Zihin removes direct database access for AI agents, routing data through read-only replicas and tools

·1 views

Zihin has stopped letting AI agents connect straight to production databases, citing the risks of exposed credentials, agent-written queries and load on core systems. With version 2.2.2 of its MCP package, released October 4, 2026, the direct connection tools were removed and integrations now go through API tools or MCP servers such as the MCP Bridge. The replacement design uses a read-only replica inside the customer's network that is kept in sync with the source systems, so the production database never receives agent queries. Agents can only call pre-approved, domain-specific query contracts rather than writing their own SQL. Results travel through an outbound-only encrypted tunnel on port 443, which requires no inbound ports or VPN changes.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

OpenProject API tokens depend on project membership to determine real access

OpenProject's API accepts session auth, personal tokens, OAuth 2.0, and external OIDC tokens, but a valid token only identifies the caller. What the caller can actually see or change is determined by their project memberships and roles. Inventories that record only token IDs miss the projects and work packages that make a credential risky. The article also warns that anonymous users may receive permissions on public projects unless authentication is required for all requests. It recommends testing tokens as members, non-members, and administrators, and revoking access promptly during offboarding.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Backtesting a Polymarket Market-Making Bot Before Going Live

The article is the ninth in a series on building a Polymarket market-making bot and focuses on testing whether its adaptive strategy actually earns money. It notes that a quote that looks profitable on paper, such as a $4 gross spread on 100 tokens, can fail due to unfilled orders, partial fills, adverse price moves, queue position, or trading costs. Backtesting is presented as replaying historical market data to simulate the bot's decisions before any real capital is committed. The piece outlines a modular Python framework covering data, replay, strategy, execution simulation, portfolio tracking, and performance analysis. It also explains that backtesting is followed by paper trading and then live trading, and that a good backtest does not guarantee live success.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a Minecraft Network with Velocity: Lobby, Survival and Minigames

A Minecraft network links several servers so players can move between a lobby, survival, creative and minigames without disconnecting. The Velocity proxy, made by the PaperMC team, serves as the single address players join and needs little memory, while Paper or Purpur servers run the actual worlds. The guide recommends a 512 MB or 1 GB plan for the proxy and sizing each game server like a standalone Minecraft server. Setup involves listing game servers in velocity.toml, enabling modern forwarding with a shared secret, and setting online-mode=false on the game servers so the proxy handles login. Waterfall is also available but its development has ended, so Velocity is the recommended choice for new networks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Most SaaS firms leave AI search bots open on robots.txt, while news sites block them

A developer audited the home pages of 40 well-known websites in November 2026 to see how their robots.txt files treat 12 AI crawlers, and 31 sites yielded usable results. The crawlers were split into AI search and assistant bots, which fetch pages to answer users, and training bots, which collect content for model training. Ten of the 31 sites block at least one search or assistant bot, and all six news sites in the sample do so. None of the ten SaaS and developer tool companies block those bots, and nine of them publish an llms.txt file, which no news site does. The author suggests the split may reflect business models, since publishers risk losing visits to AI answers while software firms may benefit from mentions. The audit also revealed a bug in the author's own tool, which had wrongly flagged Figma as blocking AI search bots because Python's urllib.robotparser mishandles the end-of-URL marker and some bot-name matches.

0 comments Read more at DEV Community