Ask your production database anything. Break nothing.
Midplane sits between your AI assistant and your Postgres database. It blocks dangerous queries, hides sensitive fields, and keeps your data in your network.
Works with Claude, ChatGPT, Cursor, VS Code and any MCP client.
UPDATE accounts SET plan = 'free';Midplane blocked that because it had no filter. I'll limit it to trials that have ended.
… WHERE trial_ends_at < now() AND plan = 'trial';The change is waiting for your approval. Once you approve, 312 accounts move to the free plan.
Your AI is fast and confident. Midplane checks every query before it reaches your database.
UPDATE accounts SET plan = 'free';The full list
- Mass changes
- Updates or deletes without a WHERE clause, or with one that would still touch every row. Midplane stops them before they run.
- Dropped tables
- Dropped tables and other schema changes. Your AI can’t restructure your database by accident.
- Hidden writes
- Changes hidden inside a query that looks like a read. Midplane reads the whole statement, so a delete tucked inside a SELECT is caught.
- Sensitive fields
- Hidden fields stay hidden, even when your AI filters or sorts by them. It can’t work out an email or an SSN one question at a time.
- Prompt injection
- Instructions planted in your data, like a support ticket telling your AI to fetch your API keys. Text your AI reads can’t give it orders.
Midplane runs next to your database: on your laptop, or in your own cloud with one click.
Your network
Your AI vendor
Midplane's cloud
What it lets you do
Only engineers who know SQL can answer “how many trials converted last week?”
Your whole team can ask production questions, not just the engineers who know SQL.
Your AI stays read-only, because one bad write costs too much.
Your AI can make changes, because risky ones wait for a human.
Connecting an assistant means handing it a database password.
Use the AI assistant you already have, without handing it a database password.
Real data is off limits because it’s full of emails and SSNs.
Answer questions from real data without exposing what’s sensitive.
Risky changes wait for your OK.
Midplane holds the change and counts the rows it would touch. Approve it, and it runs once. The rows never leave your network.
“Clean up the test accounts.”
3 rows will change · Row changes on accounts
DELETE FROM accounts WHERE email LIKE '%@example.test'Counted read-only by the gateway. The rows themselves stay on the gateway. An approval covers this exact statement, from this agent, once.
Three steps.
Deploy Midplane next to your database: one command on your laptop, or one click into your cloud.
$ npx midplane localConnect Claude, ChatGPT or Cursor, and sign in.
Set your rules in the dashboard: which tables, which fields stay hidden, which changes need your OK.
Your rules, in a few clicks.
Choose which changes wait for your OK, and which fields your AI only ever sees masked. Midplane points out the columns that look like personal data.
- Row changes
- HoldINSERT, UPDATE and DELETE with a WHERE
- Schema changes
- DenyALTER, DROP and CREATE INDEX
| Column | Mask | Your AI sees |
|---|---|---|
name | clear | Ana Ruiz |
email | hash (joinable) | 56c1b2b98f7e… |
phone | partial, last 4 kept | •••••••••••0142 |
ssn | full redact | *** |
Midplane flags columns that look like personal data and suggests a mask for each, judged by name and type, never by reading a value.
The details, for whoever signs off.
Postgres’s own parser
Every statement is parsed by the real Postgres parser before it runs. Anything it can’t fully understand is denied.
SELECT * FROM users; DROP TABLE users;
→ denied: DROP TABLE in a stacked statementMasking inside the query
Hidden fields are replaced inside the query itself, so filters, joins and counts only ever see masked values. A count by SSN prefix returns 0.
SELECT count(*) FROM users WHERE ssn LIKE '123%';
→ 0Approvals bound to one statement
An approval covers one exact statement, from one agent, once.
DELETE FROM accounts WHERE email LIKE '%@example.test';
→ waiting: 3 rows · valid for this statement, onceContainment
After your AI reads text an outsider wrote, its changes wait for a human and secret tables are off limits.
-- after reading ticket 4312
SELECT secret FROM api_keys;
→ denied: secret table after untrusted input
Open-source gateway
MIT-licensed: read every line, build it yourself.
Every guarantee has a test
We publish the attacks we test against, adversarial SQL and masking bypasses. Run them against us, or anyone.
Logged before it runs
Every query is recorded before it reaches the database, and can be exported to storage you own.
Your credentials stay home
Our cloud never holds your database password. EU or US region.
Two ways to run it.
Local
Free, open sourceFor developers and open-source users trying Midplane on their own database, or teams that want enforcement with no vendor account at all.
- One gateway, rules in a policy file you edit
- Risky changes are refused
- Query log kept as a local file
Midplane Cloud
Your gateway, our dashboard.For teams that want approvals, SSO, shared rules and an audit view across people and gateways, while the gateway and their data stay in their own network.
- Team approvals for risky changes
- SSO, and rules shared across gateways
- Audit view and EU or US region
- Protection from instructions planted in your data
Tell us what you want to ask your database and what has to stay protected. We'll set it up with you.
Both block dangerous queries, hide sensitive fields, log every query before it runs, and keep your data in your network. Fully self-hosted dashboard for enterprise deals, on request.
Full comparison in the docs