How do I use MCP with a database without exposing credentials?

Asking an AI to help with a database usually means copying something into the chat: a table schema, a query that is not working, or the result of a statement. It looks harmless. That habit can still expose production data, personal information, and other details you may not have meant to share.

Using an MCP server does not remove that risk on its own. If the agent needs the database credentials, you are only changing how they get shared.

Kerry Studio takes a different approach. Its MCP server runs locally and lets desktop AI clients such as Claude Desktop, ChatGPT, Gemini, Conductor, and Cursor work with the connections you already configured in the app. Credentials stay in Kerry. They do not need to be given to the assistant.

That does not mean queried data never reaches the AI. The assistant receives what it needs to do the work: project, environment, database type, database name, schema, and query results. If you use a cloud model, the AI client can send that information to the model provider. Kerry Studio does not send it to Sireeus servers.

You also control what the assistant can do. Access is read-only by default. You can limit which projects and environments are available and, if you need changes, turn on full mode and allow Insert, Update, or Delete. The mcp.log file records the requests the assistant sends to the server and the replies Kerry returns.

There is an important limit: when the assistant queries the database, the schema and up to 500 rows of each result have to reach the AI client so the model can analyze them. Do not grant access to environments or data the assistant should not see, and use only AI clients you trust.

The idea is simple: give the AI controlled access to your databases without handing it the connection credentials. You keep the passwords in Kerry Studio and decide which data and operations the assistant can use.

How to enable the server

The MCP panel does not appear on the workspace picker. Open a workspace.

1. In the right sidebar, click the MCP Server icon. The footer (MCP enabled / MCP disabled) and the palette (⌘K / CtrlK) → Open MCP Panel do the same.
2. Turn on Enable MCP server.
3. Click Copy JSON and paste it into the client’s MCP settings.
4. Restart the client if it does not reload servers on its own.

The default address is http://127.0.0.1:18765/mcp. Use 127.0.0.1, never localhost. Kerry only accepts 127.0.0.1. Copy JSON uses the current port and the real token. Do not use the sample YOUR_TOKEN.

{
  "mcpServers": {
    "kerry-studio": {
      "url": "http://127.0.0.1:18765/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN"
      }
    }
  }
}

By default the server does not come back on when you quit and reopen Kerry Studio. In Settings → MCP, On app launch → Start with the server on changes that.

Start in read-only

By default the server stays in read-only. The assistant lists connections, reads schema, and runs read queries: SELECT, SHOW, DESCRIBE, EXPLAIN (including ANALYZE on a SELECT). INSERT, UPDATE, DELETE, SELECT … FOR UPDATE, SELECT INTO, INTO OUTFILE, and WITH queries that change data are refused.

Read-only already opens the database in the assistant’s session. Without that there is no schema and no SELECT. Kerry’s SQL tabs do not need to be connected.

Force read-only when starting the server (on by default) keeps the Read-only mode switch checked and locked whenever the server starts.

Limit what the assistant can access

With no restriction, every saved connection is available to the assistant. The default is all projects and environments. Permissions changes that.

Open Permissions from Configure on the MCP panel, in Settings → MCP, or in the palette under MCP Permissions.

Read-only and read-write have their own lists. You can let read mode see the catalog and, in full mode, allow only some projects. Turn off Allow all projects and environments when you want to pick project by project.

If the project is not on the list in use, Kerry does not open the connection for the assistant. A query with @alias, for example @billing.orders, is also blocked if that connection is not reachable.

How to ask by project and environment

Name the project and the environment, not only the database type. Otherwise the assistant picks the wrong connection or asks again.

Examples:

• “in the billing project, Development environment, list the tables”
• “in Billing / Development, which columns does public.products have?”

SQL without @alias runs in a separate session: it does not change the tab or the Entities bar. SQL with @alias uses the active SQL tab, which needs to be connected to that project and environment.

Check what was written to mcp.log

In Kerry Studio, the mcp.log file records each exchange with the assistant. REQUEST is what the assistant sent, including the SQL. RESPONSE is what Kerry returned. Open the file from the Observability header on the MCP panel.

By default Kerry hides passwords, tokens, authorization, and private keys in the file and in the response. Emails disappear only in the file. Connection strings, host, user, and path disappear only in the response to the assistant. If a column from your database still shows the real value in the RESPONSE, add the field under Redacted values.

In the Observability section, each card is an app connected to Kerry. The trash can (Drop connection) ends that app.

Each control is documented in Local MCP server.