Developer builds SQL client with AI agent safeguards after finding existing tools too risky

·4 views

A developer built a SQL client called data-peek after finding that existing tools lacked safe ways to grant AI agents controlled database access. The tool runs a local MCP server, allowing AI clients like Claude Code to query databases while enforcing strict read-only rules through database-level transaction rollbacks rather than simple string matching. A single write tool, execute_statement, requires explicit human approval via an in-app dialog before any data-modifying SQL is executed, with auto-rejection after 60 seconds of inaction. Every query run by either humans or agents is recorded in a tamper-evident local audit log using a hash chain, letting users verify exactly what the agent executed. The server runs only on localhost, uses bearer-token authentication, and never exposes database credentials through any tool.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Five hreflang Mistakes That Quietly Undermine International SEO in 2026

Hreflang, the HTML attribute used to signal language and regional targeting to search engines, remains a frequent source of SEO failures for international websites. Common implementation errors include missing self-referencing tags, mismatches between hreflang URLs and canonical tags, and x-default attributes pointing to redirecting URLs rather than final destinations. Sitemap-only implementations carry added risk because a single fetch error can wipe out signals for entire page sets, making HTML-level tags a more resilient fallback. Incorrect language codes — such as declaring 'ru-PL' for a page actually written in Polish — cause Google's content detection to conflict with the hreflang declaration, often leading the signal to be discarded. These mistakes tend to surface after CMS migrations or regional expansions, and auditing hreflang sets for canonical consistency, redirect chains, and accurate language codes can prevent ranking losses.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dev-Turned-Security-Learner Builds IOC Enrichment Tool to Bridge Skills Gap

A full-stack developer transitioning into cybersecurity has built a beginner-level threat intelligence tool called IOC Enricher while working toward a SOC Analyst role. The web-based tool accepts an IP address, domain, or file hash and queries VirusTotal, AbuseIPDB, and MalwareBazaar in parallel, returning a combined risk score and an AI-generated plain-English summary. Built on a FastAPI backend with a Next.js frontend and Groq for AI summaries, the project was designed to automate a repetitive manual lookup workflow common in SOC investigations. During development, the creator encountered a silent authentication failure with MalwareBazaar that returned no data without raising an error, highlighting the danger of tools that appear functional while producing incomplete results. The project is publicly available and documented primarily as a learning record, with planned improvements including bulk lookups and Shodan integration.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer rewrites OneNote MCP server in TypeScript, exposes Microsoft Graph auth pitfalls

A developer attempting to connect OneNote to AI assistants like Claude via the Model Context Protocol (MCP) encountered persistent 401 authentication errors after using an existing JavaScript MCP server. The root cause was that the original server requested application-level permission scopes ending in '.All', which Microsoft silently rejects for personal accounts despite issuing a token. Switching to delegated, resource-qualified scopes resolved the issue and enabled compatibility with both personal and work accounts. The developer also noted that personal Microsoft accounts return non-JWT opaque tokens, meaning any code that validates JWT format will incorrectly reject valid tokens. Following these fixes, the entire server was rewritten in TypeScript with a modular structure, Zod-typed tool schemas, and removal of unnecessary dependencies.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Multiplying Step Success Rates Reveals True Workflow Reliability

A developer has built a free, browser-based calculator that computes the true end-to-end reliability of automated workflows by multiplying per-step success rates rather than averaging them. The tool addresses a common misconception: a seven-step workflow where each step succeeds 85% of the time yields only a 32% fully correct end-to-end rate, not 85%. Even a realistic workflow with steps averaging around 95.8% success can produce an actual combined reliability of just 77.2%. The calculator runs entirely locally, requires no account or email, and supports up to 30 workflow steps. The author emphasizes the tool is a diagnostic aid to identify fragile steps — particularly those with low success rates tied to high-cost outcomes — rather than a precise production forecast.

0 comments Read more at DEV Community