DBBat - Database Observability Proxy

🔌

Multi-Engine Proxy

PostgreSQL, Oracle, MySQL/MariaDB, MongoDB, and SQL Server on independent listeners. Connect any standard client — psql, sqlplus, mysql, mongosh, sqlcmd, DBeaver, your ORM — without application changes.

🔍

Query Observability

Track every query with full SQL text, parameters, execution time, rows affected, and optional result-data capture. Text and binary protocols decoded the same way.

🔐

Granular Access Control

Time-windowed grants with combinable controls — read_only, block_copy, block_ddl — plus per-grant quotas on queries and bytes transferred.

👥

User & API Key Management

Local users with admin, viewer, and connector roles. Optional Slack sign-in. API keys for programmatic access — and they cannot create or revoke other keys.

🛡️

Secure by Design

Passwords and API keys hashed with Argon2id, database credentials encrypted with AES-256-GCM and bound to the database UID. Every administrative change lands in an HMAC-chained audit log, so tampering with it is detectable.

🧱

Defense in Depth

Read-only enforced via SQL inspection and engine-level session flags. MySQL LOCAL INFILE opted out of the upstream capabilities. PostgreSQL session bypass attempts blocked.

📼

Session Packet Dumps

Optional per-session binary capture of the post-auth command stream. Same .pcapng format across all protocols, with a CLI anonymiser for safe sharing.

🌐

REST API + Web UI

Full OpenAPI 3.0 spec served at /api/docs. React frontend embedded in the binary at /app for managing users, databases, grants, and browsing query history.

📦

Single Binary

One Go binary backed by PostgreSQL. Distroless Docker image, Helm chart, Kubernetes-friendly. Stateless beyond its store — replicas welcome.

See it in action

Real captures from a live instance — the query log, the access requests, and a write held for a second pair of eyes, whether a person or an AI agent issued it.

Four eyes on a write. An UPDATE matching the grant's approval pattern is parked mid-flight — the client sits there waiting — until a second person releases it. Self-approval is rejected.

The Queries page listing five statements with user, database, connection, duration, row count and status — **Every query, tracked**Full SQL text, the user behind it, the connection it ran on, its duration and its row count — for every statement that crosses the proxy.

A query detail page showing the SQL, its duration, its row count and the ten result rows it returned — **Down to the rows returned**Open a statement to see what it actually did, optional captured result rows included.

The Request access dialog with a grant definition, a database and a written justification — **Access on request**A developer picks a grant definition and a database and says why. An admin approves or denies — from the UI or straight from Slack.

The Add Server dialog configuring a PostgreSQL read replica — **One proxy, five engines**Point DBBat at PostgreSQL, Oracle, MySQL/MariaDB, MongoDB or SQL Server. Credentials are encrypted at rest; clients never see them.

An AI agent's UPDATE parked awaiting approval, with the agent's MCP transcript showing the approval_pending result it got back — **AI agents, on the same leash**An agent's statement runs through the same proxy a human's does — so a write it did not think through freezes mid-flight and waits for a person, and the agent is told so rather than timing out.

Captured on v0.23.2 · 10 August 2026. The media is regenerated on demand, so a newer release may look a little different.

Ready for the compliance conversation

Every session is attributed to a person, every statement is logged, access is time-boxed, and risky statements wait for a second pair of eyes. That is the substance behind a SOC 2, ISO 27001 or PCI DSS control narrative — so we wrote down exactly which controls it maps to, and exactly which ones it does not.

DBBat is a control you deploy, not a certificate you inherit.

Read the compliance mapping

Quick Start

Get DBBat running in seconds with Docker — one container fronts PostgreSQL, Oracle, MySQL/MariaDB, MongoDB, and SQL Server:

docker run
  -p 5433:5433  # PostgreSQL proxy
  -p 1522:1522  # Oracle proxy
  -p 3307:3307  # MySQL / MariaDB proxy
  -p 27018:27018  # MongoDB proxy
  -p 1434:1434  # SQL Server proxy
  -p 4200:4200  # REST API + web UI
  -e DBB_DSN=postgres://dbbat:dbbat@pgserver:5432/dbbat
  ghcr.io/fclairamb/dbbat

View full installation guide