Supported Databases
DBBat ships with five independent listeners — one per wire protocol family. Enable only the engines you need by setting the matching DBBLISTEN* variable; an empty value disables that proxy.
Access Control
DBBat provides fine-grained access control through grants. A grant gives a user permission to access a specific database for a limited time, under the rules of the grant definition it was issued from.
Grant Requests & Auto-Approval
Grants can be created directly by an admin, but that puts an admin in the loop for every access. The request workflow lets users ask for access themselves, against templates an admin has pre-approved — and, when the shape of access is routine enough, skip the approval step entirely.
Query Logging
DBBat logs every query or command executed through the proxy — across all supported engines (PostgreSQL, Oracle, MySQL, MariaDB, MongoDB, SQL Server) — providing complete visibility into database activity.
User Management
DBBat maintains its own user database, separate from target database users. This separation provides:
Session Packet Captures
DBBat can write per-session packet captures of every proxied connection. The capture records the post-auth byte stream between client and upstream, which is invaluable for protocol-level debugging, replay testing, and forensic analysis.
SSH Tunnels
Not every database is reachable from wherever DBBat runs. Production databases commonly sit in a private subnet with no route from outside the VPC, fronted by a bastion host.
AI Agents (MCP)
Give Claude Code, Claude Desktop or any MCP client governed access to your databases — scoped to a grant, time-boxed, every query logged, and a human in the loop on the statements that matter.
Tamper-Evident Audit Log
DBBat HMAC-chains its audit log, query history and captured result rows, so modifying, deleting or reordering a record is detectable with dbbat audit verify.