live wire
▸Snowflake’s Cortex Agent quickstart routes metrics and transcripts with prompt rules—but documents no authorization boundarySnowflake▸Oracle Select AI generates SQL/PGQ for property graphs—but errors if one AI profile mixes graphs with tables or viewsOracle▸Domo’s data team standardizes MCP builds with shared scaffolding; beta toolkits inherit user permissionsDomo▸Databricks proposes five outcome signals for agentic BI—and says dashboard counts and license usage miss decision qualityDatabricks▸One vibe-coded database app needed 56+ human test hours and three repair rounds despite AI Studio’s verification claimsMancas & Mancas / arXiv▸BigQuery AI.IF’s default cost mode trains a local model for most rows—and drops row-error thresholdsGoogle Cloud▸AWS’s multi-tenant data-agent pattern gives the broker Lambda no data permissions; Cognito roles carry Lake Formation scopeAWS Big Data Blog▸Amazon OpenSearch’s optimized engine adds nested agent traces, but AWS reserves it for log analytics—not vector searchAWS▸Two interpretation-based provenance semantics cannot express SQL bag difference, new theorem showsKolaitis / arXiv▸Databricks Feature Views reuse one definition for training and live scoring, but online lookup still returns latest available stateDatabricks▸Databricks Genie’s Slack and Teams previews default channel answers to public, even when viewers lack source-data accessDatabricks▸Snowflake’s two-tool GraphRAG agent beat a seven-tool graph setup 70% to 60% on 22 ontology questionsSnowflake Engineering▸Semantix opens an Apache-2.0 semantic-first data-agent stack, but labels the project WIP and has no release or adoption yetGitHub / icosmos-space▸Confluent defines Streamhouse as shared current state for agents and apps, but says broader semantics and governance are still to comeConfluent▸Snowflake’s Cortex Agent quickstart routes metrics and transcripts with prompt rules—but documents no authorization boundarySnowflake▸Oracle Select AI generates SQL/PGQ for property graphs—but errors if one AI profile mixes graphs with tables or viewsOracle▸Domo’s data team standardizes MCP builds with shared scaffolding; beta toolkits inherit user permissionsDomo▸Databricks proposes five outcome signals for agentic BI—and says dashboard counts and license usage miss decision qualityDatabricks▸One vibe-coded database app needed 56+ human test hours and three repair rounds despite AI Studio’s verification claimsMancas & Mancas / arXiv▸BigQuery AI.IF’s default cost mode trains a local model for most rows—and drops row-error thresholdsGoogle Cloud▸AWS’s multi-tenant data-agent pattern gives the broker Lambda no data permissions; Cognito roles carry Lake Formation scopeAWS Big Data Blog▸Amazon OpenSearch’s optimized engine adds nested agent traces, but AWS reserves it for log analytics—not vector searchAWS▸Two interpretation-based provenance semantics cannot express SQL bag difference, new theorem showsKolaitis / arXiv▸Databricks Feature Views reuse one definition for training and live scoring, but online lookup still returns latest available stateDatabricks▸Databricks Genie’s Slack and Teams previews default channel answers to public, even when viewers lack source-data accessDatabricks▸Snowflake’s two-tool GraphRAG agent beat a seven-tool graph setup 70% to 60% on 22 ontology questionsSnowflake Engineering▸Semantix opens an Apache-2.0 semantic-first data-agent stack, but labels the project WIP and has no release or adoption yetGitHub / icosmos-space▸Confluent defines Streamhouse as shared current state for agents and apps, but says broader semantics and governance are still to comeConfluent
nl2sql.ai
releaseRelease

LibreDB Studio’s new MCP server makes read-only a database property—not a prompt promise

Version 0.17.0 exposes selected database connections to AI clients, but puts enforcement, auditability and hard limits below the model layer.

By The Tools Desk· Sep 27, 2026the quick take — two AI hosts go live when you do

LibreDB Studio 0.17.0 adds an opt-in Model Context Protocol server for AI clients including Claude Code, Codex, Cursor, VS Code, Gemini CLI and OpenCode. The important part is not merely that another database tool now speaks MCP. It is where LibreDB places the safety boundary: below the model, in database permissions and server-side controls. LibreDB Studio 0.17.0 release notes

Three tools, deliberately narrow

The MCP endpoint exposes three tools: connection listing, schema inspection and a bounded read-query operation. Query execution is limited to PostgreSQL, SQLite, DuckDB and SQL Server, while connection and schema inspection work across all supported engines. Results default to 100 rows, cannot exceed 500 rows or 32 KiB, and include pagination information when truncated. LibreDB Studio 0.17.0 release notes

LibreDB does not describe read-only safety as a SQL keyword filter. PostgreSQL uses a read-only transaction; SQLite and DuckDB use read-only opens; SQL Server requires a login that cannot write. PostgreSQL and SQL Server connections therefore need least-privilege credentials before the query tool will accept them. That design matters because generated SQL can evade shallow string filters even when the prompt says “SELECT only.” LibreDB Studio 0.17.0 release notes

Access is explicit—and auditing can stop execution

MCP is disabled until an operator enables it, and only seed connections marked for MCP are visible. Visibility is further filtered by the caller’s role. Users mint bearer tokens that are shown once and expire after 30 days by default; browser session cookies do not authorize the MCP route. The release does not include OAuth, so deployments must manage static bearer-token distribution and rotation. LibreDB Studio 0.17.0 release notes

Every tool call is written as an audit event before database access. If that audit write fails, the database call does not run. Origin, host and token refusals are also logged, while JSON-RPC batches are rejected. This turns the audit trail from optional observability into part of the execution gate. LibreDB Studio 0.17.0 release notes

The limits are as useful as the launch

LibreDB reports live checks with its SDK client, Claude Code and OpenCode across PostgreSQL, SQL Server, SQLite, DuckDB and LibreDB; configurations for Codex, Cursor, VS Code and Gemini CLI are documented but were not measured. Cancellation only stops Studio waiting, not necessarily the database statement, and long SQLite queries can block the whole Node process because the driver is synchronous. Those caveats make this a bounded administrative surface, not a blanket claim that connecting an agent is safe. LibreDB Studio 0.17.0 release notes

For operators evaluating database MCP servers, 0.17.0 offers a concrete checklist: explicit connection opt-in, role filtering, expiring credentials, database-native read-only enforcement, response caps and fail-closed audit logging. The remaining question is operational: whether static-token handling, cancellation behavior and single-process limits fit the deployment’s threat model.

sources

Filed by The Tools Desk. Corrections: desk@nl2sql.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk