Rather than trusting an agent to stay inside its instructions, what it can reach is decided before it connects — table and column selection, masking rules and row scoping are configured in a UI and enforced on the endpoint. That makes 'give the support team read access to customers without exposing emails' a configuration task rather than a code review. One deployment detail worth getting right on day one: persist the generated secret file, or a container restart invalidates every token you have issued.
A self-hosted control plane between a database and an MCP client. You connect PostgreSQL, MySQL or SQLite, define an access profile — which tables and columns are visible, which columns are masked, which rows are in scope, which auth mode applies — and each profile is served as its own MCP endpoint.
- A profile's MCP endpoint at `http://localhost:4567/mcp/<profile>`, with tools generated from the profile — one per exposed table plus a query tool
- Read-only by construction: queries run under `SET TRANSACTION READ ONLY` and are parameterised only
- PII detection and masking, automatic or by custom rule, globally or per column
- Row-level scoping, so a profile can be restricted to rows matching a condition
- A write queue with an approval workflow, for the cases where mutation is needed
- Per-profile authentication — open, bearer token, password, OIDC SSO, OAuth 2.1 with dynamic client registration, or an external validation URL — with per-user tokens, revocation and a full exportable audit log
- A built-in chat for querying without an external client, backed by Anthropic, OpenRouter, or any OpenAI-compatible endpoint including a local Ollama
- A knowledge base that indexes document sources with on-device embeddings by default, so nothing leaves the machine
You host it. `git clone`, `pnpm install`, `pnpm dev`, then open `http://localhost:4567` and create the admin account — or `docker compose up`. Published as calame version 0.6.0. On first run it generates a `CALAME_SECRET_KEY` used to encrypt tokens and connection strings and writes it to `.calame-secret`; under Docker, mount a persistent volume on `/data` or every restart invalidates your saved tokens. You can set `CALAME_SECRET_KEY` yourself to reuse an existing secret. Optional SSH tunnelling covers remote databases; HashiCorp Vault integration and Caddy and nginx templates are included. Dual-licensed: Apache 2.0 for the main tree, BUSL 1.1 for the `ee/` directory holding the SSO implementation.
One command — docker compose up