Launch price: a lifetime Pro licence for $4.99 once, for the first 500 developers. Then $14.99. See pricing

QueryMoat
Install free

MCP server + database client for VS Code, Cursor and Windsurf

Your AI agent can read your database. It can't change it.

QueryMoat gives Claude Code, Cursor, Windsurf and Copilot your real schema and data, so they write code that actually fits it. Every query goes through a local server that lets reads through and stops writes. Production stays locked, whatever the agent decides.

Install free for VS Code Cursor, Windsurf & more
  • 1,100+ downloads
  • Free, including at work
  • Runs on 127.0.0.1
  • No telemetry, no signup
SELECT id, email FROM users WHERE created_at > now() - interval '7 days' 42 rows
EXPLAIN SELECT * FROM orders WHERE status = 'late' Query plan
UPDATE orders SET status = 'shipped' WHERE id = 1187 Never reached

Query rejected: connection "orders (prod)" is READ-ONLY (environment is "production"; contains UPDATE).

SELECT REPLACE(sku, '-', '') AS sku FROM products 318 rows
Works with
  • Claude Code
  • Cursor
  • Windsurf
  • GitHub Copilot
  • Antigravity
  • Any MCP client
Databases
  • PostgreSQL
  • MySQL
  • MariaDB
  • SQL Server
  • SQLite
  • Supabase
  • AWS RDS
  • Azure SQL

The problem

"Please don't touch production" is a request, not a rule.

Agents write much better code when they can see your tables and real rows. But a plain database MCP server hands them the same access you have, and one confident UPDATE without a WHERE is all it takes.

Agent with a raw connection

  • Runs whatever SQL it decides is right
  • Reaches production if the URL is in .env
  • Can be talked into a write by text inside your own data
  • Leaves no record of what it ran

Agent behind QueryMoat

  • Only reads run; the server checks every statement
  • Remote and production databases locked by default
  • Results arrive fenced as data, never as instructions
  • Writes become proposals you approve, and every call is logged (Pro)

How it works

What stops a write

The guard lives in the server your agent talks to, so it holds even when the agent decides otherwise. All of this is free.

  • 01

    Every statement is checked

    Only reads run: SELECT, WITH, EXPLAIN and friends. The guard parses the SQL itself, ignores words inside strings and comments, and catches a write chained after a read.

  • 02

    Remote databases are locked, whatever they're called

    Anything that isn't localhost, a Docker container or a SQLite file is read-only until you allow writes yourself. Databases tagged or named production stay locked either way.

  • 03

    The agent can't unlock itself

    Project settings can only tighten the rules. Turning read-only off takes your click in a dialog. Web pages can't reach the local server, and every request needs a token that only your user account can read.

  • 04

    Limits and injection defence

    Agent queries return at most 500 rows and stop after 30 seconds. Results reach the agent inside a boundary your data can't forge, and values that read like instructions are flagged.

Setup

Connected in about a minute

No database drivers, no Docker, no config file for most projects. QueryMoat finds your databases in .env, docker-compose.yml, Laravel, Rails, Django, Supabase, Prisma and Drizzle projects. It never reads .env.production.

  1. Install QueryMoat

    From the VS Code Marketplace, or Open VSX for Cursor, Windsurf, Antigravity and VSCodium.

  2. Open your project

    Detected databases show up in the QueryMoat panel. Click Connect.

  3. Connect your agent

    For Claude Code, run this once. Other clients get a ready-made config from the plug icon.

    claude mcp add --transport stdio querymoat node ~/.querymoat/mcp-server.js

Included free

A full database client, right in your editor

Close the separate database app. Browse, edit and query your data next to your code, with the same safety rules your agent follows.

QueryMoat data grid showing the orders table with column types, primary and foreign key badges, JSON values and pagination over 48,211 rows.
  • Fast data grid. Sorting, column filters and server-side pages of 25 to 500 rows.
  • Safe inline editing. Double-click a cell, review your batch of changes, commit with Cmd+S.
  • SQL editor. Cmd+Enter to run, EXPLAIN plans, searchable history, export.
  • Schema inspector. Types, defaults, keys, foreign keys and indexes in a side drawer.

