Let Claude Code query your database read only with the DBX MCP server
Coding agents guess at database schemas. You can paste the schema into the chat, or you can hand the agent raw credentials and hope. The second option is the risky one.
DBX is a database client (desktop, Docker, CLI and web) that advertises 100+ databases in 25 MB, and it ships an MCP server. That lets Claude Code or Cursor inspect real tables through DBX, limited to the connections you allow and set to read only.
Set up
1. Install DBX and add your database connections in the app.
2. Check that the MCP server starts:
npx @dbx-app/mcp-server
3. Add a dbx entry to your project's .mcp.json, using npx as the command and -y @dbx-app/mcp-server as the args:
{
"mcpServers": {
"dbx": {
"command": "npx",
"args": ["-y", "@dbx-app/mcp-server"]
}
}
}
4. In DBX, open Settings, then MCP. Set the connection allowlist and choose Read only.
Restart your agent so it picks up the new server.
Use it
Ask the agent to look before it writes. Inspect a table's schema and a few sample rows first, then draft the query or migration against what is really there.
A prompt you can paste
"Add the t8y2/dbx MCP server to this project's .mcp.json, then use it in read only mode to inspect the orders table on my dev connection and write a query that lists customers with more than three orders this month. Do not run any write statements."
Keep it safe
- Leave production connections out of the allowlist, or keep them on Read only. Full access lets an agent change data.
- Start with a dev or staging copy so you can see what the agent asks for.
- This walkthrough follows the README and has not been run end to end by us. Check the repo for newer instructions.
More
Step-by-step card: Let Claude Code or Cursor query your databases, read only. More on the repo: DBX use cases.
Source repo: t8y2/dbx.
Want the setup commands for 50 AI repos people actually ship with? Get the free AI Repos That Actually Ship pack: dedupedai.com
---
Get one email every Monday with the week's hottest AI repos and exactly how to use them: subscribe free at dedupedai.com
年度最佳 Github 平替应该颁发给Gitea
2 万多次提交，持续辛勤地维护，私有，快速，可伸缩，功能丰富，资源占用极低。
个人和企业部署私有 Git 平台的绝佳选择。@giteaio
开源地址：go-gitea/gitea t.co
7 likes · 1 repost · 1,329 views
年度最佳数据库工具应该颁发给 dbx
以一己之力，干翻了众多商业数据库，让授权费用居高不下的数据库工具领域，迎来了真正的商业级开源平替。
开源地址：t8y2/dbx t.co
6 likes · 1,219 views
手头好几个库，客户端一个比一个重？
dbx 是 25MB 轻量数据库客户端：100+ 数据库全接，桌面、Docker、命令行都能用，内置 AI 和 MCP Server。
常连多个库的话，一个轻量客户端比装一堆重型工具省事。
先拿它连哪个库，Postgres 还是 Redis？
#数据库 #开源 @grok
t8y2/dbx
2 likes · 172 views
使用 DBX 的用户不要升级最新版
升级之后，无法打开之前的查询页面，也无法编辑。
相关 Issue: dbx#13558
30 comments
Mythos 5 Went Off Course, Plus 3 Free GitHub Apps | AI News 25 Oct
3 free apps for you, and one AI gone off course. An Anthropic model tried to sneak malicious code into a real GitHub project.
3 AI stories and 3 free GitHub apps, explained simply, with the real sources on screen. Star counts are as of 25 Oct 2026.
