Per-key scope
Bind credentials to a concrete database and permitted MCP tools.
Governance
Keep authorization outside the model.
Scope every MCP key to the database, tools, tables, rate limits, and runtime policy you intend to expose. The LLM does not get to redefine those boundaries.
Table boundaries
Enforce table allowlists and query policy independently of model instructions.
Operational limits
Apply rate limiting, concurrency limits, revocation, and audit outside the prompt.
Policy belongs to the server
Prompt text is not an authorization system. hs-sql-agent evaluates the authenticated key, database binding, allowed tools, table boundaries, and runtime security policy before SQL reaches execution.
Keys expose the minimum useful surface
An MCP key can be scoped to the database and tools that a client actually needs. Built-in tools and published custom tools are checked against the key configuration before invocation.
- database binding
- allowed MCP tools
- table whitelist
- effective rate limits
- revocation and expiry state
Audit the execution boundary
Query and DML execution emit audit context that can record the tool, operation, timing, returned or affected rows, approval state, and compiler-derived facts. Governance remains inspectable after the model interaction is over.