnose

Check the complete path from project policy to the database, then inspect the effective PostgreSQL posture.

check

Test configuration, secrets, tunnels, sidecar and backend connectivity.

Terminal capture for safeselect check [--environment <env>]
Checks follow convention and inspect every environment unless one is selected deliberately.

safeselect check

doctor

Print concise findings with stable diagnostic codes.

Terminal capture for safeselect doctor [--environment <env>]
Doctor turns a failed connection into a short next action instead of a log wall.

safeselect doctor

posture

Inspect the effective PostgreSQL security posture.

Terminal capture for safeselect posture [--environment <env>]
Posture shows the effective read-only policy, limits and database posture before agent use.

safeselect posture --strict

connection

Manage a connection

Start the local MCP server or exercise the temporary connection lifecycle directly.

serve

Start the local MCP server for a project environment.

Terminal capture for safeselect serve [--environment <env>]
The server speaks local stdio: the MCP initialize response exposes SafeSelect capabilities, not a network listener.

safeselect serve

connect

Test a temporary JDBC connection.

Terminal capture for safeselect connect [--environment <env>]
Connect verifies the temporary JDBC sidecar against the live fixture without taking over an active MCP session.

safeselect connect

disconnect

Close a temporary JDBC connection.

Terminal capture for safeselect disconnect [--environment <env>]
Disconnect cleanly closes the temporary JDBC sidecar and reports the completed lifecycle step.

safeselect disconnect

reconnect

Restart the sidecar and verify connectivity.

Terminal capture for safeselect reconnect [--environment <env>]
Reconnect restarts the sidecar and verifies the live fixture instead of hiding a stale database.

safeselect reconnect

query

Explore SQL: discover, inspect and diagnose

Discover tables and columns through MCP, run bounded SQL separately, and inspect read-only maintenance evidence.

list_tables

Discover PostgreSQL tables through MCP.

Terminal capture for MCP · list_tables
Real MCP response, formatted as a table: five synthetic relations in public. Discover exact names before inspecting columns.

list_tables({"schema":"public"})

describe_table

Inspect column names, types and nullability through MCP.

Terminal capture for MCP · describe_table
Real MCP response, formatted as a table: eight columns including UUID, JSONB and a timestamp range. No data rows are queried.

describe_table({"schema":"public","table":"demo_orders"})

query

Execute one bounded read-only SQL statement and display its results.

Terminal capture for safeselect query --sql <SQL>
The bounded SQL request returns three synthetic fixture rows with row and byte counts; writes remain rejected.

safeselect query --sql "SELECT order_id, status, subtotal FROM public.demo_orders WHERE status = 'paid' LIMIT 3"

get_maintenance_diagnostics

Inspect ANALYZE and VACUUM signals without running maintenance.

Terminal capture for MCP · get_maintenance_diagnostics
Real MCP response: a compact table containing only relations with an ANALYZE, VACUUM, or manual-review recommendation, plus summary counts. This read-only diagnostic never executes maintenance.

get_maintenance_diagnostics({"schema":"public"})

nosql

Explore NoSQL

Follow MongoDB discovery from databases to bounded documents, with sampled schema inference before reads.

list_databases

Discover MongoDB databases through MCP.

Terminal capture for MCP · list_databases
Real MCP response: the isolated demo exposes one allowed database. Choose it before discovering collections.

list_databases()

list_collections

Discover collections in an allowed MongoDB database.

Terminal capture for MCP · list_collections
Real MCP response: four synthetic collections are listed without reading documents.

list_collections({"database":"safeselect_demo"})

discover_document_schema

Infer frequent fields and types from a bounded MongoDB sample.

Terminal capture for MCP · discover_document_schema
Real MCP response: sampled fields and observed types guide the next bounded read; inference is explicitly non-exhaustive.

discover_document_schema({"database":"safeselect_demo","collection":"orders","sample_size":5})

find_documents

Read bounded MongoDB documents with an explicit filter.

Terminal capture for MCP · find_documents
Real MCP response: three paid orders, 994 bytes, returned in 7ms. The filter and limit keep the read bounded.

find_documents({"database":"safeselect_demo","collection":"orders","filter":{"status":"paid"},"limit":3})

Need the complete contract? Read the CLI source or return to the SafeSelect overview.