AskDBBLOCK
Give AI agents safe access to your database.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
AskDB — Give AI agents safe access to your database.
Your database, sandboxed. Your fields, controlled. One MCP endpoint for every AI tool.
https://github.com/user-attachments/assets/baa53f34-b0b4-41ee-89b3-60d133e8004d
Install · Try Locally · Connect AI · Security · FAQ
About AskDB
AskDB is a self-hosted bridge between your MongoDB or PostgreSQL database and any AI agent that speaks MCP. It clones your production data into an isolated sandbox, lets you control exactly which fields the AI can see, and exposes a single /mcp endpoint that plugs into Claude, ChatGPT, Cursor, and anything else.
No data masking. No fake
ea8ba87e8161OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add ui --env BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET} --env BETTER_AUTH_URL=${BETTER_AUTH_URL} --env ENCRYPTION_KEY=${ENCRYPTION_KEY} --env MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS=${MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS} -- npx -y @askdb/[email protected]{
"mcpServers": {
"ui": {
"command": "npx",
"args": [
"-y",
"@askdb/[email protected]"
],
"env": {
"BETTER_AUTH_SECRET": "${BETTER_AUTH_SECRET}",
"BETTER_AUTH_URL": "${BETTER_AUTH_URL}",
"ENCRYPTION_KEY": "${ENCRYPTION_KEY}",
"MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS": "${MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS}"
}
}
}
}Exposed tools (15)
13 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Orders | read | Customer orders |
aggregate | read | |
collection-schema | read | |
count | read | |
courses | read | Course catalog metadata. |
distinct | read | |
execute-typescript | write | |
find | read | |
list-collections | read | |
list-databases | read | |
private_notes | read | Internal notes. |
query | read | |
sample-documents | read | |
save-insight | write | |
users | read | User accounts and enrollment state. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (8 observation(s))
- Network
- declared (11 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
exec(sql: string): unknown;
CMD wget -qO- http://127.0.0.1:3100/api/health >/dev/null || exit 1
.oxfmtrc.json
.oxlintrc.json
url: process.env.DATABASE_PATH || "../../data/askdb.db",
import { db } from "../../db/index.js";import { schemaTables, schemaColumns } from "../../db/schema.js";import { detectPii } from "../../pii/patterns.js";import { db } from "../../db/index.js";TRUSTED_ORIGINS=http://localhost:3100,http://127.0.0.1:3100
Create an admin account in the dashboard, add a database connection, and try the MCP URL at `http://127.0.0.1:3100/mcp`. Local MCP clients (Claude Code / Cursor with a fixed bearer token) work; remote
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3100/api/health >/dev/null || exit 1"]
- Any URI is not `https://...` (except `http://localhost:*` / `http://127.0.0.1:*` for local Claude Code clients)
chalk, commander, open, ora, @types/node, tsx, typescript
@types/node, husky, lint-staged, oxfmt, oxlint, tsx, typescript
@modelcontextprotocol/sdk, express, mongodb, pg, quickjs-emscripten, zod, @types/better-sqlite3, @types/express
better-sqlite3, dockerode, drizzle-orm, mongodb, pg, @types/better-sqlite3, @types/dockerode, @types/node
@modelcontextprotocol/sdk, better-auth, cookie-parser, dotenv, express, express-rate-limit, helmet, vite
**`packages/mcp-server/src/token-verifier.ts`** (new file) — extract the verifier so both the router and the main server can share it:
| Body-parser ordering breaks better-auth or the SDK's token endpoint. | Mount `/api/auth` first (raw), then `createMcpOAuthRouter()` (handles its own urlencoded internally), then `/mcp` with its own
- `curl -X POST https://<domain>/token` 15 times quickly → last ones 429.
for i in {1..20}; do curl -sX POST https://<domain>/token; done | tail -5 # some 429sdocs/site/assets/askdb-promo.mp4
docs/site/assets/cover-github.png
ui/public/askdb-promo.mp4
Gates applied: no_behavioural_pass.
ea8ba87e8161full audit observations/trust-audit/mcp-server/mgorabbani__askdb.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | ea8ba87e8161 | BLOCK | D | 69 | first audit |
Questions
What is the AskDB MCP server?
Give AI agents safe access to your database.
What tools does AskDB expose?
15 in total: 13 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is AskDB safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does AskDB need?
It reads BETTER_AUTH_SECRET, BETTER_AUTH_URL, ENCRYPTION_KEY, MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS, MCP_OAUTH_CODE_TTL_SECONDS, MCP_OAUTH_ISSUER_URL and MCP_OAUTH_REFRESH_TOKEN_TTL_SECONDS from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does AskDB run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @askdb/ui at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (ea8ba87e8161), read on 2026-10-07. The repository is watched and re-audited when it changes.