Most database servers give an agent SQL and no accountability. Here the reviewable artefact — what was run, what was refused, how long it took — is the thing you keep, and it is shaped for a pull request rather than a screenshot. The approval path is the rough edge: a blocked call shows up in the timeline immediately, but the in-UI allow action is still being finished, so treat a block as a stop rather than a prompt.
A proxy that wraps a database MCP server. It parses the tool calls passing through, checks the SQL against a policy, relays what is allowed, and writes the whole session — inputs, outputs and policy decisions — to a local SQLite file you can read back in a browser.
- Session logs holding the exact SQL and tool calls the agent made, with execution times
- Protective mode on by default: SELECT is allowed, INSERT and UPDATE and DELETE with a WHERE clause need approval, and DROP, TRUNCATE, multi-statement SQL and DELETE without a WHERE are blocked outright
- Warnings that do not block — SELECT without a LIMIT, SELECT *, and result sets approaching the preview cap
- A Control Room in the browser where blocked calls appear in the timeline as they happen
- One-click "Copy for GitHub" produces a collapsible block with the SQL, timing and safety checks, ready to paste into a pull request
- Targets switch from the UI without restarting the agent, so a new database does not mean a new client config
- Export a session as raw JSON trace data or as a readable Markdown log
Install with pipx, choosing the extras for the stores you use — DuckDB and Postgres are supported today, with BigQuery, Snowflake and Databricks listed as coming. The client runs `mantora mcp`; the dashboard is a separate `mantora up` and serves on port 3030. Policy overrides go in a mantora.toml file. Everything stays on the machine — the session store is a local SQLite database.
One command — pipx install "mantora[duckdb,postgres]"