list_tablesLABSCO SUMMARY
The generated API is the security boundary.
Handing an agent a raw SQL connection means the schema is the permission model. Here the LLM writes a named set of endpoints once, at build time, and that file is what gets served — you can read it, edit it and commit it before anything runs. The plugin layer is what makes it deployable rather than a demo: PII redaction and Lua row-level security both execute in the gateway, so the model receives filtered data instead of being asked to behave. Raw mode is there when you want exploration instead, and its validate-before-execute step is a sensible middle ground.
What it is
A Go binary that reads your database schema, samples the data, and uses an LLM to generate an API configuration — a gateway.yaml describing endpoints per table. It then serves that configuration as an MCP server or as REST with OpenAPI. There is also a raw mode that skips generation entirely.
What you get
- Generated mode: a tool per generated endpoint, written from your actual schema and sample data rather than from a generic query interface
- Raw mode, started with --raw, which gives four tools instead: list the tables, examine their structure with samples, validate a SQL query and see its output schema before running it, then execute it
- PostgreSQL, MySQL, ClickHouse, Snowflake, MSSQL, BigQuery, Oracle, SQLite and Elasticsearch
- Three ways to serve the same configuration — REST with auto-generated Swagger and an OpenAPI 3.1.0 spec, MCP over SSE, or MCP over stdio for a desktop client
- PII redaction before data leaves the gateway, through a regex plugin or Microsoft Presidio
- Row-level security written as Lua scripts, so which rows a caller sees is decided at the gateway rather than trusted to the model
- API keys or OAuth in front of it, OpenTelemetry behind it for request tracking and an audit trail, and time-based or LRU caching
- Generation can run on OpenAI, Anthropic, Amazon Bedrock, Google Gemini or Vertex AI — or on a self-hosted model, so your schema need not leave your network
Requirements
A single Go binary — build it with go build or take a release, and run it in Docker or Kubernetes if you prefer. Database credentials, and an LLM provider for the generation step only; once gateway.yaml exists, serving it needs no model. Configuration supports ${VARIABLE_NAME} substitution so secrets stay out of the file. Start it with ./gateway start --config gateway.yaml, adding --raw for raw mode, mcp-stdio for a desktop client, or --addr to move it off the default port.
Setup effort
One command plus a key — docker run --platform linux/amd64 -p 9090:9090 ghcr.io/centralmind/gateway:v0.2.18 start --connection-string "postgres://db-user:db-password@db-host/db-name?sslmode=require", then supply credentials
USE CASES
01
Giving an agent access to a production database without giving it SQL
Generate the API from the schema, review the endpoints it wrote, and serve only those.
02
Letting people ask questions of data that contains personal information
Put the redaction plugin in front so identifiers never reach the model.
03
Different users needing to see different rows
Write the row-level rule as a Lua script in the gateway rather than trusting the query.
04
Exploring a database you do not know yet
Run in raw mode, list the tables, sample them, and validate the query before you run it.
05
Serving the same data to an agent and to an application
Run one configuration as both MCP and REST, with the OpenAPI spec generated for you.
06
Keeping the schema inside your network
Point the generation step at a self-hosted model instead of a hosted provider.
4 tools
Listed in project docs. Your client may show a different list.
discover_dataprepare_queryqueryBEFORE YOU INSTALL
What to know first
Tools you get
4 tools named in the project's documentation. These four are raw mode's tools, started with --raw (the project's Cursor guide reaches it over SSE at http://localhost:9090/sse). The Claude Desktop block runs generated mode (mcp-stdio), which gives one tool per endpoint in your gateway.yaml instead.
Requires
- The gateway binary — a release download, the Docker image or go build
- Credentials for the database you connect it to
- For the discovery step that writes gateway.yaml: a key for one AI provider (Gemini, OpenAI, Anthropic, Amazon Bedrock or Vertex AI); serving the file needs none
Where it runs
Both documented clients run the server on your machine.
INSTALLATION
Connect your client
Server setup
Setup
Install the binary — download the release archive for your OS from https://github.com/centralmind/gateway/releases (for example gateway-linux-amd64.tar.gz), extract it, rename it to gateway and chmod +x gateway; or docker pull ghcr.io/centralmind/gateway:v0.2.18; or build from source with git clone https://github.com/centralmind/gateway.git, cd gateway, go mod download, go build -o gateway
Get an AI provider key — this is required for the discovery step only. For Google Gemini: export GEMINI_API_KEY='<YOUR_GEMINI_API_KEY>' (OpenAI, Anthropic, Amazon Bedrock and Google Vertex AI are also supported)
Run discovery against your database to GENERATE the config; this must happen before any MCP mode will work: ./gateway discover --ai-provider gemini --connection-string "postgresql://<YOUR_DB_USER>:<YOUR_DB_PASSWORD>@localhost:5432/<YOUR_DB_NAME>" --prompt "Develop an API that enables a chatbot to retrieve information about data." — it writes gateway.yaml
Review/edit the generated gateway.yaml
Run it. Generated-API MCP over stdio: ./gateway start --config gateway.yaml mcp-stdio (this is the form the Claude Desktop config block uses). Raw SQL MCP mode: ./gateway start --config gateway.yaml --raw. REST + MCP SSE server: ./gateway start --config gateway.yaml, which serves SSE at http://localhost:9090/sse and Swagger at http://localhost:9090/
Shortcut that skips discovery entirely — run straight from Docker against a connection string: docker run --platform linux/amd64 -p 9090:9090 ghcr.io/centralmind/gateway:v0.2.18 start --connection-string "postgres://db-user:db-password@db-host/db-name?sslmode=require"
docker
TERMINAL
docker run --platform linux/amd64 -p 9090:9090 \
ghcr.io/centralmind/gateway:v0.2.18 start \
--connection-string "postgres://db-user:db-password@db-host/db-name?sslmode=require"MCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"gateway": {
"command": "<YOUR_PATH_TO_GATEWAY_BINARY>",
"args": [
"start",
"--config",
"<YOUR_PATH_TO_GATEWAY_YAML_CONFIG>",
"mcp-stdio"
]
}
}
}<YOUR_PATH_TO_GATEWAY_BINARY> is the full path to the gateway binary, and <YOUR_PATH_TO_GATEWAY_YAML_CONFIG> is the gateway.yaml that the discover step wrote. The AI provider key is used only by discover; this server does not need it.
Cursor
CURSOR · JSON
{
"mcpServers": {
"gateway": {
"command": "<YOUR_PATH_TO_GATEWAY_BINARY>",
"args": [
"start",
"--config",
"<YOUR_PATH_TO_GATEWAY_YAML_CONFIG>",
"mcp-stdio"
]
}
}
}The project's Cursor guide adds this as a command server: <YOUR_PATH_TO_GATEWAY_BINARY> start --config <YOUR_PATH_TO_GATEWAY_YAML_CONFIG> mcp-stdio. <YOUR_PATH_TO_GATEWAY_BINARY> is the full path to the gateway binary, and <YOUR_PATH_TO_GATEWAY_YAML_CONFIG> is the gateway.yaml the discover step wrote. To use raw mode over SSE instead, start ./gateway start --config gateway.yaml --raw and add http://localhost:9090/sse as an SSE server.