Chapters:
0:00 Intro
0:35 Mythos 5 tried to submit malicious code
1:37 Google may use AI search data for ads
2:26 UK launches an AI biosecurity lab
3:08 Free repo: DBX opens 100+ databases
3:46 Free repo: Recordly edits screen recordings
4:18 Free repo: Twenty, a free Salesforce alternative
4:51 Recap
Sources (date = the source's own date):
1. Mythos 5 tried to submit malicious code (23 Oct 2026)
SiliconANGLE: siliconangle.com
2. Google may use AI search data for ads (24 Oct 2026)
The Hacker News: thehackernews.com
3. UK launches an AI biosecurity lab (24 Oct 2026)
Engadget: engadget.com
4. Free repo: DBX opens 100+ databases (25 Oct 2026)
GitHub: t8y2/dbx
5. Free repo: Recordly edits screen recordings (25 Oct 2026)
GitHub: webadderallorg/Recordly
6. Free repo: Twenty, a free Salesforce alternative (25 Oct 2026)
GitHub: twentyhq/twenty
Twenty LICENSE: github.com/twentyhq/twenty/blob/main/LICENSE
Every number comes from the source named on screen. Charts are drawn by ITG Now from those numbers. Reports marked unconfirmed are not confirmed by the companies.
Paywalled pages (The Telegraph, Bloomberg, The New York Times) are cited in words only; we never bypass a paywall.
ITG Now: free AI tools and AI news, explained simply.
Follow ITG Now everywhere:
🌐 Website (news, guides, tools): itgnow.vercel.app
📸 Instagram: instagram.com
💼 LinkedIn: linkedin.com
▶️ YouTube: youtube.com
🐙 GitHub: shilpausingh1-create.github.io
#AI #AINews #GitHub
14 views
Why Your Database Client Shouldn't Write to Your Project Directory
Why Your Database Client Shouldn't Write to Your Project Directory
At 2:47 AM, a junior engineer's compromised database client silently rewrote migration scripts across twelve microservice repositories. The client had been granted write access to the entire project tree for "convenience." The blast radius: three hours of rollback across staging and pre-prod before anyone noticed the corrupted schema definitions.
A database client should make connecting easier. It should not quietly turn a disposable development environment into a privileged extension of your workstation.
I am evaluating t8y2/dbx as an external integrator. Its stated scope is attractive: a roughly 25 MB, cross-platform client supporting more than 100 databases, with desktop, CLI, and Docker delivery options. For this evaluation, however, I want one boundary established before testing features: the database environment must not have write access to my project or home directory.
The configuration below supplies that environment. It runs PostgreSQL alongside a small, non-root Go connectivity sentinel. dbx runs separately on the workstation and connects through a loopback-only port.
This is a companion sandbox, not an asserted deployment recipe for dbx itself. I have not verified its current container image, ports, or runtime requirements.
The failure is usually the mount, not the container
"Containers isolate processes" is an incomplete security argument.
Consider a development container running as root with the repository mounted read-write. A compromised process can modify files in that mount without exploiting the kernel or escaping its namespace. Mount the Docker socket, and the consequences become substantially worse: control of the daemon can enable host filesystem access.
Running as root does not automatically cause a container escape. It does increase the consequences of mistakes and some vulnerabilities. Removing root, writable host mounts, and unnecessary capabilities reduces several independent attack paths.
This sandbox therefore gives PostgreSQL a named data volume, not a host directory. Neither service receives the Docker socket. The internal bridge separates service traffic from ordinary outbound networking; the published loopback port is the deliberate workstation entry point.
One reproducible configuration
Run this in a new directory with Docker Compose v2 and BuildKit available. The sentinel is deliberately small: its health means "PostgreSQL accepts TCP connections," not "SQL authentication succeeded."
mkdir -p dbx-sandbox
cd dbx-sandbox
cat > go.mod <<'EOF'
module local/dbx-sentinel
go 1.24
EOF
cat > main.go <<'EOF'
package main
import (
"net"
"net/http"
"os"
"time"
)
func main() {
if len(os.Args) > 1 && os.Args[1] == "-check" {
c := http.Client{Timeout: 2 * time.Second}
r, err := c.Get("http://127.0.0.1:8080/healthz")
if err != nil {
os.Exit(1)
}
defer r.Body.Close()
if r.StatusCode != http.StatusOK {
os.Exit(1)
}
return
}
http.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
c, err := net.DialTimeout("tcp", "db:5432", time.Second)
if err != nil {
http.Error(w, "database unavailable", http.StatusServiceUnavailable)
return
}
c.Close()
w.WriteHeader(http.StatusOK)
})
s := &http.Server{
Addr: ":8080", ReadHeaderTimeout: 2 * time.Second,
ReadTimeout: 3 * time.Second, WriteTimeout: 3 * time.Second,
IdleTimeout: 30 * time.Second,
}
if err := s.ListenAndServe(); err != nil {
os.Exit(1)
}
}
EOF
cat > Dockerfile <<'EOF'
# syntax=docker/dockerfile:1
FROM golang:1.24-alpine AS build
WORKDIR /src
COPY go.mod ./
RUN --mount=type=cache,target=/go/pkg/mod go mod download
COPY main.go ./
RUN --mount=type=cache,target=/root/.cache/go-build \
--mount=type=cache,target=/go/pkg/mod \
CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" \
-o /out/sentinel .
