# DBShield MCP server

> Protects relational databases from AI agents using dry-run sandboxing, intent-vs-effect gap analysis, and PII masking.

- Repository: https://github.com/RitualDev-Lab/DBShield
- Page: https://hostedmcp.org/servers/ritualdev-lab/dbshield
- Transport: stdio
- Stars: 1
- License: MIT
- Latest version: 0.2.1

## Install

### Claude Code

```sh
claude mcp add dbshield -- npx -y @ritualdev-lab/dbshield
```

### Cursor (`~/.cursor/mcp.json`)

```json
{
  "mcpServers": {
    "dbshield": {
      "command": "npx",
      "args": [
        "-y",
        "@ritualdev-lab/dbshield"
      ]
    }
  }
}
```

### VS Code (`.vscode/mcp.json`)

```json
{
  "servers": {
    "dbshield": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@ritualdev-lab/dbshield"
      ]
    }
  }
}
```

### VS Code CLI

```sh
code --add-mcp '{"name":"dbshield","type":"stdio","command":"npx","args":["-y","@ritualdev-lab/dbshield"]}'
```

### Claude Desktop (`claude_desktop_config.json`)

```json
{
  "mcpServers": {
    "dbshield": {
      "command": "npx",
      "args": [
        "-y",
        "@ritualdev-lab/dbshield"
      ]
    }
  }
}
```

### Codex

```sh
codex mcp add dbshield -- npx -y @ritualdev-lab/dbshield
```

### Codex config.toml (`~/.codex/config.toml`)

```toml
[mcp_servers.dbshield]
command = "npx"
args = ["-y", "@ritualdev-lab/dbshield"]
```

### Gemini CLI

```sh
gemini mcp add -s user dbshield npx -- -y @ritualdev-lab/dbshield
```

### Gemini settings.json (`~/.gemini/settings.json`)

```json
{
  "mcpServers": {
    "dbshield": {
      "command": "npx",
      "args": [
        "-y",
        "@ritualdev-lab/dbshield"
      ]
    }
  }
}
```

## Environment variables

| Name | Required | Secret | Description |
|---|---|---|---|
| `DATABASE_URL` | no | no |  |
| `DBSHIELD_DB_URL` | no | no | Connection URL or file path for target database |
| `DBSHIELD_DIALECT` | no | no | Target database dialect (postgres, mysql, sqlite) |

## Tools (12)

- `db_status`
- `db_describe_schema`
- `db_query`
- `db_dry_run`
- `db_commit`
- `db_explain_query`
- `db_audit_log`
- `db_validate_migration`
- `db_check_schema_drift`
- `db_check_semantic_intent`
- `db_distributed_dry_run`
- `db_distributed_commit`

## FAQ

### What is DBShield?

DBShield is an open-source database guardrail, virtual schema masking proxy, and MCP server designed to protect relational databases from accidental mutations and PII leaks when queried by AI agents.

### What is Virtual Schema Masking?

It is a feature that intercepts wire protocol queries to hide sensitive internal tables and restricted columns from an agent's view during introspection.