Skip to main content
The gateway runs in your network, next to your databases. In Midplane Cloud you write the policy, approve held writes and read the query log. Your rows and connection strings never leave your network. An AI agent connects over MCP to the Midplane gateway, which runs in your network. The gateway checks, records and runs each statement, writes the audit log, and queries Postgres as its own role. Its only other connection is outbound, to Midplane Cloud (policy, approvals, query log), which holds no credentials and sees no rows.

Get started

From a new project to your agent’s first query.

How it works

The parts, and what stays in your network.

Deploy the gateway

On your machine, a server, or a platform.

​
What it enforces

Table access

Denied by default. You open tables one by one, or all for reading.

Masking

Emails hashed, phones shortened, dates generalized, inside the query.

Approvals

A write can wait for a person to approve the exact statement.

Containment

An agent that reads untrusted text loses access to secret tables.
Every statement is also recorded in an audit log on the gateway’s own disk. The gateway is MIT licensed, with its source on GitHub.