LogCarverGuard MCP server

LogCarverGuard

English | 繁體中文

An MCP proxy that lets an AI coding agent (Claude Code, Cursor, …) read and write a production SQL Server without handing it the real credentials or a free hand. Every statement runs under the caller's own SQL login and grants, dangerous statements are blocked before they reach the database, and everything is written to an audit log.

Status: early (v0.1).

What it does

AI agent --(MCP, API key)--> LogCarverGuard proxy --(EXECUTE AS the caller's own login)--> SQL Server

• One tool, executesql.** Reads and writes go through it. A SELECT returns its rows (first 100 shown, with a count of the rest). A write is executed and audited.
• A real T-SQL parser decides what is allowed, not keyword matching, so a fake keyword inside a comment or string does nothing.
• The AI never sees the database password. The proxy holds one service login. Each person gets an API key that maps to their own SQL login, and the proxy impersonates it, so their existing GRANT/DENY still decide what they can do.
• The service login does not need sysadmin. It needs IMPERSONATE on each user's login, and a database user in the target database so it can connect. The host tests run SELECT, UPDATE and a permission-denied DELETE through a service account that is not sysadmin.
• Data changes run in a transaction the proxy controls. A batch containing INSERT / UPDATE / DELETE is rolled back as a whole if any statement fails. DDL (ALTER TABLE…), TRUNCATE and EXEC run as they are and are not rolled back as part of a batch. BEGIN TRAN / COMMIT / ROLLBACK from the caller is blocked.
• Audit log in a local SQLite file: who, when, which SQL, and whether it was blocked or executed. Executed statements are recorded after they commit. A statement that SQL Server rejects (for example permission denied) or a request with a bad key is not recorded.

Always blocked

DROP TABLE, DROP DATABASE, RESTORE DATABASE / RESTORE LOG, ALTER DATABASE … SET, spexecutesql, xpcmdshell, dynamic EXEC of a variable or string, identity switching (REVERT, EXECUTE AS, SETUSER), permission changes (GRANT, DENY, REVOKE), and caller-managed transactions (BEGIN TRAN, COMMIT, ROLLBACK, SAVE TRANSACTION).

Blocked unless the admin allow-lists it

TRUNCATE TABLE, ALTER TABLE … DROP COLUMN, and EXEC of a named stored procedure (including INSERT … EXEC). Allow-list entries are written as schema.name; a statement that names a database or a server (OtherDb.dbo.T, [srv].db.dbo.P) is never matched against them.

This list is deliberately narrow. It is not "everything an AI could break": DROP INDEX, sprename, BACKUP DATABASE, or a Linked Server OPENQUERY are not specially handled and run if the real login may run them. The real security boundary is the SQL login's own grants, so issue each API key against an account with the least privilege you can accept, never sysadmin or dbowner.

Local mode

Runs on your own machine, started by your AI tool over stdio. No server, no Docker, no API keys. Settings come only from environment variables (not from appsettings.json or the command line). Tested on Windows with integrated authentication.

dotnet tool install -g LogCarverGuard.Local
claude mcp add logcarverguard --env LOGCARVERGUARD_CONNECTION_STRING="Server=localhost;Database=MyDb;Integrated Security=true;TrustServerCertificate=true" -- logcarverguard

Or run it without installing, through dnx (end the command with -- dotnet dnx LogCarverGuard.Local --yes).

Shortened. The full README is on GitHub.