Verified

Midplane MCP Server

Postgres database interaction with SQL AST parsing, PII masking, and audit logging.

Data last scanned today · Reviewed today

381 tool★ 4TypeScriptMIT

Overview

Midplane acts as a security layer between AI agents and Postgres databases. By parsing incoming SQL statements into the actual Postgres AST rather than using regex filtering, it ensures that every query aligns with declarative, per-table policies. This approach allows developers to expose sensitive tables to agents while maintaining strict control over data access. The system enforces PII masking at the source, ensuring raw sensitive values never leave the database environment. Policies handle complex transformations like consistent hashing and generalization, and the system fails closed if a query cannot be verified. Additionally, all write operations require human approval, providing a verifiable audit trail for database modifications.

Our verdict

With a security score of 33/100, this server is considered high risk. The score reflects that the project is community-maintained rather than vendor-backed, and key security aspects like its authentication methods have not yet been editorially reviewed. It is suitable for experimental environments where you can actively monitor the implementation, but should not be deployed in sensitive production contexts until the project matures and undergoes formal security review.

Zero direct dependencies reduce the supply-chain attack surface.
SQL AST parsing prevents common injection vectors.
PII masking occurs at the source level.
All write operations are captured in an audit log.

Community-maintained project with no formal vendor support.
Authentication and read-only modes lack third-party verification.
Low bus factor with only one identified contributor.

Setup

Claude Desktop

{
  "mcpServers": {
    "midplane": {
      "args": [
        "-y",
        "midplane-cloud"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
check_approval	Used by the agent to re-run a statement after a human has approved a held write.	medium

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›What are the environment requirements to run the Midplane engine?

The Midplane engine requires Node.js version 22.16 or higher to run.

›How does Midplane protect data during query execution?

Midplane parses SQL statements into a Postgres AST, enforces declarative per-table access policies, and rewrites queries to mask sensitive columns at the source before they leave the database.

›Can Midplane prevent destructive writes like mass deletions?

Yes, Midplane blocks destructive writes by default, including no-WHERE clause DELETE or UPDATE operations and all schema-altering commands like DROP or TRUNCATE, regardless of table policy.

›How does the human approval system for writes work?

If a write operation is configured for approval, the engine pauses the statement after policy validation and provides a tool for the agent to request human authorization. The statement only proceeds if approved, and denials can include feedback notes returned to the agent.

›Does Midplane block stacked-statement SQL injection attacks?

Yes, Midplane denies stacked-statement injections at parse time, preventing execution of combined commands like SELECT followed by DROP.