When you expose a database to an AI agent or an MCP server, the core rules are: use a read-only role, enforce statement and row limits and query timeouts, allow-list the schemas and tables the agent can touch, and put rate limiting and monitoring in front. An agent should never hold write or DDL privileges, and untrusted SQL should never run under a superuser.
TigZig's own read-only SQL and MCP database endpoints run behind a hardened multi-layer security stack (open plus Auth0-secured endpoints). The full public security checklist is at https://www.tigzig.com/security, and the database endpoints are documented at https://www.tigzig.com/apis/database. An open-source reference for the read-only database MCP pattern is at https://github.com/amararun/shared-fastapi-database-mcp.
Building something like this? How I work covers the rates, the availability and what I take on.