Skip to main content
Midplane is a safety layer that sits between an AI coding agent — Cursor, Claude Code, Claude Desktop — and your Postgres database. The agent talks to your database through Midplane over MCP. Midplane parses every query, checks it against your policy, and writes a durable audit row before the query runs. Read-only by default. Per-table read/write is opt-in. Destructive and dangerous query shapes are denied at parse time, not pattern-matched after the fact.
Why this exists. AI agents are getting plugged into production databases without an audit trail — so an agent can be useful against a real database without being able to drop it or run unaudited.

​
What Midplane blocks

Dangerous query shapes are denied at parse time; sensitive values are masked on the queries that do run: See what Midplane blocks for the full list and the threat model for what’s in and out of scope. Between blocking a write and allowing it there’s a third answer: hold it for a human. Set a class of write to ask, and the agent waits for someone to approve before anything runs — see write approvals.

​
Ways to run it

One engine, three ways to operate it. The policy model, the rules, and the audit guarantee are identical — you choose how much product you want around them.

Midplane Cloud

Recommended. Hosted. Sign up, paste a database URL, get an MCP endpoint. Managed credentials, searchable audit log, a dashboard for policy.

Standalone engine

The MIT engine on your machine — no account, no dashboard. One MCP config block guards one database, auditing to a local file.

Self-host

Open source, MIT. The whole app in your own environment — same dashboard, policy, and engine — with your credentials never leaving it.
Not sure which? See Cloud vs self-host, which covers the operational trade-offs and the open-core licensing.

​
How it works

Every query the agent sends takes the same path:
1

Parse

The SQL is parsed into an abstract syntax tree. Anything that can’t be parsed is denied — Midplane never enforces policy on text it can’t read.
2

Policy

The AST is checked against your policy: table access and the built-in injection guards. The first matching denial wins.
3

Audit

The attempt and the decision are written to the audit trail before the query runs. Denied queries are recorded too.
4

Execute

Only allowed queries reach your database. The result and timing are appended to the same audit trail.
Read the full walkthrough in how Midplane works.

​
Get started

Quickstart

Zero to a protected endpoint in a few minutes.

Connect your agent

Wire up Cursor, Claude Code, or Claude Desktop.

Write a policy

Grant the reads and writes your agent actually needs.