live wire
▸Snowflake agent evals can pin judge versions; unpinned metrics may roll forward and shift scoresSnowflake▸ThoughtSpot makes Spotter 3 default for new instances; it requires download rights and always shares query data with an LLMThoughtSpot documentation▸MotherDuck adds image classification and object location to prompt_jev(), returning typed SQL outputs with confidence scoresMotherDuck▸BigQuery conversational analytics adds Montréal and Toronto; mixed-region agents still default to globalGoogle Cloud Documentation▸Fabric enables Azure OpenAI Copilot access by default, but OpenAI-subprocessor and cross-region processing/storage switches remain offMicrosoft Learn▸Snowflake Cortex Agents now continue by default when named tools are inaccessible, emitting warnings instead of failing the runSnowflake documentation▸Databricks Genie One can use group memberships to tailor answers, while Unity Catalog remains the access-control boundaryDatabricks documentation▸Fabric data agents can query Power BI models with Read alone; Build and workspace access are unnecessaryMicrosoft Learn▸Fabric data-agent Git configs expose column flags, but selecting a table still includes every columnMicrosoft Learn▸Google Data Agent Kit offers remote Spark kernels, but notebook exports can still move results into local Pandas or ArrowGoogle Cloud Documentation▸Cube says production analytics agents need explicit partial-result states, caller-filtered model search and durable artifactsCube▸Thinking Machines names Bridgewater behind ReViSQL-K2.6, citing 92.97% SC-16 accuracy at 15% of frontier-model costThinking Machines Lab▸AWS says a mismatched data/tool/prompt release cut its Field Sales agent pass rate from 78% to 38% in pre-productionAWS Artificial Intelligence Blog▸NL2SQL Multi-Agent ships evaluation artifacts across BIRD, CSpider, Archer and KDD DataSpace—but no software licenseGitHub▸Snowflake agent evals can pin judge versions; unpinned metrics may roll forward and shift scoresSnowflake▸ThoughtSpot makes Spotter 3 default for new instances; it requires download rights and always shares query data with an LLMThoughtSpot documentation▸MotherDuck adds image classification and object location to prompt_jev(), returning typed SQL outputs with confidence scoresMotherDuck▸BigQuery conversational analytics adds Montréal and Toronto; mixed-region agents still default to globalGoogle Cloud Documentation▸Fabric enables Azure OpenAI Copilot access by default, but OpenAI-subprocessor and cross-region processing/storage switches remain offMicrosoft Learn▸Snowflake Cortex Agents now continue by default when named tools are inaccessible, emitting warnings instead of failing the runSnowflake documentation▸Databricks Genie One can use group memberships to tailor answers, while Unity Catalog remains the access-control boundaryDatabricks documentation▸Fabric data agents can query Power BI models with Read alone; Build and workspace access are unnecessaryMicrosoft Learn▸Fabric data-agent Git configs expose column flags, but selecting a table still includes every columnMicrosoft Learn▸Google Data Agent Kit offers remote Spark kernels, but notebook exports can still move results into local Pandas or ArrowGoogle Cloud Documentation▸Cube says production analytics agents need explicit partial-result states, caller-filtered model search and durable artifactsCube▸Thinking Machines names Bridgewater behind ReViSQL-K2.6, citing 92.97% SC-16 accuracy at 15% of frontier-model costThinking Machines Lab▸AWS says a mismatched data/tool/prompt release cut its Field Sales agent pass rate from 78% to 38% in pre-productionAWS Artificial Intelligence Blog▸NL2SQL Multi-Agent ships evaluation artifacts across BIRD, CSpider, Archer and KDD DataSpace—but no software licenseGitHub
nl2sql.ai
releaseRelease

LibreDB Studio’s new MCP server makes read-only a database property—not a prompt promise

Version 0.17.0 exposes selected database connections to AI clients, but puts enforcement, auditability and hard limits below the model layer.

By The Tools Desk· Sep 27, 2026the quick take — two AI hosts go live when you do

LibreDB Studio 0.17.0 adds an opt-in Model Context Protocol server for AI clients including Claude Code, Codex, Cursor, VS Code, Gemini CLI and OpenCode. The important part is not merely that another database tool now speaks MCP. It is where LibreDB places the safety boundary: below the model, in database permissions and server-side controls. LibreDB Studio 0.17.0 release notes

Three tools, deliberately narrow

The MCP endpoint exposes three tools: connection listing, schema inspection and a bounded read-query operation. Query execution is limited to PostgreSQL, SQLite, DuckDB and SQL Server, while connection and schema inspection work across all supported engines. Results default to 100 rows, cannot exceed 500 rows or 32 KiB, and include pagination information when truncated. LibreDB Studio 0.17.0 release notes

LibreDB does not describe read-only safety as a SQL keyword filter. PostgreSQL uses a read-only transaction; SQLite and DuckDB use read-only opens; SQL Server requires a login that cannot write. PostgreSQL and SQL Server connections therefore need least-privilege credentials before the query tool will accept them. That design matters because generated SQL can evade shallow string filters even when the prompt says “SELECT only.” LibreDB Studio 0.17.0 release notes

Access is explicit—and auditing can stop execution

MCP is disabled until an operator enables it, and only seed connections marked for MCP are visible. Visibility is further filtered by the caller’s role. Users mint bearer tokens that are shown once and expire after 30 days by default; browser session cookies do not authorize the MCP route. The release does not include OAuth, so deployments must manage static bearer-token distribution and rotation. LibreDB Studio 0.17.0 release notes

Every tool call is written as an audit event before database access. If that audit write fails, the database call does not run. Origin, host and token refusals are also logged, while JSON-RPC batches are rejected. This turns the audit trail from optional observability into part of the execution gate. LibreDB Studio 0.17.0 release notes

The limits are as useful as the launch

LibreDB reports live checks with its SDK client, Claude Code and OpenCode across PostgreSQL, SQL Server, SQLite, DuckDB and LibreDB; configurations for Codex, Cursor, VS Code and Gemini CLI are documented but were not measured. Cancellation only stops Studio waiting, not necessarily the database statement, and long SQLite queries can block the whole Node process because the driver is synchronous. Those caveats make this a bounded administrative surface, not a blanket claim that connecting an agent is safe. LibreDB Studio 0.17.0 release notes

For operators evaluating database MCP servers, 0.17.0 offers a concrete checklist: explicit connection opt-in, role filtering, expiring credentials, database-native read-only enforcement, response caps and fail-closed audit logging. The remaining question is operational: whether static-token handling, cancellation behavior and single-process limits fit the deployment’s threat model.

sources

Filed by The Tools Desk. Corrections: desk@nl2sql.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk