Ask your production database anything. Break nothing.
Midplane sits between your AI assistant and your Postgres database. It blocks dangerous queries, hides sensitive fields, and keeps your data in your network.
Works with Claude, ChatGPT, Cursor, VS Code and any MCP client.
UPDATE accounts SET plan = 'free';Midplane blocked that because it had no filter. I'll limit it to trials that have ended.
… WHERE trial_ends_at < now() AND plan = 'trial';The change is waiting for your approval. Once you approve, 312 accounts move to the free plan.
Your AI is fast and confident. Midplane checks every query before it reaches your database.
UPDATE accounts SET plan = 'free';The full list
- Mass changes
- Updates or deletes without a WHERE clause, or with one that would still touch every row. Midplane stops them before they run.
- Dropped tables
- Dropped tables and other schema changes. Your AI can’t restructure your database by accident.
- Hidden writes
- Changes hidden inside a query that looks like a read. Midplane reads the whole statement, so a delete tucked inside a SELECT is caught.
- Sensitive fields
- Hidden fields stay hidden, even when your AI filters or sorts by them. It can’t work out an email or an SSN one question at a time.
- Prompt injection
- Instructions planted in your data, like a support ticket telling your AI to fetch your API keys. Text your AI reads can’t give it orders.
Midplane runs next to your database, on your laptop or in your own cloud, with no open ports.
Your network
Your AI vendor
Midplane's cloud
What it lets you do
Only engineers who know SQL can answer “how many trials converted last week?”
Your whole team can ask production questions, not just the engineers who know SQL.
Your AI stays read-only, because one bad write costs too much.
Your AI can make changes, because risky ones wait for a human.
Connecting an assistant means handing it a database password.
Use the AI assistant you already have, without handing it a database password.
Real data is off limits because it’s full of emails and SSNs.
Answer questions from real data without exposing what’s sensitive.
Risky changes wait for your OK.
Midplane holds the change and counts the rows it would touch. Approve it, and it runs once. The rows never leave your network.
“Clean up the test accounts.”
3 rows will change · Row changes on accounts
DELETE FROM accounts WHERE email LIKE '%@example.test'Counted read-only by the gateway. The rows themselves stay on the gateway. An approval covers this exact statement, from this agent, once.
Three steps.
Run Midplane next to your database: one command on your laptop or a server, or a template for AWS, Fly.io, Render or Kubernetes.
Add its URL to Claude, ChatGPT or Cursor, and sign in. No tunnel to set up, even in a private network.
Set your rules in the dashboard: which tables, which fields stay hidden, which changes need your OK.
Your rules, in a few clicks.
Choose which changes wait for your OK, and which fields your AI only ever sees masked. Midplane points out the columns that look like personal data or credentials.
- Row changes
- HoldINSERT, UPDATE and DELETE with a WHERE
- Schema changes
- DenyALTER, DROP and CREATE INDEX
| Column | Mask | Your AI sees |
|---|---|---|
name | clear | Ana Ruiz |
email | hash (joinable) | 56c1b2b98f7e… |
phone | partial, last 4 kept | •••••••••••0142 |
ssn | full redact | *** |
Midplane flags columns that look like personal data or credentials and suggests a mask for each, judged by name and type, never by reading a value.
The details, for whoever signs off.
Postgres’s own parser
Every statement is parsed by the real Postgres parser before it runs. Anything it can’t fully understand is denied.
SELECT * FROM users; DROP TABLE users;
→ denied: DROP TABLE in a stacked statementMasking inside the query
Hidden fields are replaced inside the query itself, so filters, joins and counts only ever see masked values. A count by SSN prefix returns 0.
SELECT count(*) FROM users WHERE ssn LIKE '123%';
→ 0Approvals bound to one statement
An approval covers one exact statement, from one agent, once.
DELETE FROM accounts WHERE email LIKE '%@example.test';
→ waiting: 3 rows · valid for this statement, onceContainment
After your AI reads text an outsider wrote, its changes wait for a human and secret tables are off limits.
-- after reading ticket 4312
SELECT secret FROM api_keys;
→ denied: secret table after untrusted input
Open-source gateway
MIT-licensed: read every line, build it yourself, or verify our signed releases.
Every guarantee has a test
We publish the attacks we test against, adversarial SQL and masking bypasses. Run them against us, or anyone.
Logged before it runs
Every query is recorded before it reaches the database, and can be exported to storage you own.
Your credentials stay home
Our cloud never holds your database password, and our relay only passes encrypted traffic. EU or US region.
Two ways to run it.
Local
Free, open sourceFor developers and open-source users trying Midplane on their own database, or teams that want enforcement with no vendor account at all.
- One gateway, rules in a policy file you edit
- Risky changes are refused
- Query log kept as a local file
Midplane Cloud
Your gateway, our dashboard.For teams that want approvals, SSO, shared rules and an audit view across people and gateways, while the gateway and their data stay in their own network.
- Team approvals for risky changes
- SSO, and rules shared across gateways
- Audit view and EU or US region
- A URL Claude and ChatGPT can reach, with no open ports
Tell us what you want to ask your database and what has to stay protected. We'll set it up with you.
Both block dangerous queries, hide sensitive fields, log every query before it runs, and keep your data in your network. Fully self-hosted dashboard for enterprise deals, on request.
How it works, in the docs