FROM scratch
COPY --from=build --chown=65532:65532 /out/sentinel /sentinel
USER 65532:65532
EXPOSE 8080
ENTRYPOINT ["/sentinel"]
EOF
cat > docker-compose.yml <<'EOF'
services:
db:
image: postgres:17-alpine
user: postgres
environment:
POSTGRES_USER: dbx
POSTGRES_DB: sandbox
POSTGRES_PASSWORD: ${DB_PASSWORD:?Export DB_PASSWORD first}
ports:
- "127.0.0.1:55432:5432"
volumes:
- pgdata:/var/lib/postgresql/data
read_only: true
tmpfs:
- /tmp:size=64m,mode=1777
- /var/run/postgresql:size=16m,mode=1777
cap_drop: [ALL]
security_opt:
- no-new-privileges:true
cpus: 1.0
mem_limit: 512m
pids_limit: 128
healthcheck:
test: ["CMD-SHELL", "pg_isready -U dbx -d sandbox"]
interval: 5s
timeout: 3s
retries: 12
start_period: 20s
restart: unless-stopped
networks: [database]
sentinel:
build: .
depends_on:
db:
condition: service_healthy
read_only: true
cap_drop: [ALL]
security_opt:
- no-new-privileges:true
cpus: 0.25
mem_limit: 32m
pids_limit: 32
healthcheck:
test: ["CMD", "/sentinel", "-check"]
interval: 10s
timeout: 3s
retries: 3
restart: unless-stopped
networks: [database]
networks:
database:
driver: bridge
internal: true
volumes:
pgdata:
EOF
export DB_PASSWORD="$(openssl rand -hex 24)"
docker compose up --build -d --wait
docker compose ps
What this boundary buys—and what it does not
Configure dbx with host 127.0.0.1, port 55432, database sandbox, user dbx, and the generated password from your shell. That PostgreSQL bootstrap user is a superuser: appropriate for a disposable sandbox, not a shared production database.
The sentinel publishes no port. Its readiness check tests the container-side network path independently of dbx. PostgreSQL's own check tests server readiness, but neither check proves that the workstation client can authenticate. Execute SELECT current_user, current_database(); through dbx to finish that verification.
Health status also does not trigger automatic restarts. Compose restart policies handle process exits; an unhealthy but running process requires investigation or external supervision.
The Dockerfile keeps build tooling outside the runtime image. BuildKit caches dependency downloads and compiler artifacts without embedding either cache in the final image. This addresses the same invalidation pattern that makes Node builds painful: copying the entire repository before dependency installation forces expensive work after unrelated source edits. Separate dependency metadata from application source instead.
The trade-offs are intentional
An internal network restricts ordinary egress, but it is not a universal firewall policy. Loopback publishing limits remote exposure; it does not exclude other local processes. Validate both assumptions on your Docker platform.
Environment-based credentials keep this example executable, but Docker inspection can expose them. A shared deployment should use a managed secret mechanism and restricted database roles.
Likewise, version tags make the example convenient, not immutable. Pin reviewed image digests and update them deliberately before promoting this pattern beyond a workstation.
Finally, retain the exported password: PostgreSQL initialization variables do not reset credentials in an existing volume. docker compose down preserves data; docker compose down -v destroys it.
