[exabrial]

Wow. This fails security protocols established 25+ years ago.

We have an SQL MCP server. It has two thread pools, a low-priv pool and a high-priv pool.

The low-priv-pool exclusively have SELECT on views of the database that drop all PII and other sensitive columns.

The low-priv-pool user cannot escalate anything, no matter how hard it tries because the security is enforced by the database layer and the view design. This is the only pool that executes arbitrary SQL from the LLM. When the results are returned to the LLM, the view prefixes are stripped, so the LLM is none the wiser that its not querying the real tables.

The high-priv-pool can only execute predefined queries, and the query parameters are substituted by the driver. The LLM Cannot escape this constraint.

Separation of privs is a pretty standard security design. Why on earth would you even give an LLM accocunt access to things it definiately should never echo back to the user?