Per table
Expose Orders. Hide Payments.
Turn each operation on or off per table. Hidden tables disappear from what the agent sees.
Using Claude Code on a multi-tenant app?
A database MCP server that doesn’t leak every customer’s data.
Connect any agent to Postgres, MySQL, or SQLite, limited to the tables, operations, and users you choose.
Claude Code
MCP: zenstack-studio · signed in as alice@example.com
show me all orders
| order | total | customer |
|---|---|---|
| order-002 | 59.99 | Alice Johnson |
| order-005 | 120.00 | Alice Johnson |
what about Bob's orders?
I can't find any orders for Bob.
mark order-002 as refunded
order.update · rejected by access policy
I can't. Your access policy doesn't let this user change an order's status.
A connection string gives your agent everything.
Most database MCP servers log in to the database itself, so the agent sees every customer’s rows. Studio’s MCP server can act as one of your app’s users instead. Connect it as Alice, and the agent sees only what Alice can see.
| Aspect | Typical database MCP server | ZenStack Studio MCP |
|---|---|---|
| What the agent can see | Every table the database role can reach | Only the tables you expose |
| What it can change | Read-only or everything | Read, create, update, delete, set per table |
| Whose data it sees | Every customer at once | One user’s, e.g. only Alice’s orders |
| Where credentials live | In every agent’s MCP config | In the proxy you run |
Three layers of control.
Per user
One customer’s rows, nothing else.
Each access key acts as one user, and every query runs under your ZenStack access policies.
Per query
Checked before it runs.
The agent writes Prisma-style queries, type-checked against your schema before they reach the database.
Per-user rules are ZenStack access policies, the same ones the studio enforces for people.
What it makes possible.
Debug a customer’s ticket
On production data, scoped to that one customer.
Ship an “ask your data” assistant
Each end user gets answers from their own records only.
Give a teammate’s agent a safe slice
Read-only access to just the tables they need.
Stop pasting DATABASE_URL into your agent’s config.
Enable the MCP server on a project in Studio and paste the config it gives you. Database credentials stay in your proxy.
Your proxy is reachable from the internet.
{ "mcpServers": { "zenstack": { "url": "https://studio.zenstack.dev/api/mcp/<your-routing-token>", "headers": { "Authorization": "Bearer <access-key>" } } }}Access keys are standard HS256 JWTs, so your backend can mint one per user. Read the docs.
MCP server FAQ
Is it safe to connect an AI agent to my production database?
As safe as the access you give it. You choose the tables the agent can see, the operations it may run, and the user it acts as. Database credentials stay in the proxy you run.
How is this different from a Postgres MCP server?
A typical Postgres MCP server logs in as a database role and hands the agent raw SQL, so it can reach every table and every tenant. Studio works at the level of your schema: allowed models and operations, per-user access policies, and type-checked queries.
Which MCP clients work with it?
Any MCP client, including Claude Code, Claude Desktop, and Cursor.
My database is only reachable on localhost. Can I still use it?
Yes. Use @zenstackhq/studio-mcp-remote as the MCP command. It runs on your machine and forwards requests to the local proxy.
Real data, and a safe agent.
npx @zenstackhq/cli studio --introspect