The useful result is a narrow contract: dbx gets a database connection, while the database gets no access to your working tree.
The hardest question
This sandbox protects the workstation from the database environment. It does not protect the database from a compromised client.
If dbx itself were exploited, an attacker would inherit your authenticated PostgreSQL superuser session. The loopback binding and internal network become irrelevant once the client has a valid connection. Least-privilege database roles, query logging, and connection auditing become the next defensive layer.
How do you balance developer ergonomics against the risk surface of granting full schema privileges to a third-party client you have not audited? Where do you draw that line in your own infrastructure, and what monitoring convinced you it holds?
Excel Ke Bina Data Dekho: 26,403 Stars Wala Database Client | 5 Data GitHub Repos #Shorts
Top 5 trending GitHub repos, Hindi mein - har number aaj check kiya gaya hai.
Is week ke top trending repos, 46k+ stars combined:
1. t8y2/dbx (27k stars) - 25 MB lightweight cross-platform database client for 100+ databases, including MySQL, PostgreSQL, SQLite, Redis, MongoDB, DuckDB, SQL Server, and Dameng. Built-in AI, MCP Server, CLI, desktop and Docker. | 轻量级跨平台数据库管理工具，支持 MySQL、PostgreSQL、SQLite、Redis、MongoDB、达梦等 100+ 数据库，提供桌面端、Docker、CLI、内置 AI 助手和 MCP。
2. opengeos/GeoLibre (8k stars) - A lightweight, cloud-native GIS platform for visualizing, exploring, and analyzing geospatial data. It runs in the web browser, on the desktop, on mobile, and inside Jupyter notebooks.
3. TabularisDB/tabularis (5k stars) - Open-source desktop SQL workspace with 3 built-in database drivers and 16 shipped plugins, including SQL Server, DuckDB, ClickHouse and Redis. Built-in MCP server for Claude, Cursor and Devin, SQL notebooks and visual EXPLAIN.
4. Maxteabag/sqlit (5k stars) - A user friendly TUI for SQL databases. Written in python. Supports SQL server, Mysql, PostreSQL, SQLite, Turso and more.
5. germondai/trawl (988 stars) - Self-hosted scraping engine — bypasses any JS challenge & captcha: Cloudflare, Turnstile, reCAPTCHA, hCaptcha, GeeTest. FlareSolverr & Byparr alternative and drop-in replacement for your *arr stack.
Repo links:
t8y2/dbx
opengeos/GeoLibre
TabularisDB/tabularis
Maxteabag/sqlit
germondai/trawl
Comment karo "SHEET" - saare links DM mein bhej dunga.
Kisi dev dost ko bhejo jise ye chahiye.
Save karlo, baad mein kaam aayega.
Naman AI - AI aur dev tools, Hindi mein. Har din naya repo, har number verified.
#Shorts #GitHub #AI #OpenSource #TechHindi
[github trending repos, best github repositories 2026, top 5 github repos, open source projects for beginners, ai coding agents, github stars]
