Letting AI agents query my databases without ever giving them the credentials

Every time I connect an AI agent to a database, the same question comes up: where does the connection string live? Usually the answer is "in the agent's config file", which means a password sitting in a JSON file next to a tool I don't fully control.

I took a different route in omni-sql, an open-source desktop SQL IDE. The IDE already holds my connections (passwords live in the OS keyring). It also runs a local MCP server, so the agent talks to the IDE, not to the database.

It removes the credential from the agent's configuration. It does not hide data: SQL, schema names and permitted results are visible to the connected MCP client, so use it only when that exposure is acceptable. Approved SQL can still change data, so I use a least-privilege database user for anything important.

An agent that can run arbitrary SQL on its own is a bigger risk than one that has to ask. The approval dialog keeps a human in the loop for the one action that matters.

MongoDB (native queries plus read-only SQL via DuckDB), local analysis with DuckDB, CSV/S3 imports and macOS installers (v0.14.0).

Repo and docs: github.com/cccadet/omni-sql (see docs/MCP.md ).

Question for readers: would you trust this model for a staging database, and what would you want the approval dialog to show?