QueryMoatYour AI agent can read your database. It can't change it.
QueryMoat connects Claude Code, Cursor, Windsurf and Copilot to your project's database through a local MCP server. Reads go through. Writes stop at the moat.
Free. Runs on your machine. No telemetry.
SELECT id, email FROM users WHERE created_at > now() - interval '7 days'
42 rows
EXPLAIN SELECT * FROM orders WHERE status = 'late'
Query plan
UPDATE orders SET status = 'shipped' WHERE id = 1187
Never reached
Query rejected: connection "orders (prod)" is READ-ONLY (environment is "production"; contains UPDATE).
SELECT REPLACE(sku, '-', '') AS sku FROM products
318 rows
What stops a write
Telling an agent "read-only" in a prompt is a request. QueryMoat enforces it in the server the agent talks to, so it holds even when the agent decides otherwise.
-
Every statement is checked
Only reads run: SELECT, WITH, EXPLAIN and friends. The guard reads the SQL itself, ignores words inside strings and comments, and catches a write hidden after a read.
-
Remote databases are locked, whatever they're called
Anything that isn't localhost, a Docker container or a SQLite file is read-only until you allow writes on it yourself. Databases tagged or named production stay locked either way.
-
The agent can't unlock itself
Project settings can only tighten the rules. Turning read-only off takes your click in a dialog, and web pages can't reach the local server.
Set up in a minute
No database drivers to install and no config to write for most projects.
-
Install QueryMoat
From the VS Code Marketplace, or from Open VSX for Cursor, Windsurf, Antigravity, VSCodium and other VS Code–based editors.
-
Open your project
QueryMoat finds your databases in
.env,docker-compose.yml, Laravel, Rails, Django, Supabase and Prisma projects. -
Connect your agent
For Claude Code, run this once. Other clients get a ready-made config from the plug icon in QueryMoat.
claude mcp add --transport stdio querymoat node ~/.querymoat/mcp-server.js
Works with what you already use
Agents and editors
Claude Code, Cursor, Windsurf, Antigravity, GitHub Copilot, and any MCP client.
Databases
SQLite, PostgreSQL, MySQL, MariaDB and SQL Server, including Azure SQL and AWS RDS.
Keep it that way in CI
The free querymoat-check fails the build when a config would let an agent write to a remote database, or when a password is committed to the repo.
- uses: actions/checkout@v4
- uses: heysidhant/[email protected]Pricing
Everything that keeps your data safe is free, for good. Pro adds control over what agents do and a record of what they did. Pay once; no subscription.
| Feature | Free$0For every developer | Pro$14.99 onceFor one developer |
|---|---|---|
| MCP server for Claude Code, Cursor, Windsurf and Copilot | Included | Included |
| Agents read your schema and data | Included | Included |
| Read-only guard, with remote and production databases locked | Included | Included |
| Database client: data grid, SQL editor, EXPLAIN, export | Included | Included |
| CI check for your config | Included | Included |
| Run read-only stored procedures in a rolled-back sandbox (SQL Server) | No | Included |
| Audit log: every agent query, which rule allowed or blocked it, and where that rule came from | No | Included |
| Write approval: the agent proposes a change, you review the affected rows and approve it | No | Included |
| Hide personal data such as emails and phone numbers from agents | Your own rules | Automatic |
| SSH tunnels and cloud database sign-in (AWS RDS, Azure) | No | Included |
Launch price: $4.99 for the first 100 developers. Enter code LAUNCH100 at checkout under "Have a discount code?" (the Get Pro button copies it for you). Pay once and keep Pro, including the Pro features we add later. After the first 100, Pro is $14.99.
Team
$6 per user a month, or $59 per user a year, from 3 users. Everything in Pro, plus shared rules your team can't loosen, one audit trail for the whole team, and central licence management. Coming soon; email us to be first.
Questions
Does my data leave my machine?
No. The MCP server runs inside your editor and listens only on 127.0.0.1. Queries go from your machine straight to your database, and QueryMoat collects no telemetry.
What if I want the agent to change data?
You can turn off read-only for agents in your user settings; QueryMoat asks you to confirm in a dialog first, and production databases stay locked regardless. Pro's write approval lets the agent propose a change that you review and approve one at a time.
Was this called QueryDock?
Yes. It's the same extension under a new name. Existing .querydockrc files and AI client configs keep working after you switch.
Is Pro a subscription?
No. Pro for individuals is a one-time payment, and it includes updates and the Pro features we add later. If it isn't right for you, ask for a refund within 14 days. Only the Team plan is billed monthly or yearly. See the refund policy.