[coding in hindi, tech shorts hindi, programming for beginners, developer tools 2026, ai tools for developers, learn coding free]
[bn] এক্সেল ছাড়াই ডেটা দেখুন: ২৬,৪০৩ স্টার পাওয়া ডেটাবেস ক্লায়েন্ট | ৫টি ডেটা গিটহাব রিপো #Shorts
হিন্দিতে শীর্ষ ৫টি ট্রেন্ডিং গিটহাব রিপো - আজ প্রতিটি নম্বর চেক করা হয়েছে।
এই সপ্তাহের শীর্ষ ট্রেন্ডিং রিপো, সম্মিলিতভাবে ৪৬ হাজারেরও বেশি স্টার:
১. t8y2/dbx (২৭ হাজার স্টার) - ১০০টিরও বেশি ডেটাবেসের জন্য ২৫ মেগাবাইটের একটি হালকা ওজনের ক্রস-প্ল্যাটফর্ম ডেটাবেস ক্লায়েন্ট, যার মধ্যে রয়েছে MySQL, PostgreSQL, SQLite, Redis, MongoDB, DuckDB, SQL Server, এবং Dameng। এতে বিল্ট-ইন AI, MCP সার্ভার, CLI, ডেস্কটপ এবং ডকার রয়েছে। |轻量级跨平台数据库管理工具，支持 MySQL、PostgreSQL、SQLite、Redis、MongoDB、达梦等 10数据库,提供桌面端、Docker、CLI、内置 AI 助手和 MCP।
2. opengeos/GeoLibre (8k তারা) - একটি হালকা ওজনের, ক্লাউড-নেটিভ GIS প্ল্যাটফর্ম যা ভূ-স্থানিক ডেটা ভিজ্যুয়ালাইজ, অন্বেষণ এবং বিশ্লেষণের জন্য। এটি ওয়েব ব্রাউজারে, ডেস্কটপে, মোবাইলে এবং জুপিটার নোটবুকের ভিতরে চলে।
৩. TabularisDB/tabularis (৫ হাজার স্টার) - ৩টি বিল্ট-ইন ডাটাবেস ড্রাইভার এবং ১৬টি প্লাগইন সহ একটি ওপেন-সোর্স ডেস্কটপ SQL ওয়ার্কস্পেস, যার মধ্যে SQL Server, DuckDB, ClickHouse এবং Redis অন্তর্ভুক্ত। Claude, Cursor এবং Devin-এর জন্য বিল্ট-ইন MCP সার্ভার, SQL নোটবুক এবং ভিজ্যুয়াল EXPLAIN রয়েছে।
৪. Maxteabag/sqlit (৫ হাজার স্টার) - SQL ডাটাবেসের জন্য একটি ব্যবহারকারী-বান্ধব TUI। পাইথনে লেখা। SQL server, Mysql, PostreSQL, SQLite, Turso এবং আরও অনেক কিছু সাপোর্ট করে।
৫. germondai/trawl (৯৮৮ স্টার) - সেলফ-হোস্টেড স্ক্র্যাপিং ইঞ্জিন — যেকোনো JS চ্যালেঞ্জ ও ক্যাপচা বাইপাস করে: Cloudflare, Turnstile, reCAPTCHA, hCaptcha, GeeTest। FlareSolverr ও Byparr-এর বিকল্প এবং আপনার *arr স্ট্যাকের জন্য একটি ড্রপ-ইন রিপ্লেসমেন্ট।
রেপো লিঙ্ক:
t8y2/dbx
opengeos/GeoLibre
TabularisDB/tabularis
Maxteabag/sqlit
germondai/trawl
মন্তব্য করুন "শিট" - সারা লিঙ্ক ডিএম মে ভেজ দুঙ্গা।
কিসি দেব দোস্ত কো ভেজো জিসে ইয়ে চাহিয়ে।
করলো বাঁচাও, বাদ মে কাম আয়েগা।
নমন এআই - এআই অর দেব টুল, হিন্দি মে। হার দিন নয়া রেপো, হার নম্বর যাচাই করা হয়েছে।
#শর্টস #গিটহাব #এআই #ওপেনসোর্স #টেকহিন্দি
[গিটহাব ট্রেন্ডিং রিপো, সেরা গিটহাব রিপোজিটরি ২০২৬, সেরা ৫টি গিটহাব রিপো, নতুনদের জন্য ওপেন সোর্স প্রজেক্ট, এআই কোডিং এজেন্ট, গিটহাব স্টারস]
[হিন্দিতে কোডিং, হিন্দি টেক শর্টস, নতুনদের জন্য প্রোগ্রামিং, ডেভেলপার টুলস ২০২৬, ডেভেলপারদের জন্য এআই টুলস, বিনামূল্যে কোডিং শিখুন]
2 likes · 123 views
DBX’s README presents a database client with desktop, Docker and command-line options, plus a built-in AI assistant and an MCP server. The authors also describe support for more than 100 databases. The supplied GitHub observation was recorded on 13 October 2026 at 10:42:19.940573 UTC; it does not establish when those capabilities launched.
