> ## Documentation Index > Fetch the complete documentation index at: https://midplane.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # What is Midplane? > A safety layer between AI coding agents and your Postgres database. Parse, policy, audit. Midplane is a safety layer that sits between an AI coding agent — Cursor, Claude Code, Claude Desktop — and your Postgres database. The agent talks to your database through Midplane over [MCP](https://modelcontextprotocol.io/). Midplane parses every query, checks it against your policy, and writes a durable audit row **before** the query runs. Read-only by default. Per-table read/write is opt-in. Destructive and dangerous query shapes are denied at parse time, not pattern-matched after the fact. **Why this exists.** AI agents are getting plugged into production databases without an audit trail — so an agent can be useful against a real database without being able to drop it or run unaudited. ## What Midplane blocks Dangerous query shapes are denied at parse time; sensitive values are masked on the queries that do run: | What's blocked | Example | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Destructive writes** | `DELETE FROM users`
Denied by default, even with a `WHERE`. Opt in per table with `read_write`. | | **Statement injection** | `SELECT 1; DROP TABLE users`
Stacked statements are rejected at parse time — they never reach the database. | | **Hidden writes** | `WITH x AS (DELETE FROM ...) SELECT * FROM x`
The recursive AST walk catches writes buried in CTEs. | | **Sensitive values** | `SELECT * FROM users`
Runs, but emails, dates of birth, and salaries come back [masked](/docs/concepts/masking) — the raw values never reach the agent. | See [what Midplane blocks](/docs/concepts/table-access#beyond-table-access) for the full list and the [threat model](/docs/security/threat-model) for what's in and out of scope. ## Two ways to run it Midplane is one engine with two ways to operate it. The policy model and agent setup are identical — you choose who hosts it. Hosted. Sign up, paste a database URL, get an MCP endpoint. Managed credentials, searchable audit log, a dashboard for policy. Fastest path. Open source, MIT. Run Midplane in your own environment — the same dashboard, policy, and engine — with your credentials never leaving it. Not sure which? See [Cloud vs self-host](/docs/cloud-vs-self-host), which covers the operational trade-offs and the open-core licensing. ## How it works Every query the agent sends takes the same path: The SQL is parsed into an abstract syntax tree. Anything that can't be parsed is denied — Midplane never enforces policy on text it can't read. The AST is checked against your policy: table access and the built-in injection guards. The first matching denial wins. The attempt and the decision are written to the audit trail **before** the query runs. Denied queries are recorded too. Only allowed queries reach your database. The result and timing are appended to the same audit trail. Read the full walkthrough in [how Midplane works](/docs/how-it-works). ## Get started Zero to a protected endpoint in a few minutes. Wire up Cursor, Claude Code, or Claude Desktop. Grant the reads and writes your agent actually needs.