P
MCP server · Database
Govern the Postgres MCP server.
The Postgres MCP server exposes your database to an agent. Keep it read-only, mask PII, and deny every write and DDL path.
Per-tool policy
An MCP server is a bag of tools. Enable them one at a time.
Connect Postgres once; HiveKey gates each tool per role. Read-only by default, writes on purpose, destructive ops denied.
mcp / postgres governed
query (SELECT) allow
list_schemas allow
query (INSERT/UPDATE) review
query (DELETE/DROP) deny
Read-only by default; route writes to approval; deny destructive SQL outright.
In the path
HiveKey sits between the agent and Postgres.
Agent
wants a tool call
HiveKey
scope · guard · log
Postgres MCP
only allowed tools
Put the Postgres MCP server under one policy.
Connect Postgres, gate each tool per role, and log every call — across your whole agent fleet.