schemagateBLOCK
Text-to-SQL access control: schema selection that gives the LLM only the tables the caller is allowed to read. Row-level-security-aware table pruning for LangChain, MCP and any SQL agent. Postgres, Oracle, MySQL, SQL Server. 75% fewer prompt tokens.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://pypi.org/project/schemagate/) [](https://pypi.org/project/schemagate/) [](https://github.com/ashishsinha1602/schemagate/actions/workflows/ci.yml) [](LICENSE) [](https://www.bestpractices.dev/projects/15353) [](https://api.reuse.software/info/github.com/ashishsinha1602/schemagate) [](https://pepy.tech/projects/schemagate) [](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.ashishsinha1602/schemagate) [](https://ashishsinha1602.github.io/schemagate/)
Your text-to-SQL agent picks which tables to show the model before anyone checks what the caller is allowed to read. schemagate does the check first: it filters the schema by the caller's grants, so restricted tables are absent from the prompt rather than ranked low. Works with LangChain, MCP, or any SQL agent, on Postgres, Oracle, MySQL, SQL Server and SQLite.
If it keeps a table out of a prompt it should never have reached, a ⭐ helps oth
c3869f7631d6OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add schemagate --env SCHEMAGATE_DATABASE_URL=${SCHEMAGATE_DATABASE_URL} -- python schemagate==1.4.1 -m schemagate.mcp_serverTrust audit
BLOCKgrade D · trust 62/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (20)
schemagate certify postgresql://user:pw@host/db # end-to-end check on your engine
mod = __import__(mods[key])
CMD curl -fsS "http://127.0.0.1:${SCHEMAGATE_STUDIO_PORT}/api/health" || exit 1# then http://127.0.0.1:8770 in your own browser. `--no-connect` is
PG_URL_DEFAULT = "postgresql://postgres:[email protected]:5433/sgbench"
SGBENCH_PG_URL=postgresql://postgres:[email protected]:5434/sgbench pytest tests/test_groups_live.py
SGBENCH_PG_URL=postgresql://postgres:[email protected]:5434/sgbench pytest tests/test_groups_live_server.py
SCHEMAGATE_PG_URL=postgresql://postgres:[email protected]:5432/app pytest tests/test_rls_live.py
cat.add_all(pickle.loads(cache.read_bytes()))
cat.add_all(pickle.loads(cache.read_bytes()))
mod = importlib.import_module(fixture)
f"IF SCHEMA_ID('{SCHEMA}') IS NULL EXEC('CREATE SCHEMA {SCHEMA}')",local process on that VM can read at `169.254.169.254`. It is also in
schemagate # opens http://127.0.0.1:8770 on the 42-object demo
then open <http://127.0.0.1:8770>. See `stack/README.md` for why it is not public.
Then open <http://127.0.0.1:8770>. It is already pointed at the database the
sig = base64.b64decode(rec["sig"], validate=True)
and access control lists while the answer is a password.
for line in open("/etc/schemagate.env"):Gates applied: no_behavioural_pass.
c3869f7631d6full audit observations/trust-audit/mcp-server/ashishsinha1602__schemagate.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | c3869f7631d6 | BLOCK | D | 62 | first audit |
Questions
What is the schemagate MCP server?
Text-to-SQL access control: schema selection that gives the LLM only the tables the caller is allowed to read. Row-level-security-aware table pruning for LangChain, MCP and any SQL agent. Postgres, Oracle, MySQL, SQL Server. 75% fewer prompt tokens.
Is schemagate safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (62/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does schemagate need?
It reads ADMIN_PASSWORD, ANTHROPIC_API_KEY, GEMINI_API_KEY, GOOGLE_API_KEY, HF_TOKEN, OCI_CLI_AUTH, OPENAI_API_KEY, SCHEMAGATE_DATABASE_URL, SCHEMAGATE_ORACLE_PASSWORD, SGBENCH_PASSWORD and WALLET_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does schemagate run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as ashiq.
How current is this page?
The grade is for one exact copy of the source (c3869f7631d6), read on 2026-10-12. The repository is watched and re-audited when it changes.