hs-sql-agent
2.0.2
Docs 2.0.2
Documentation version
2.0.2 Latest
2.0.2 Latest
Docs Administration

Admin Panel Overview

The operator control plane for database access, MCP credentials, identity, authorization, audit, security policy, and runtime operations.

The Admin Panel is the operator control plane for hs-sql-agent. Operators define what an MCP client can reach and how SQL is governed; MCP clients then use the separately authenticated /mcp endpoint.

Database Management Register provider connections, test connectivity, and control which database an MCP key can bind to.
MCP Keys Issue, rotate, revoke, scope, and generate client configuration for MCP credentials.
Semantic Metadata Add human-readable names, descriptions, synonyms, relationships, and metrics to schema discovery.
Custom Tools Publish governed SQL operations as named MCP tools without bypassing runtime policy.
Security Understand authentication, authorization, table/tool scope, fail-closed SQL policy, and audit boundaries.
Operations Configure deployment, shared state, observability, retention, limits, and production runtime behavior.

Identity, governance, and operations

Members & Roles Create Admin members, assign roles, revoke sessions, and manage role lifecycle safely.
Permissions Understand the permission-path plus action model enforced by Admin controllers.
Audit Search, summarize, export, and apply retention to runtime and security audit records.
Security Policies Manage query, DML, per-key rate-limit, and SQL concurrency enforcement.
Operability Inspect execution metrics, DB health, key usage, and outbound delivery state.
Admin HTTP API Source-backed 2.0.2 controller routes and authorization surface used by the bundled UI.
01 Register database
02 Issue MCP key
03 Set tool/table scope
04 Enrich metadata
05 Connect client
06 Observe & audit
  1. Register and verify the database connection that the agent should expose.
  2. Issue an MCP key bound to that database and give it only the tools/tables the client needs.
  3. Add semantic metadata when raw schema names are not enough for reliable agent discovery.
  4. Generate the client configuration and connect through the public Streamable HTTP /mcp endpoint.
  5. Use audit and operability surfaces to inspect runtime behavior and tighten policy where needed.

MCP key lifecycle

When a key is issued, rotated, or duplicated, the UI can generate direct Streamable HTTP configuration for supported client formats. The plaintext secret is shown only in that lifecycle dialog and is not retained for later display.

Copy the generated configuration before closing the dialog.

Embedded UI and built-in identity are optional

An ASP.NET Core host can expose the HsSqlAgent Admin API without serving the packaged Admin UI. In the modular integration path, use UseHsSqlAgentAdminApi() and let the host call MapControllers(); add UseHsSqlAgentAdminUi() only when the packaged UI is wanted.

The host can also use AddHsSqlAgentHostAuthorization(...) to keep its existing login and permission system instead of installing HsSqlAgent members, roles, JWT, SMTP, or OIDC. MCP is selected and mapped independently with AddHsSqlAgentMcp(...) / UseHsSqlAgentMcp().

See ASP.NET Core integration for the complete 2.0.2 composition model.