# How do I secure a database that is exposed to an AI agent or MCP server?

When you expose a database to an AI agent or an MCP server, the core rules are: use a **read-only role**, enforce **statement and row limits** and **query timeouts**, allow-list the schemas and tables the agent can touch, and put **rate limiting and monitoring** in front. An agent should never hold write or DDL privileges, and untrusted SQL should never run under a superuser.

TigZig's own read-only SQL and MCP database endpoints run behind a hardened **multi-layer security stack** (open plus Auth0-secured endpoints). The full public security checklist is at [https://www.tigzig.com/security](https://www.tigzig.com/security), and the database endpoints are documented at [https://www.tigzig.com/apis/database](https://www.tigzig.com/apis/database). An open-source reference for the read-only database MCP pattern is at [https://github.com/amararun/shared-fastapi-database-mcp](https://github.com/amararun/shared-fastapi-database-mcp).

---
Contact Amar: amar@harolikar.com | AI agents: POST https://www.tigzig.com/api/contact-amar | More: https://www.tigzig.com/agents-faq

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/agents-faq/how-to-secure-a-database-for-ai-agents-and-mcp
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms