Security

Nothing is opened inbound. The agent runs inside your network and dials out to the service.

Your credentials stay on the agent. A connection string goes to the machine's keyring; the agent writes down only the host, port, database and user. The service holds names, versions, tiers, your policy and your databases' map (the names, types, keys and comments of their tables and columns), never a credential and never a row, and refuses a request that could carry either.

Results are never kept by the service. With the agent's MCP server, a tool's result goes from the agent to the AI client on the same machine and nowhere else; the service receives the licence check and the policy pull. Through the workspace's gateway (/mcp), the result is masked and fenced on the agent first, then passes through the service to your AI client, and is not stored: the workspace's audit keeps who asked, what, and how it was decided, with the arguments masked. Three walls keep a database unchanged. The agent refuses a database role that can write: before it keeps a connection it proves the role holds no INSERT, UPDATE, DELETE or CREATE. Every statement passes the agent's SQL guard, which runs one SELECT and nothing else (no stacked statement, no function that sleeps or reaches files, no table of the server's credentials) and caps it at 500 rows. And every statement runs inside a read-only transaction with a time limit. Personal values in a result are masked on the agent by their column's tag, and by their shape anywhere (an email, a national id, a card number), before your AI client sees them, unless your role may see them on that tier.

Every call is your role's decision, made on the agent with a policy the service signs and the agent verifies, and a row in the agent's own audit. A call through the gateway is decided at the gateway first and again on the agent, with your role bounded by the role of the member who paired the agent.

The agent is open to inspection. It is a compiled program that unpacks; nothing in it pretends to be a secret. It checks its licence once a day and holds the last good answer for seven days offline; after that it runs no tools and says why.