Bearer-only MCP
Every JSON-RPC POST requires Authorization: Bearer <token>. Unauthenticated calls are rejected.
Security
How DB Query Guard protects paid MCP access
The remote endpoint is intentionally narrow: bearer auth is required, GET requests return JSON 405, tokens are issued once after payment, and usage logs avoid raw SQL secrets or DSNs.
One-time token claim
Checkout creates an order and claim code. After payment confirmation, the token is shown once and only the prefix is retained in status responses.
Safe usage logging
Logs capture method, tool, query hash, verdict, status, duration, plan, and short order/token summaries. Full bearer tokens, raw DSNs, and secrets are not stored.
Fixed tool surface
The endpoint exposes only the six database query guard tools listed in the server-card and does not provide arbitrary write SQL, shell, deployment, or deletion tools.