PgBeam

The product is a Postgres access proxy that issues scoped connection strings and hosted MCP endpoints for AI agents, enforcing read-only access, table allowlists, PII masking, query and row budgets, kill-switch revocation, and a full audit trail at the wire protocol before queries reach the database. It is for developers, IT and security staff, and engineering teams in B2B organizations that let coding agents or MCP clients query production Postgres. Compared to handing agents a raw superuser DSN, it enforces policy in the wire with no code changes, extensions, or schema changes and works with any Postgres including RDS, Aurora, Neon, Supabase, or self-hosted.

Key features

• Scoped per-agent Postgres credentials
• Read-only enforcement blocking writes and DDL
• Table and schema allowlists
• Row-level policies via appended WHERE
• PII masking via redact null or hash
• Query budgets per time window
• Row caps per result
• Instant kill-switch per credential or project
• Full audit log with decision rows latency
• Hosted MCP endpoint with 8 tools
• Connection pooling
• Query caching with TTL
• Read replica routing