FoxByte
GitHubContact salesInstall
AI agents

Give every agent its own database. Keep main untouched.

Each agent gets an isolated copy of your database in seconds, runs real SQL against real data, and leaves behind a record of everything it changed. When you like what it built, you approve it.

Install FoxByteMCP setup guide
{
  "mcpServers": {
    "foxbyte": {
      "command": "fox",
      "args": ["mcp"],
      "env": { "FOX_API_KEY": "key_…" }
    }
  }
}
The loop

Copy, work, review, approve

  1. 1

    Copy

    create_branch gives the agent a full copy of the database and a key that opens only that copy.

  2. 2

    Work

    run_sql runs anything Postgres accepts, inside the guardrails.

  3. 3

    Review

    changes shows exactly what the agent altered, straight from the Blackbox.

  4. 4

    Approve or discard

    Turn the work into a change request for a person to approve, or delete_branch and the key goes with it.

Two ways in

MCP for agent frameworks, HTTP for everything else

fox mcp speaks the Model Context Protocol on stdio, so any MCP client can drive it through one standard interface. The Agent Branch API hands back a ready connection string over HTTP.

-k accepts the self-signed certificate a fresh install uses; drop it once you give FoxByte a real certificate. MCP tools: create_branch, run_sql, changes, verify_blackbox, list_branches and delete_branch. DDL an agent runs is attributed to that agent automatically.

$ FOX_API_KEY=key_… fox mcp
$ fox serve --addr :8088
$ curl -k -H "Authorization: Bearer $FOX_KEY" -X POST https://localhost:8088/agents/alice/branch
{ "dsn": "postgresql://agent-alice:key_…@localhost:6432/agent-alice" }
Agent keys

Keys that know they belong to an agent

One branch only

A key from the Agent Branch API opens its own branch and nothing else. Deleting the branch revokes it.

Recorded as an agent

Everything it does is labelled as an agent’s, and the agent guardrails apply to it.

Never an admin

An agent key never holds your admin grant; the console and the control-plane API refuse it.

Guardrails

It can experiment. It cannot wreck.

Destructive commands are blocked by policy, and a DELETE or UPDATE without a WHERE is refused. In the next release, one that reaches past 100 rows of a table is stopped at row 101, before anything is lost.

  • Next release: at most 1,000 rows of a table per hour, per agent.
  • Every refusal is recorded in the Blackbox.
  • An agent can propose changes to main; only a person can approve them.
agent-claude · branch ai-sandbox
DELETE FROM orders WHERE 1 = 1;
rows changed by this statementlimit 100
0of 1,000,000
counting…14.5 ms on a million-row table, 4-vCPU test VM · next release

Questions about agents

Any MCP client, or anything that can make an HTTP call and speak the Postgres wire protocol.

Not without a WHERE, and never with TRUNCATE or DROP TABLE unless an admin overrides the policy. From the next release, not more than 100 rows in a statement either.

No. Its key opens only its own branch, and other people’s branches answer “not found”.

Its schema changes can be turned into a change request first. Approving it applies the same statements to main, still attributed to the agent.

Hand your agent its first database.

Install FoxByte, make an agent key, and point your MCP client at fox mcp.

$ curl -fsSL https://get.thefoxbyte.com/install.sh | sh
Install FoxByteRead the docs