QueryMoat Pro

Free keeps you safe. Pro gives you control and proof.

When you want the agent to do more than read, and a record of everything it did. A lifetime licence for $4.99 once at launch, no subscription.

Pro

Write approval: the agent proposes, you decide

Instead of a flat "no", the agent can propose a change and say why. QueryMoat test-runs it in a transaction that is rolled back, shows you exactly which rows would change, and runs it only when you click Approve.

  • Dry run with the affected rows, before anything changes
  • The approved SQL is pinned by hash, so it can't be swapped
  • Proposals expire; production stays locked regardless
Claude Code proposes an UPDATE on three orders. QueryMoat shows the SQL, a rolled-back test run listing the three affected rows, and Reject or Approve and run buttons.
Pro

Audit log: every agent query, and why it was allowed

See each tool call by agent, database and result, with the exact rule that allowed or blocked it and the settings file that rule came from. Entries are hash-chained, so any edit or deletion shows up.

  • Search SQL, filter by agent, result and database
  • Tamper-evident: "No entries were edited or removed"
  • Export to CSV for a review or an incident report
QueryMoat audit log listing agent queries from Claude Code, Cursor, Windsurf and Copilot, each marked allowed, blocked, proposed, sandboxed or executed, with the rule that decided it.
Pro

Personal data masked before the agent sees it

Emails, phone numbers, card numbers, names, addresses and secrets are found by column name and by value, even when renamed with AS, and masked in everything the agent gets back. Searching a masked column is refused.

Free plan: write your own rules to hide or mask any table or column.

What your database holdsWhat the agent sees
jane.doe@acme.ioj***@acme.io
4242 4242 4242 4242**** 4242
+1 415 555 0132[hidden]
sk_live_51Hx…9fQ[hidden]

Masked columns: email, card_number, phone, api_key

  • Pro

    SSH tunnels

    Reach databases behind a bastion host with key, agent or password sign-in. Host keys are pinned on first use.

  • Pro

    Cloud sign-in

    AWS RDS IAM with your AWS CLI profile or SSO, and Azure Entra ID through az login. No passwords in config.

  • Pro

    Sandboxed stored procedures

    Let the agent run read-only SQL Server procedures inside a transaction that is always rolled back.

Get Pro for $4.99

Lifetime licence · one-time payment · 14-day refund · $14.99 after the first 500

Why QueryMoat

Built for agents, not bolted on

Most database tools were made for people and later gained an MCP server. QueryMoat starts from the question "what should an agent be allowed to do?"

Telling the agent to be careful A typical database MCP server QueryMoat
Writes blocked by the server, not the promptNoIf you configure itDefault
Remote and production databases locked automaticallyNoNot usuallyYes
Agent can't loosen its own rulesNoVariesYes
Finds your databases with no config—Not usuallyYes
Database client in your editor—NoYes
Writes reviewed with a dry run before they runNoNoPro
Tamper-evident log of every agent queryNoNot usuallyPro
Personal data masked automaticallyNoNot usuallyPro
Your data leaves your machine—VariesNever

"Readonly MCP is the adult version."

Downloads
1,100+
Database engines
5
Telemetry collected
None

Pricing

Safety is free. Control is $4.99, once.

Everything that keeps your data safe is free, for good, including at work. Pro is a lifetime licence: you pay once, and it includes the Pro features we add later.

Free

$0

For every developer, forever

Install free
  • MCP server for every agent and editor
  • Agents read your schema and data
  • Read-only guard, production locked
  • Token-protected local server
  • Row and time limits, injection defence
  • Your own rules to hide tables and columns
  • Data grid, SQL editor, EXPLAIN, export
  • CI check for your config

Launch price · first 500

Pro

$4.99 $14.99 one-time

Lifetime licence for one developer, up to 5 of your machines

Get Pro for $4.99

No subscription. Pay once, keep Pro for life.

