sferarc/pgbeam

Investigate and export what an agent actually did against Postgres using PgBeam's audit trail. Use this when you need to answer "what did this agent run", show a reviewer or auditor that a credential was held to its policy, export statement history to CSV or a SIEM, verify the tamper-evident audit chain, or turn recorded traffic into a tighter policy. For creating credentials use pgbeam-connect, for authoring the policy itself use pgbeam-policy.

Wire an AI agent to a Postgres database safely with PgBeam. Use this when a task needs the agent to read or query a real Postgres database and you want scoped, read-only-by-default, PII-masked, budgeted, audited, revocable access instead of handing the agent a full-privilege connection string. Covers getting a scoped credential, choosing between a guarded connection string and the hosted MCP endpoint, and paste-ready Claude Code, Cursor, and VS Code config.

Drive PgBeam's hosted Postgres MCP tools well once an agent is connected. Use this when the agent is already wired to a PgBeam MCP server (briefing, query, validate_sql, list_tables, describe_table, explain, schema_catalog, my_permissions, plus search_docs and read_doc) and needs to explore a schema and run SQL efficiently against policy-enforced, read-only-by-default, PII-masked, audited access. For the initial wiring and credential setup, use pgbeam-connect first.

Author a PgBeam policy profile as code (access mode, table allow and deny lists, PII masking rules, row filters, query budgets, write mode). Use this when you need to define or tighten what a PgBeam agent credential is allowed to do against Postgres, either with the CLI or as a reviewed Terraform resource. For first-time wiring of an agent to a database, use pgbeam-connect first.

Let an agent write to Postgres without risking production, using PgBeam's migration linter, instant branches, always-rollback dry-run mode, and human approvals. Use this when the agent's job is to write rather than read (a migration, a backfill, a generated UPDATE) and read-only enforcement is too strict, or when you need to check DDL for table rewrites and locking before it runs. For read-only wiring use pgbeam-connect, for the full policy shape use pgbeam-policy.