SafeSelect MCP

Agents can look.
They cannot mutate.

Read-only PostgreSQL & MongoDB access for coding agents.

Debug with real database context, without exposing write tools—even when your existing credentials allow writes. SafeSelect puts local, project-scoped policy between your agent and your data.

Get started → · Website · Compare approaches · DBeaver → Codex guide

Discover structure, inspect bounded rows, explain queries, and diagnose connectivity—without giving the agent write-capable tools or database credentials. Start with development data or a sanitized replica, then review the policy and effective database permissions before connecting to a more sensitive environment.

[!NOTE] SafeSelect is a safety boundary for agent access, not a replacement for database permissions. Use least-privilege database users when you can; SafeSelect still constrains overpowered credentials when agents connect through it.

Current backend support: PostgreSQL and MongoDB.

Where It Helps

• Debug an application against realistic data without exposing mutation tools.
• Let an agent inspect schemas, indexes, query plans, and bounded rows during development.
• Explore MongoDB collections through bounded reads and sampled schema inference.
• Reuse existing DBeaver, Docker Compose, or MongoDB Compass connections.
• Give coding agents database context while keeping policy, limits, secrets, and audit under your control.

Why SafeSelect?

SafeSelect is intentionally narrower than general-purpose database MCP servers. It is not a tool builder, SQL workbench, or remote database gateway. It is a local safety boundary for agents that need database visibility, not database power.

What Makes It Different?

The combination matters: PostgreSQL and MongoDB inspection, a fixed database read surface, local stdio, project policy, connection import and reproducible security evidence. Read-only modes and layered controls also exist in other projects; they are not exclusive to SafeSelect.

See the dated comparison for DBHub, MongoDB MCP Server, Postgres MCP Pro and SchemaBrain—including when each is a better fit.

Agents can look, but they cannot mutate through SafeSelect's database tools. This boundary does not cover a shell, another MCP server or direct credentials also available to the agent. Use least-privilege database users and review the threat model and limits.

Backend Support

Architecture

The agent talks to SafeSelect through MCP stdio. SafeSelect enforces policy in Rust, stores secrets outside project files, and reaches databases through an embedded Java sidecar: JDBC for SQL backends and the MongoDB driver for MongoDB. The Rust to Java channel is JSON-lines over stdin/stdout: no sockets, no open ports.

See it in action

Complete onboarding: from Homebrew to a protected agent

Install SafeSelect from Homebrew, import an SSH-backed DBeaver connection, keep the password in macOS Keychain, install the OpenCode integration, and see the agent read a paid order while its DELETE attempt is rejected. Focused agent and backend clips remain in the complete demo gallery.

Quick Start

Install SafeSelect with one of the following methods:

Prebuilt binaries (macOS & glibc Linux)

Download a platform-specific, prebuilt binary for macOS or glibc-based Linux from the latest GitHub release. The verified installer selects the matching macOS or glibc Linux architecture, checks the published SHA-256 digest, and installs to ~/.local/bin:

curl -fsSL https://raw.githubusercontent.com/antonillos/safeselect/main/packaging/install/install-release.sh | sh

Set PREFIX to choose another installation directory. SafeSelect still needs a Java 17+ runtime at execution time.

Homebrew (macOS)

brew install antonillos/tap/safeselect

asdf (macOS & Linux)

asdf plugin add safeselect https://github.com/antonillos/asdf-safeselect.git
asdf install safeselect latest
SAFESELECT_VERSION="$(asdf latest safeselect | sed -n '$p')"
asdf set -u safeselect "${SAFESELECT_VERSION}"
asdf reshim safeselect "${SAFESELECT_VERSION}"

After installing the binary, configure a project database and its MCP entry:

# Import a project database
safeselect import-dbeaver ~/Downloads/dbeaver-export.zip
# or:
# safeselect import-compose
# safeselect import-compass --path "$HOME/.config/MongoDB Compass"

# Verify the environment
safeselect check --environment testing

# Install the MCP entry. If this is the only environment, its name is inferred.
safeselect agent install opencode

# Verify exactly what was installed and where.
safeselect agent status

SafeSelect uses any available Java 17+ runtime rather than requiring a specific package-manager formula. If Java is missing or too old, install or select a Java 17+ runtime before running database commands. On macOS with Homebrew, you can install one with brew install openjdk@17.

The generated MCP name defaults to safeselect-<project>-<environment>.

The generated MCP entry is a stdio server scoped to one project and environment:

{
  "mcpServers": {
    "safeselect-myapp-testing": {
      "command": "safeselect",
      "args": ["serve", "--project", "/path/to/myapp", "--environment", "testing"]
    }
  }
}

SafeSelect uses each client's official MCP configuration contract, pins the absolute repository path, and defaults to user scope. Add --local for a project-scoped entry where the client supports it. See AI agent integration for exact paths, scopes, and manual configuration.

Guided MCP Context

Clients that support MCP prompts can invoke read_only_database_debugging for a safe investigation checklist. Clients can also read safeselect://guide/read-only-database-debugging for the same static workflow and boundary notes. Neither capability exposes database data, credentials, or write access; use the database tools below for discovery and bounded reads.

Agent Workflow

Agents should use SafeSelect in this order:

1. database_info
2. list_tables then describe_table; inspect list_table_indexes or bounded statistics when useful for SQL
3. list_databases, list_collections, then discover_document_schema for NoSQL
4. select / explain, or the bounded MongoDB read tool that matches the task
5. check, connect, or reconnect when connectivity is stale

Agents must discover relation or collection structure before querying unfamiliar data and use each discovery response's next_suggestion instead of guessing column or field names. SQL descriptions are catalog metadata; MongoDB schemas are inferred from a bounded, non-exhaustive sample.