Docs
Download
Docs / Guides

Connect Claude Code to PostgreSQL safely

Updated

You can let Claude Code query your PostgreSQL database without giving it your rows or a way to change data. SayQL sits in between as an MCP server: Claude Code gets the schema and, by default, counts and summaries.

It works the same for MySQL, MariaDB, SQLite and SQL Server, and for production databases, which is where it matters most.

Why not give Claude Code a database URL?

A connection string in your project lets the agent run anything that login can: read every row into its context, which goes to the AI provider, and change data if the login can write. SayQL keeps the password in your keychain, checks every statement before it runs, and decides what Claude Code sees of each result.

Set it up

  1. Install SayQL from the download page. It's free and open source.
  2. Add your PostgreSQL connection in SayQL. Use a read-only login if you can (a role with CONNECT, USAGE on the schema and SELECT on its tables), so the database enforces it too.
  3. Connect Claude Code. Open Settings → AI apps, then Connect an app on the Access tab, and pick Claude Code. SayQL shows the command with the path filled in, which looks like claude mcp add --scope user sayql -- <path>. Run it once in a terminal.
  4. Ask. In Claude Code, ask about your data: "which tables are still in use, and how many orders came in this month?" It lists your connections, reads the schema and runs read-only queries through SayQL.

Choose what Claude Code sees

In Settings → AI apps → Access, each connection has a row. Under What AI apps get back, choose:

  • Nothing: row counts and column names only.
  • Counts and summaries (the default): per column, its type, nulls and distinct values, and min and max of plain numbers and dates. No row values.
  • Rows, masked: rows, with likely personal data replaced by tokens such as ‹email-1›.
  • All rows: for data you're happy to share with the app.

Columns that must never reach the AI, such as customers.email, go in the same row under never send: any query that could read them is refused, and SELECT * runs with them withheld. Details are in What AI apps may see.

What Claude Code can't do

  • Change data. Statements that could change data are refused. When a change is what you want, Claude Code can open the SQL in SayQL for you to review and run.
  • See your password. It stays in your system keychain.
  • Read server files through functions such as pg_read_file, or reach outside the database with dblink, even when the login could.

See what it ran

The Activity tab in Settings → AI apps lists every query Claude Code ran, with its SQL and whether it ran or was refused. Block stops an app in one click, and Only allow apps I've approved keeps out apps you haven't chosen.

For a team, the self-hosted SayQL server gives each agent its own key, its databases, tables and rows, and puts every query from people and agents in one audit log.

Using Cursor instead? See Give Cursor read-only access to your database. Comparing tools? See how SayQL compares.

Something missing or unclear? Ask in Discussions.