  • Everything in Free
  • Write approval with dry run
  • Audit log, tamper-evident, with viewer and CSV export
  • Automatic masking of personal data and secrets
  • SSH tunnels
  • AWS RDS IAM and Azure Entra ID sign-in
  • Sandboxed stored procedures (SQL Server)
  • Future Pro features included

Coming soon

Team

$6 per user a month

or $59 per user a year, from 3 users

Join the waitlist
  • Everything in Pro
  • Shared rules your team can't loosen
  • One audit trail for the whole team
  • Central licence management
  • Pay once, keep it for life. No subscription for individuals.
  • 14-day refund. No questions asked. Refund policy
  • One network call. Pro checks its licence; it keeps working 14 days offline.
Compare every feature
Free Pro
MCP server for Claude Code, Cursor, Windsurf and Copilot, with multi-project routingIncludedIncluded
Agents read your schema and data, including run-queryIncludedIncluded
Read-only guard, with remote and production databases lockedIncludedIncluded
Row and time limits, prompt-injection defenceIncludedIncluded
Database client: data grid, inline editing, SQL editor, EXPLAIN, exportIncludedIncluded
SQLite, PostgreSQL, MySQL, MariaDB and SQL ServerIncludedIncluded
Zero-config discovery and .querymoatrcIncludedIncluded
CI check (querymoat-check)IncludedIncluded
Hide personal data from agentsYour own rulesAutomatic
Write approval: the agent proposes a change, you review the affected rows and approve itNoIncluded
Audit log: every agent query, which rule allowed or blocked it, and where that rule came fromNoIncluded
Audit log viewer with search, filters and CSV exportNoIncluded
SSH tunnels and cloud database sign-in (AWS RDS, Azure)NoIncluded
Run read-only stored procedures in a rolled-back sandbox (SQL Server)NoIncluded

Free for your pipeline

Keep it that way in CI

The MIT-licensed querymoat-check fails the build when a config would let an agent write to a remote database, or when a password is committed to the repo.

- uses: actions/checkout@v4
- uses: heysidhant/querymoat@v0.3.0

Questions

Does my data leave my machine?

No. The MCP server runs inside your editor and listens only on 127.0.0.1, with a token only your user account can read. Queries go from your machine straight to your database, and QueryMoat collects no telemetry. The only network call is Pro's licence check.

Do I need Pro to be safe?

No. The read-only guard, production lock, row and time limits, prompt-injection defence and your own hide rules are all free, for good. Pro adds control (write approval, automatic masking) and proof (the audit log).

What if I want the agent to change data?

You can turn off read-only for agents in your user settings; QueryMoat asks you to confirm in a dialog first, and production databases stay locked regardless. With Pro's write approval the agent proposes each change, you see the rows it would affect, and nothing runs until you approve.

Which editors and agents does it work with?

VS Code 1.90+, Cursor, Windsurf, Antigravity, VSCodium and other VS Code–based editors, with Claude Code, Copilot and any MCP client. It runs on macOS, Windows, Linux, WSL and Dev Containers, with no native binaries.

What happens after the first 500?

Pro goes to $14.99. If you bought at the launch price, your licence keeps working and keeps getting updates; later price changes never affect a licence you already have.

Is Pro a subscription?

No. Pro for individuals is a lifetime licence you pay for once, and it includes updates and the Pro features we add later. If it isn't right for you, ask for a refund within 14 days. Only the Team plan is billed monthly or yearly. See the refund policy.

Was this called QueryDock?

Yes. It's the same extension under a new name. Existing .querydockrc files and AI client configs keep working after you switch.

Let your agent see the data. Keep the keys.

Install free in under a minute. Upgrade when you want the agent to do more.

Install free for VS Code Cursor, Windsurf & more