Blastproof MCP server
Commit Nov 14, 2026Provides a safety gateway for AI agents by previewing database writes on branches and requiring human approval for risky actions.
Also known as Mrinanka/blastproof
- Stars
- 1
- Tools
- —
- Downloads, 30 days
- —
- Latest version
- —
- Last commit
- Nov 14, 2026
- License
- Apache-2.0
What is Blastproof MCP?
Blastproof provides a safety gateway for AI agents by previewing database writes on branches and requiring human approval for risky actions.
Summary generated from the project's README
About Blastproof MCP server
Protecting production databases from accidental AI deletions or modifications is the primary function of Blastproof. It acts as a safety gateway for AI agents by intercepting tool calls and evaluating their impact before any changes are committed. While read operations execute directly, all write operations are first previewed on a database branch. The system uses a combination of predefined rules and an LLM judge to analyze these previews, providing plain language explanations of what the command will actually do.
Developers can integrate this with Claude Code to ensure agents operate within safe boundaries. The architecture relies on credential isolation, meaning the AI agent never holds the actual database keys; instead, those credentials live exclusively in the backend. Depending on the risk level, the system can automatically approve safe actions, block dangerous ones, or hold them for human review via a dashboard. This setup prevents incidents like mass user deletions by quantifying the exact impact, such as the number of rows or specific customer accounts affected.
What you can do with it
- 1Preventing accidental mass data deletionAn AI agent attempts to delete old user records, but the system intercepts the command to show exactly how many customers will be lost.
- 2Validating database writes via branchingBefore committing any changes, the server runs the proposed write on a database branch to preview the outcome.
- 3Securing database credentials from agentsEnsure that an AI agent cannot access or leak sensitive database keys by isolating them in a backend environment.
- 4Reviewing risky agent actions through a dashboardA developer can manually approve or reject pending database changes that the LLM judge flagged as uncertain.
Written from the project's README. Every use case is checked against a quote from it.
README
View on GitHubBlastproof
A safety gateway for AI agents. Every tool call an agent makes passes through Blastproof. Reads run directly. Writes are previewed on a database branch, explained in plain language, judged by rules and an LLM, then auto-approved, blocked, or held for the owner's approval before they are committed with an audit trail.
The agent never holds the company database's credentials, so a bad DELETE FROM users becomes a
held request that says "deletes 48,213 users, including 12 paying customers", not an incident.
▶ Watch the full 24-second film:
https://github.com/user-attachments/assets/5eed0547-6eca-40e8-969c-cca156d4cd89
How it works
- Code counts, the LLM explains. Every number comes from the database, never from a model.
- Fail closed. An error, timeout or unparseable statement blocks the write.
- The boundary is credential isolation. Company credentials live only in the backend.
More: docs/spec.md (what and why), docs/backend-plan.md,
docs/frontend-plan.md, docs/decisions.md.
Eval results
63 labelled scenarios (backend/evals/): 51 dangerous actions, 12 of them replays of real
incidents, and 12 safe ones. Dangerous actions must be blocked or held; safe ones must go through.
| Rules only (every pull request) | Live, real models (2026-11-06) | |
|---|---|---|
| Real-incident replays caught | 12 of 12 | 12 of 12 |
| Dangerous actions blocked or held | 51 of 51 (100%) | 51 of 51 (100%) |
| Safe actions held (false blocks) | 1 of 12 (8.3%) | 1 of 12 (8.3%) |
| Previewed impacts with the exact row counts | n/a | 37 of 37 |
| Time added to a read, p95 | n/a | 19.4 ms (100 reads) |
| Write preview time, p50 / p95 | n/a | 7.7 s / 18.5 s |
| Cost of the whole run | $0 | $0.30 |
The live run used gpt-oss-120b for summaries and Claude Sonnet 5.5 as the judge, through
OpenRouter, on GitHub Actions. The one false block is a ticket update that no rule allows on its
own, so it goes to review. How to run them: docs/setup.md section 10.
Quickstart (fully local: no Neon, no model key)
You need Docker, uv, Node (see frontend/.nvmrc) and, for the agent
part, Claude Code v2.1.295 or newer (older versions let a failing hook through). The full guide,
with the Neon path and troubleshooting, is docs/setup.md.
docker compose up -d
cd backend
uv sync
cp .env.example .env # then fill the values listed in docs/setup.md section 3
uv run alembic upgrade head
uv run python ../demo_company/seed.py --target local
uv run python -m app.cli bootstrap --admin-email you@example.com --admin-name "You"
uv run python -m app.cli seed-demo-actions
uv run uvicorn app.main:app --reload --env-file .env --log-config log_config.json
The first bootstrap downloads a 67 MB embedding model (set EMBEDDING_CACHE_DIR to choose where).
Open http://localhost:8000/docs, log in with POST /v1/auth/login, and approve or reject the seeded
actions. Without a model key the summary uses a template and the judge sends writes to human review.
The dashboard (cd frontend && npm ci && npm run dev, http://localhost:3000) has login,
navigation, shared components and every page up to Settings (Agents, Users, Rules); the polish pass and landing page come next.
Connect Claude Code
bootstrap prints the agent's key once. Create a workspace that holds only that key, with the hook
installed, and start Claude Code in it (see claude_hook/README.md):
uv run --project backend python claude_hook/workspace.py create ../blastproof-demo --key-stdin
uv run --project backend python claude_hook/workspace.py check ../blastproof-demo
Development
Checks, from backend/ and frontend/:
uv run pytest
uv run ruff check . ../demo_company ../claude_hook
cd ../frontend && npm run lint && npm run typecheck && npm test
After changing a route: uv run python -m app.cli export-openapi, then npm run gen:api in
frontend/. CI fails if either generated file is stale. Progress and known issues:
PROGRESS.md.
Status: the backend (steps 1 to 20) is live on Fly.io (checklist:
docs/deploy.md) and the dashboard and landing page (F1 to F13) on Vercel at https://blastproof.in (docs/deploy-dashboard.md). The evals are green with real models (above). Still to come: some by-hand checks, the final audit and the two-to-three-minute demo video.
Community & Contributing
- Contributing Guide: Setup instructions, workflow, and testing.
- Code of Conduct: Community standards and pledge.
- Security Policy: How to securely disclose vulnerabilities.
License
Blastproof is open-source software licensed under the Apache License, Version 2.0.
Blastproof MCP questions
How does Blastproof protect my database credentials?
Blastproof uses credential isolation, meaning company credentials live only in the backend and the agent never holds them.
What happens when an AI agent attempts a risky write operation?
Risky writes are previewed on a database branch, explained in plain language, and then either auto-approved, blocked, or held for human approval.
Does the system fail if there is an error or an unparseable statement?
Yes, the system is designed to fail closed, meaning any error, timeout, or unparseable statement will block the write.