open source · Apache-2.0 · MCP-native

Stop giving AI agents raw database access.

SchemaBrain is the trust and intelligence layer between AI agents and your database. It learns your schema, then compiles every query read-only, PII-aware, and audited.

12 read-only tools·local vector embedder·SHA-256 audit
AI AGENTclaude · cursor · zed
MCP tools
(read-only)
schemabrainTRUST BOUNDARY
inspectionclassify PII · resolve schema01
trustpolicy · refusal · audit02
executioncompile read-only SQL03
intelligencesemantic · graph · RAG04
compiled
read-only SQL
YOUR DATABASEpostgres · sqliteread_only = ON
● The intelligence

It understands your database deeply — so it can guard it.

Safety is downstream of understanding. Four layers turn a raw schema into something an agent can reason over, and an operator can trust.

LAYER 01

Semantic understanding

Every column gets an AI-generated meaning, and real business entities are identified out of raw tables — each with a rationale and a confidence band.

user · bound entity · conf high — “join hub for orders, sessions, billing”
LAYER 02

Relationship intelligence

Declared foreign keys plus join paths mined from real query logs — surfacing relationships the schema never declared, with cardinality.

session → user · log-mined · 1.8M joins observed
LAYER 03

The knowledge graph

A real, traversable graph with multi-hop join paths and cardinality. Ask for a rollup and get the canonical path back.

order_item → order → user → tenant · 3 hops
LAYER 04

Retrieval (RAG)

Local semantic search returns what's relevant and why it matched — all process-local, nothing leaves the box.

q=“monthly revenue” → revenue 0.91 · sales 0.84
● How it works

discover → describe → compute

The agent never writes SQL. SchemaBrain compiles it from definitions you control.

1

discover

Agent calls one of 12 read-only MCP tools over stdio. SchemaBrain resolves intent against the semantic layer.

2

describe

It classifies and refuses PII, looks up cosine-similar entities, and resolves the canonical join path.

3

compute

It compiles strictly parameterized read-only SQL, runs it, and writes a hash-chained audit row.

● The safety, as proof-points

Trust you can show your security team.

Because SchemaBrain understands the data, every safeguard is precise — not a blunt allowlist. The firewall is the floor, not the headline.

PII classification

Twelve sensitivity categories, scored per column with a confidence band.

Catastrophic floor

Credentials, government IDs, and card data are hard-blocked, regardless of policy.

Editable policy

Tag or clear any column; preview the diff before it applies.

Tamper-evident audit

Every query writes a SHA-256 hash-chained row. Verify the chain in ms.

Def-driven compilation

Agents never write SQL — it's compiled from definitions you own.

SQL firewall

Read-only connections, statement timeouts, row caps — one guarantee among many.

● Get started

Running in one command.

Point SchemaBrain at a Postgres URL, add it to your MCP client, and the agent talks to a schema it finally understands — safely.

~/acme-saas
$ uvx schemabrain init
# indexing schema · 12 tables · mining joins
38 entities · 94 joins · 26 metrics · 4,612 vecs
✓ mcp stdio server live · 12 read-only tools
# transaction_read_only = ON