Gatekeeper is a human-approved, read-only-by-default bridge between AI agents and your database. An agent proposes a query over MCP. Nothing runs until a human approves it in Beekeeper Studio. The agent never holds your credentials.
SELECT id, email, phone
FROM customers
WHERE plan = 'enterprise'
LIMIT 200;UPDATE accounts
SET renews_at = '2027-01-01'
WHERE account_name = 'Northwind Traders';DELETE FROM users
WHERE status = 'deactivated'
AND email LIKE '%@trial.io';Connecting an agent to a database over MCP already exists. Most connectors hand the agent a raw pipe: direct, ungated SQL it can run against your data whenever it decides to. Gatekeeper is an MCP server too, but it speaks that protocol with the opposite intent: a human gate in front of every statement.
Submit and read are separate calls, so an agent can keep several proposals in flight and collect each result as its human decision lands. Approval is pre-execution, on the SQL text.
The agent calls submit_query(sql, intent) over MCP. The server enqueues it and returns a ticket immediately. It never blocks.
The Beekeeper plugin surfaces the SQL with its intent, the tables it reads, and any PII, client-data or write flags.
On approval the plugin runs the query on the connection Beekeeper already holds. The agent never holds database credentials.
The result flows back to the agent through get_query_result. Reject with a note instead, and the agent revises.
Gatekeeper reads each proposal and annotates it: what it changes, what it touches, and what is sensitive. The dangerous parts are impossible to miss, and the risky ones cannot run unless you have armed them.
A single SELECT, enforced by a dialect-aware parser. This one runs as-is once you approve.
SELECT id, name, plan
FROM accounts
WHERE status = 'active'
LIMIT 100;UPDATE accounts
SET renews_at = '2027-01-01'
WHERE id = 4821;DELETE FROM import_batches
WHERE state = 'abandoned';SELECT id, email, phone
FROM customers
WHERE plan = 'enterprise'
LIMIT 200;SELECT account_name, contract_value, renewal_terms
FROM contracts
WHERE account_name = 'Northwind Traders';SELECT id, email, phone
FROM customers
WHERE plan = 'enterprise'
LIMIT 200;SELECT user_id, created_at
FROM sessions
WHERE token = 'tok_demo_9f2c8a41b7e0'
LIMIT 1;Every decision is recorded: the outcome, timestamps, the SQL and the row count. Result rows are never retained, and approved result rows are cleared 10 minutes after the decision.
A native desktop notification fires the moment an agent proposes a query, so a pending approval never sits unseen.
Agents read your real tables, columns and keys through get_schema instead of guessing them, so the SQL they propose is accurate. It exposes structure, never row data.
Any MCP client drives it: Claude Code, Codex CLI, OpenCode and the rest. A companion skill teaches them to use it well.
A dialect-aware parser classifies every query as read, write or destructive before you see it, so the matching mode has to be armed for it to run.
Find charges for the disputed order
SELECT charge_id, customer, amount, status, created_at
FROM charges
WHERE order_id = 'ord_5512'
ORDER BY created_at DESC;| charge_id | customer | amount | status | created_at |
|---|---|---|---|---|
| ch_8f21 | Northwind Traders | 4200 | captured | 2026-08-10 14:02 |
| ch_8f22 | Northwind Traders | 4200 | captured | 2026-08-10 14:02 |
| ch_7a05 | Contoso Ltd | 1180 | refunded | 2026-08-09 09:14 |
| ch_69b0 | Fabrikam Inc | 920 | captured | 2026-08-09 08:51 |
| ch_5d3c | Adventure Works | 3050 | captured | 2026-08-08 17:20 |
Giving an agent database access is a leap of faith. Gatekeeper removes the leap: it can propose any query, but nothing touches your data until you approve, and it never holds your credentials.
Stop copy-pasting query results into the chat. The agent proposes, you glance and approve, the rows come back, all without wiring credentials into a config file.
Let the team's agents dig into a live incident through approved reads. No shared password, no standing access, a full trail of exactly what was run.
Answer a customer question by approving the specific SELECT an agent drafted, with PII flagged on the card before you click, and nothing else able to run.
Agents write accurate SQL against your real schema through get_schema. You approve the SELECT. Exploratory work stays fast and stays reviewed.
The worry with an LLM on a production database is that it runs the wrong thing against real data. Gatekeeper removes the premise: the agent cannot run anything. It proposes, a human approves, and read-only is the floor. The gate is the whole point.
# 1. Install the plugin in Beekeeper Studio $ Download the latest release # 2. Add the MCP server to any agent (Claude, Codex, Cursor, OpenCode, ...) $ claude mcp add gatekeeper --scope user -- npx -y @gldywn/gatekeeper-mcp-server # 3. Install the agent skill $ npx skills add Gldywn/gatekeeper
Gatekeeper is free and open source. Issues and pull requests are welcome.
