SafeSQL MCP
SafeSQL lets an AI assistant answer questions from a company database without being able to change it or see customers' private details. Every query is checked first: it must be a single read-only SELECT, it is limited in rows and time, and columns such as email and phone come back masked. The console shows each verdict, and a benchmark measures what the checks cost.
Measured numbers
- Tests
- 1161
- Browser tests
- 27
- Lighthouse performance
- 98
- Accessibility
- 100
- Best practices
- 100
- SEO
- 100
Home page, mobile. Copied from the showcase's own README on 24 October 2026.
Open the live site (opens in a new tab) sql.phoenixcodes.org
On a phone
At desktop width
What it proves
- A guard that parses and rewrites SQL, tested against about 700 attack variants.
- Personal data is masked by column policy unless the sign-in allows it.
- Every call is audited as a fingerprint of the query, never as its text.
- Real OAuth 2.1 sign-in, on a Cloudflare Worker placed close to the database.
How this adapts to your project
Point the guard at your own warehouse or read replica and write the masking policy for your own columns. The query templates become the approved reports your team already asks for, and the audit log gives security a record of what the assistant touched.