Hawk AI MCP Server™ · Setup & integration
Connect an AI agent in four steps
Point any MCP-compatible agent at the Hawk AI MCP Server and it can query your data through DBHawk’s governed tools — under the same access control, masking, read-only limits, and audit as your people.
Setup
Step by step
Enable the MCP server
01
In the DBHawk admin console, turn on the Hawk AI MCP Server and select which data sources it may expose. Everything stays behind your existing access model.
Create a scoped token & role
02
Issue a token bound to a role that defines exactly what the agent can reach — data sources, objects, columns — and set it
read-only unless writes are explicitly needed.Connect your agent
03
Configure your MCP-compatible assistant or agent with the MCP endpoint URL and the token. It discovers the available governed tools automatically.
Run & monitor
04
The agent calls tools like
run_query; every call passes through access control, masking and read-only checks, and is written to the audit trail — visible in DBHawk and your SIEM.Reference
Governed tools available to agents
list_datasources
Discover permitted connections
list_schemas · list_objects
Explore permitted schema
list_columns
Inspect table structure
run_query
Execute governed, masked SQL
text_to_sql
Turn intent into SQL
format_sql · optimize_sql
Clean & tune queries
Before you go live
Security checklist
Scope the token to only the data sources and objects the agent needs.
Default to read-only; enable writes only for specific, reviewed use cases.
Confirm masking policies apply to the agent’s role.
Stream the audit log to Datadog, Splunk, or your database.
Set a rotation/revocation plan for agent tokens.
FAQ
MCP setup — questions
Which agents and clients are supported?
Any MCP-compatible AI assistant or agent framework can connect. It speaks the Model Context Protocol and discovers DBHawk's governed tools on connection.
Do I need to expose my database to the agent?
No. The agent talks only to the MCP server, never directly to the database. DBHawk brokers the connection using your vaulted credentials and enforces policy on every call.
Can I limit which data sources an agent sees?
Yes — the token's role defines exactly which data sources, objects and columns are in scope, and whether the agent is read-only.
Where do I see what the agent did?
Every tool call is recorded in DBHawk's audit trail — agent identity, token, query, policy applied and result — and can stream to your SIEM.
Want help wiring up your first agent?
We'll set up the MCP server, scope a token, and connect a governed agent with you in a live session.