--- title: Databend MCP: Production Read-Only + Sandbox... description: Databend MCP introduces a security architecture combining production read-only access with per-session sandbox environments for AI-driven data operations. AI... canonical: https://daily.dev/posts/databend-mcp-production-read-only-sandbox-verification-for-safe-ai-data-operations-ydfrfhyvy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Databend MCP: Production Read-Only + Sandbox Verification for Safe AI Data Operations | daily.dev og:description: Databend MCP introduces a security architecture combining production read-only access with per-session sandbox environments for AI-driven data operations. AI... og:url: https://daily.dev/posts/databend-mcp-production-read-only-sandbox-verification-for-safe-ai-data-operations-ydfrfhyvy og:image: https://api.daily.dev/og/posts/ydFrFHYVy.png og:image:alt: Databend MCP: Production Read-Only + Sandbox Verification for Safe AI Data Operations og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Databend MCP: Production Read-Only + Sandbox Verification for Safe AI Data Operations **[Databend Blog](https://daily.dev/sources/databend)** · 4 min read · 0 upvotes · 0 comments ## Summary Databend MCP introduces a security architecture combining production read-only access with per-session sandbox environments for AI-driven data operations. AI agents can only run read commands (SELECT, SHOW, DESCRIBE, EXPLAIN, LIST) against production objects, while all write operations (CREATE, INSERT, UPDATE, DELETE, etc.) are restricted to an isolated namespace prefixed with mcp_sandbox_{session_id}_. This lets agents build, test, and verify ETL logic, temporary tables, and SQL correctness without risking production data. The tool ships with utilities like execute_sql, create_stage, and sandbox database management, and integrates with Codex CLI, Claude Code CLI, and Cursor via a simple DSN configuration. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Databend MCP prevent an AI agent from writing to production data? It enforces a production read-only policy where only SELECT, SHOW, DESCRIBE, EXPLAIN, and LIST are permitted on production objects, while write operations like CREATE, INSERT, UPDATE, DELETE, and TRUNCATE are restricted exclusively to a per-session sandbox namespace prefixed with mcp_sandbox_{session_id}_, blocking any attempt to modify production data. _Teams wiring AI agents into production databases can track safety patterns like this via daily.dev._ ### What tools does the mcp-databend server expose for AI agents to interact with a database? It exposes tools including execute_sql, execute_multi_sql, show_databases, show_tables, describe_table, show_stages, list_stage_files, create_stage, show_connections, get_session_sandbox_prefix, list_session_sandbox_databases, and create_session_sandbox_database, covering schema discovery, SQL execution, and sandbox resource management. _Developers evaluating MCP server tooling for data agents can follow releases like this on daily.dev._ ## Similar posts on daily.dev - [Your database is about to become an AI tool. Is it ready?](https://daily.dev/posts/your-database-is-about-to-become-an-ai-tool-is-it-ready--jdwwvjydr) · The New Stack · 0 upvotes · 0 comments - [Give Your Agent Write Access](https://daily.dev/posts/give-your-agent-write-access-wxmvt2mis) · MotherDuck · 3 upvotes · 0 comments - [DBmaestro MCP Server Puts Natural Language in Control of Database Pipelines](https://daily.dev/posts/dbmaestro-mcp-server-puts-natural-language-in-control-of-database-pipelines-tx3aumpiw) · InfoQ · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#data-warehouse](https://daily.dev/tags/data-warehouse) [View this post on daily.dev](https://daily.dev/posts/databend-mcp-production-read-only-sandbox-verification-for-safe-ai-data-operations-ydfrfhyvy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Databend MCP: Production Read-Only + Sandbox Verification for Safe AI Data Operations","url":"https://daily.dev/posts/databend-mcp-production-read-only-sandbox-verification-for-safe-ai-data-operations-ydfrfhyvy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/databend-mcp-production-read-only-sandbox-verification-for-safe-ai-data-operations-ydfrfhyvy"},"datePublished":"2026-08-16T08:53:58.371Z","dateModified":"2026-08-16T08:57:28.785Z","description":"Databend MCP introduces a security architecture combining production read-only access with per-session sandbox environments for AI-driven data operations. AI...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2ed873ac2dac6115091589896e315908?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2ed873ac2dac6115091589896e315908?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Databend Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Databend Blog","logo":"https://media.daily.dev/image/upload/s--Vkqa36Ma--/f_auto,q_auto/v1786870423/logos/databend?_a=BAMAMicg0","url":"https://daily.dev/sources/databend"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/databend-mcp-production-read-only-sandbox-verification-for-safe-ai-data-operations-ydfrfhyvy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,mcp,data-warehouse","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Databend Blog","item":"https://daily.dev/sources/databend"},{"@type":"ListItem","position":3,"name":"Databend MCP: Production Read-Only + Sandbox Verification for Safe AI Data Operations"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/databend-mcp-production-read-only-sandbox-verification-for-safe-ai-data-operations-ydfrfhyvy#faq","mainEntity":[{"@type":"Question","name":"How does Databend MCP prevent an AI agent from writing to production data?","acceptedAnswer":{"@type":"Answer","text":"It enforces a production read-only policy where only SELECT, SHOW, DESCRIBE, EXPLAIN, and LIST are permitted on production objects, while write operations like CREATE, INSERT, UPDATE, DELETE, and TRUNCATE are restricted exclusively to a per-session sandbox namespace prefixed with mcp_sandbox_{session_id}_, blocking any attempt to modify production data. Teams wiring AI agents into production databases can track safety patterns like this via daily.dev."}},{"@type":"Question","name":"What tools does the mcp-databend server expose for AI agents to interact with a database?","acceptedAnswer":{"@type":"Answer","text":"It exposes tools including execute_sql, execute_multi_sql, show_databases, show_tables, describe_table, show_stages, list_stage_files, create_stage, show_connections, get_session_sandbox_prefix, list_session_sandbox_databases, and create_session_sandbox_database, covering schema discovery, SQL execution, and sandbox resource management. Developers evaluating MCP server tooling for data agents can follow releases like this on daily.dev."}}]} ```