A Cursor agent will happily run a query against whatever connection string it finds in your environment. That is the convenience and the problem in one move. The moment an AI coding agent has database access, it can read a production table, drop a column inside a migration, or pull a customer record into its context window, and the credential it used was usually a long-lived secret sitting in a dotfile. This is a fast, minimal walkthrough for putting real controls around that path: route Cursor through a gateway so every connection is scoped, recorded, and masked instead of the agent holding a raw credential.
What database access for an AI coding agent actually needs
Cursor writes and runs code, and code reaches data. The risk is not that the agent is malicious, it is that the database access is undifferentiated: one credential, full reach, no record of which statement ran or who authorized it. Three properties have to hold before you let an agent near a real database.
- The agent authenticates as a named identity, not a shared key that could belong to anyone.
- Its reach is scoped to the task, so a request to read one table does not become standing access to the whole schema.
- Every statement is recorded outside the agent, where a steered prompt or a buggy tool call cannot rewrite the log.
The instinct is to assemble these from three tools. The cleaner model is to make the database connection itself the place where all three are enforced, which is what an identity-aware proxy does.
Put the connection behind hoop.dev
hoop.dev is an open-source Layer 7 access gateway. It sits between an identity and infrastructure such as a Postgres or MySQL database, through an agent that runs inside your own network, and it governs the connection rather than trusting the caller to behave. Cursor connects to hoop.dev as if it were the database, and hoop.dev opens the real connection under controls you set. You can read how hoop.dev governs and records each connection before wiring anything.
Wiring the first connection
- Run the hoop.dev gateway inside the network that can already reach your database, and register the database as a connection. The gateway holds the real credential; the agent never sees it.
- Bind the connection to an identity from your existing provider, so the session is attributed to a named principal instead of a shared service account.
- Point Cursor at the hoop.dev endpoint instead of the database host. To the agent it is an ordinary Postgres or MySQL connection, so no tool-specific plugin is required.
- Set the scope: which database and which tables this identity may reach, and grant it just-in-time so the access expires with the task rather than lingering as a standing grant.
- Turn on inline masking for the columns that hold personal or secret data, so emails, tokens, and card numbers are redacted on the connection before any row reaches the agent's context.
From that point on the agent has database access only through a path that records the exact statements it runs at the command level. To start from a clean install, follow the steps to connect your first database through hoop.dev.
Pitfalls to avoid
- Do not hand Cursor a direct connection string "just for development". Dev credentials reach real data more often than anyone plans for, and the agent cannot tell the difference.
- Do not rely on the agent to log its own queries. A record the agent can skip or rewrite is not evidence. The log has to live on the connection, outside the process making the calls.
- Do not grant broad standing access because scoping feels slow. Just-in-time access is the property that keeps a single task from becoming permanent reach across the schema.
FAQ
Does this slow Cursor down?
No. The agent opens a normal database connection to the gateway, so the workflow is unchanged. The difference is that the connection is now scoped, recorded, and masked, which is what makes the access safe to grant in the first place.
What gets recorded for each query?
The calling identity, the exact statement run against the database, the scope that authorized it, and any fields masking redacted, captured on the connection rather than inside Cursor.
hoop.dev is open source, so you can read exactly how the gateway brokers database access for a coding agent at the hoop.dev repository on GitHub.
