Use more than a read-only password.
A database role with SELECT permission is the foundation, but it is not the complete boundary. AI database access also needs controls around destination, identity, visible schemas, query shape, execution time, and returned data.
Controls Data Connector applies
- Public TLS endpoints with hostname verification.
- Rejection of private, loopback, link-local, reserved, and cloud-metadata destinations.
- Loam account, workspace membership, and source policy checks on each MCP request.
- Optional PostgreSQL schema allowlists.
- Read-only transactions plus statement, row, and response-size limits.
- Server-side encrypted credentials that are never returned to Claude.
Your part of the boundary
Create a dedicated database role, grant only the schemas and tables required, rotate its password, and review the data those tables expose. Avoid owner, application-write, and migration credentials.
Connect through MCP
Add https://dataconnector.ai/api/mcp to Claude as a custom connector, then authorize the intended Loam workspace.
Frequently asked questions
Is a SELECT-only database role enough?
It is the foundation. You should also limit visible schemas and tables, require TLS, and bound query time and returned rows.
Can Claude see every table in my PostgreSQL database?
Only tables allowed by the database role and the source policy are available for discovery and querying.
Where is the PostgreSQL password stored?
Loam encrypts it in the selected data region. The password is write-only and is not returned to the browser or Claude.