# DBBat

> Give your developers and AI agents (temporary) access to your PostgreSQL, Oracle, MySQL/MariaDB, MongoDB & SQL Server databases. Every query logged. Every result captured.

DBBat is a transparent database proxy for query observability, access control, and safety across PostgreSQL, Oracle, MySQL/MariaDB, and MongoDB. This file indexes the documentation; see llms-full.txt for the whole thing concatenated into one document.

## Docs
- [Introduction to DBBat](https://dbbat.com/docs/intro): DBBat is a transparent database proxy designed for query observability, access control, and safety.
- [Supported Databases](https://dbbat.com/docs/features/supported-databases): DBBat ships with five independent listeners — one per wire protocol family. Enable only the engines you need by setting the matching DBB_LISTEN_* variable; an empty value disables that proxy.
- [Access Control](https://dbbat.com/docs/features/access-control): DBBat provides fine-grained access control through grants. A grant gives a user permission to access a specific database for a limited time, under the rules of the grant definition it was issued from.
- [Grant Requests & Auto-Approval](https://dbbat.com/docs/features/grant-requests): Grants can be created directly by an admin, but that puts an admin in the loop for every access. The request workflow lets users ask for access themselves, against templates an admin has pre-approved — and, when the shape of access is routine enough, skip the approval step entirely.
- [Query Logging](https://dbbat.com/docs/features/query-logging): DBBat logs every query or command executed through the proxy — across all supported engines (PostgreSQL, Oracle, MySQL, MariaDB, MongoDB, SQL Server) — providing complete visibility into database activity.
- [User Management](https://dbbat.com/docs/features/user-management): DBBat maintains its own user database, separate from target database users. This separation provides:
- [Session Packet Captures](https://dbbat.com/docs/features/session-dumps): DBBat can write per-session packet captures of every proxied connection. The capture records the post-auth byte stream between client and upstream, which is invaluable for protocol-level debugging, replay testing, and forensic analysis.
- [SSH Tunnels](https://dbbat.com/docs/features/ssh-tunnels): Not every database is reachable from wherever DBBat runs. Production databases commonly sit in a private subnet with no route from outside the VPC, fronted by a bastion host.
- [AI Agents (MCP)](https://dbbat.com/docs/features/mcp): DBBat speaks the Model Context Protocol, so an AI agent can query your databases through the same governance every other client goes through: scoped to the caller's grant, time-boxed, every statement logged — and, on the statements you care about, suspended mid-flight until a human approves it.
- [Tamper-Evident Audit Log](https://dbbat.com/docs/features/audit-chain): Logging everything is only half the story. The other half is being able to show that nobody edited the log afterwards — including the person who runs the database it lives in.
- [Compliance](https://dbbat.com/docs/compliance): DBBat holds no SOC 2 report, no ISO/IEC 27001 certificate and no PCI DSS Attestation of Compliance. It is an AGPL-3.0 project you download and run yourself, so there is nothing to inherit.
- [Changelog](https://dbbat.com/docs/changelog): Release history and version changes
- [Performance](https://dbbat.com/docs/performance): DBBat prioritizes observability and security over performance. This is by design—the primary use case is controlled developer access to production data, not high-throughput application workloads.
- [Security](https://dbbat.com/docs/security): DBBat implements multiple security layers to protect both the proxy infrastructure and the target databases.

## Configuration
- [Configuration Overview](https://dbbat.com/docs/configuration): DBBat is configured via environment variables, an optional configuration file (YAML/JSON/TOML), or CLI flags.
- [Server Configuration](https://dbbat.com/docs/configuration/servers): Target servers are configured through the REST API. Each entry maps a DBBat server name to a target (PostgreSQL, Oracle, MySQL, MariaDB, MongoDB, or Microsoft SQL Server), optionally reached through an SSH bastion.
- [Single sign-on (OIDC)](https://dbbat.com/docs/configuration/sso): DBBat ships a generic OpenID Connect provider: point it at your issuer and your engineers sign in with the identity they already have. It works with anything that publishes an OIDC discovery document — Google Workspace, Okta, Microsoft Entra ID, Keycloak, Authentik, Auth0, Ping, Dex.

## Installation
- [Docker Installation](https://dbbat.com/docs/installation/docker): The easiest way to run DBBat is with Docker.
- [Docker Compose](https://dbbat.com/docs/installation/docker-compose): For development and testing, Docker Compose provides an easy way to run DBBat with all dependencies.
- [Binary Installation](https://dbbat.com/docs/installation/binary): You can also run DBBat directly as a binary.
- [Kubernetes Deployment](https://dbbat.com/docs/installation/kubernetes): Deploy DBBat on Kubernetes with a Deployment, Service, and Ingress.

## API
- [API Reference](https://dbbat.com/docs/api): DBBat provides a comprehensive REST API for managing users, databases, grants, and viewing observability data.

## Optional
- [Full documentation text](https://dbbat.com/llms-full.txt): every doc page concatenated into one file
- [GitHub repository](https://github.com/fclairamb/dbbat): source code, issues, releases
- [API Reference](https://dbbat.com/docs/api): REST API overview and where to find the OpenAPI spec