What is an AI agent gateway?
Updated · DBShifts
Short answer
An AI agent gateway is a control point between AI agents and the systems they read from. Instead of database credentials, each agent gets a scoped token. The gateway checks every request against your policy — which tables and columns, PII masking, volume limits — records it, and only then returns data.
Key facts
- An AI agent gateway replaces database credentials with scoped, revocable tokens, one per agent.
- It enforces policy on the server, so the rules hold whatever the model decides to ask for.
- It usually exposes structured tools, often over the Model Context Protocol (MCP), instead of a raw query interface.
- It records every request, so you can answer what an agent saw and when.
- It plays the role an API gateway plays for services, except the payload is your data.
Why AI agents need one
An agent reads query results straight into the context the model reasons over. Give it a connection string and it can reach every table that database user can see, with nothing recording which rows it actually read.
The alternatives do not scale either. A hand-built API per agent has to be rewritten for every new agent and every schema change, and a security team cannot sign off on access it cannot audit. A gateway turns that into configuration: one policy, enforced the same way for every agent.
What a gateway checks on every request
Identity: is the token valid, unexpired, unrevoked and, if bound, coming from an allowed address. Scope: is this table and column on the allowlist for this agent. Protection: are sensitive values masked before they leave. Volume: is the request inside its row cap, rate limit and usage budget. Content: does the returned data carry instructions aimed at the model. Record: write it all down.
A gateway versus a read-only database user
A read-only user stops writes. It does not mask a customer's email per agent, cap how much of a table an agent reads over a month, scan rows for prompt injection, or tell you which rows one particular agent received. Use both: the read-only user is the ceiling, and the gateway narrows it per agent.
Checklist
- 1
Default-deny table and column allowlists, set per agent
- 2
PII masked on the server, including in filters and aggregates
- 3
One token per agent, revocable on its own
- 4
Row caps, rate limits and cumulative usage budgets
- 5
An audit log of every request, including the refused ones
- 6
A way to stop one agent immediately
Common mistakes
Treating the system prompt as a security boundary
Telling a model not to read a column does not stop it. Rules belong in the server that returns the data, where the model cannot talk its way around them.
One shared token for every agent
When every agent uses the same credential, you cannot tell them apart in the log or stop one without stopping all of them.
Masking that can still be filtered
If an agent can put a masked column in a WHERE clause, row counts reveal the value one character at a time without the column ever being returned.
How DBShifts does it
- DBShifts Agent Gateway is an AI agent gateway for PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLite and MongoDB.
- Agents connect over MCP or REST with a scoped agt_ token and get 26 structured tools; none of them accepts raw SQL.
- Every request passes table and column allowlists, server-side PII masking, row caps, rate limits and usage budgets, and the returned rows are scanned for prompt injection.
- Every request is written to an audit log, and a tamper-evident ledger with signed anchors lets you show later that the history was not edited.
Questions people also ask
Is an AI agent gateway the same as an MCP server?
No. An MCP server is an endpoint that exposes tools in a standard protocol. A gateway is the policy layer that decides what each agent may do and records what it did. A gateway can speak MCP — DBShifts does — but MCP alone does not enforce anything.
Do I still need database permissions if I use a gateway?
Yes. Give the gateway its own read-only database user. That user is the ceiling; the gateway narrows access further for each agent.
Related questions
Give AI agents data access you can defend
Scoped tokens, PII masked on the server, every request audited. Free to start.
Start free18 answers in this series. See all.