Databases

11.3. Databases — Controlled Data Connections

Databases — controlled data connections. Hermes does not ship a hard-coded “database” tool in the core — and this is a point worth emphasizing: the approach is always through MCP, with the principle of minimizing access rights right at configuration time.

Basic configuration

mcp_servers:
  fs:
    command: "npx"
    args: ["-y", "@modelcontextprotocol/server-filesystem", "/home/user/project"]
  postgres:
    command: "uvx"
    args: ["postgres-mcp-server"]
    env:
      DATABASE_URL: "postgresql://readonly_user:***@host/db"
    tools:
      include: [query, list_tables, describe_table]

The tool filtering principle here has a clear precedence mechanism: if you set only include, only those tools are registered; if you set only exclude, every tool except the listed ones is allowed; if you set both, include always wins — meaning a tool that appears in both include and exclude is still allowed. So it is best to use only one of the two, to avoid confusing logic.

Why you should use a read-only user

This is a recommendation repeated throughout the MCP documentation: for every database connection, create a dedicated, limited-privilege DB user/credential (read-only if possible) instead of sharing admin credentials — because once the agent has a query tool with write rights, a single wrong command (due to the model misunderstanding the intent) can cause real damage on production data.

Repo-local, bounded scope

For tasks where the agent only needs to “understand” a specific project — reading the schema, reviewing DB-related code — the recommended usage is to attach an MCP filesystem/git restricted to one specific project directory, so the agent reasons within a bounded workspace instead of having system-wide access.

Field-tested lessons

• There is no “default database MCP” — you must pick a server that fits the DB you are using (Postgres, MySQL, MongoDB…) and configure it manually; there is no one-click catalog like with popular SaaS.
• Always explicitly exclude destructive operations (drop, truncate, bulk delete) — do not just rely on the model “not being foolish enough to do that”.
• Set sensible timeout and connect_timeout values for your DB MCP server — slow queries on large tables can hang the entire turn if they are not bounded.