Midplane MCP server

Midplane

Postgres MCP server for AI agents. Connect the tables you've been keeping off-limits. PII masked at the source, policy enforced on the SQL AST, writes held for human approval, everything audited. MIT, self-hostable.

Midplane sits in the query path between an AI agent (Claude, Cursor, any MCP client) and your Postgres database. Every statement is parsed into a real Postgres AST — not matched against a regex blocklist — checked against a declarative per-table policy, rewritten so masked columns never leave the database in the clear, and recorded in an event-sourced audit log before it executes.

📖 Full documentation lives at midplane.ai/docs —

agent setup, the policy reference, self-hosting, deployment, and the threat model.

This README is just the orientation.

Why this exists

AI coding agents are being plugged into production Postgres without an audit trail or a safety layer. The deprecated Anthropic reference Postgres MCP shipped a stacked-statement injection vector (Datadog Security Labs, 2025); the common service-role setup hands an agent a connection that can read and write every table. So the tables that would make an agent genuinely useful — customers, orders, subscriptions — stay off-limits, because "a read-only role and good intentions" isn't a control anyone can show a security reviewer. Midplane is that control.

What it does

the query's source relation, so the raw value never leaves Postgres — masking applies inside joins, filters, and aggregates rather than being scrubbed out of the rows on the way back. Transforms range from full-redact and null-out to consistent-hash (deterministic, salted, so masked join keys still join), partial, generalize, pseudonymize, and noise. It fails closed: anything the engine can't prove is masked — an unvetted function that could read the table behind the parser's back, a result column whose provenance doesn't map to a known base column — denies the query rather than risk an unmasked value.

• PII masked at the source. Declare a column masked and the engine rewrites

— Postgres's own parser — and checked against a per-table policy of deny / read / read_write, plus optional tenant scoping and categorical write guardrails. The walk is recursive, so a write buried in a CTE, subquery, or UNION arm is caught at the write, not at the outer SELECT.

• Policy enforced on the SQL AST. Every statement is parsed by libpg_query

engine pauses the statement after the policy has allowed it and asks a human. The agent gets a check_approval tool and re-runs when the answer lands; a denial carries the reviewer's note back, so "use the refunds table instead" reaches the agent. Approvals sit under the policy, never over it — nothing the policy denied can be approved into running.

• Writes held for human approval. Opt a write class into approvals and the

agent, which token, the statement, the decision and its reason, and which columns were masked. Local SQLite for the standalone engine; a queryable, exportable audit log in the app.

• Everything audited. An event-sourced log written before execution: which

What it blocks

Out of the box, before you configure anything:

Shortened. The full README is on GitHub.