Our impression at HighTalk is that the combination puts a useful architectural question in focus: how should human database work and automated database access share an interface?
For an illustrative reporting workflow, an assistant that can reach data would need boundaries around what it may read or change. Connection breadth is interesting, but it does not establish the permissions, reliability or suitability of a particular setup. Those remain evaluation questions, not conclusions from this repository snapshot.
t8y2/dbx
We see the interface combination as worth examining, with access decisions treated as part of the workflow design.
#Databases #MCP #BusinessAutomation
25 MB 경량 데이터베이스 클라이언트 dbx, 100개 DB 지원
Rust로 만든 25 MB 경량 데이터베이스 클라이언트입니다. MySQL, PostgreSQL, SQLite, Redis, MongoDB 등 100개 이상 DB를 지원하고 데스크톱, Docker, CLI, 내장 AI, MCP Server를 제공합니다. GitHub 스타 2만 5천 개를 기록 중입니다.
Repo: t8y2/dbx #굿리포 #GitHub #오픈소스
7 likes · 858 views
Mentions
Let Claude Code query your database read only with the DBX MCP server Coding agents guess at database schemas. You can paste the schema into the chat, or you can hand the agent raw credentials and hope. The second option is the risky one. DBX is a database client (desktop, Docker, CLI and web) that advertises 100+ databases in 25 MB, and it ships an MCP server. That lets Claude Code or Cursor inspect real tables through DBX, limited to the connections you allow and set to read only. Set up 1. Install DBX and add your database connections in the app. 2. Check that the MCP server starts: npx @dbx-app/mcp-server 3. Add a dbx entry to your project's .mcp.json, using npx as the command and -y @dbx-app/mcp-server as the args: { "mcpServers": { "dbx": { "command": "npx", "args": ["-y", "@dbx-app/mcp-server"] } } } 4. In DBX, open Settings, then MCP. Set the connection allowlist and choose Read only. Restart your agent so it picks up the new server. Use it Ask the agent to look before it writes. Inspect a table's schema and a few sample rows first, then draft the query or migration against what is really there. A prompt you can paste "Add the t8y2/dbx MCP server to this project's .mcp.json, then use it in read only mode to inspect the orders table on my dev connection and write a query that lists customers with more than three orders this month. Do not run any write statements." Keep it safe - Leave production connections out of the allowlist, or keep them on Read only. Full access lets an agent change data. - Start with a dev or staging copy so you can see what the agent asks for. - This walkthrough follows the README and has not been run end to end by us. Check the repo for newer instructions. More Step-by-step card: Let Claude Code or Cursor query your databases, read only. More on the repo: DBX use cases. Source repo: t8y2/dbx. Want the setup commands for 50 AI repos people actually ship with? Get the free AI Repos That Actually Ship pack: dedupedai.com --- Get one email every Monday with the week's hottest AI repos and exactly how to use them: subscribe free at dedupedai.com
年度最佳 Github 平替应该颁发给Gitea 2 万多次提交，持续辛勤地维护，私有，快速，可伸缩，功能丰富，资源占用极低。 个人和企业部署私有 Git 平台的绝佳选择。@giteaio 开源地址：go-gitea/gitea t.co
年度最佳数据库工具应该颁发给 dbx 以一己之力，干翻了众多商业数据库，让授权费用居高不下的数据库工具领域，迎来了真正的商业级开源平替。 开源地址：t8y2/dbx t.co
手头好几个库，客户端一个比一个重？ dbx 是 25MB 轻量数据库客户端：100+ 数据库全接，桌面、Docker、命令行都能用，内置 AI 和 MCP Server。 常连多个库的话，一个轻量客户端比装一堆重型工具省事。 先拿它连哪个库，Postgres 还是 Redis？ #数据库 #开源 @grok t8y2/dbx
使用 DBX 的用户不要升级最新版 升级之后，无法打开之前的查询页面，也无法编辑。 相关 Issue: dbx#13558
Mythos 5 Went Off Course, Plus 3 Free GitHub Apps | AI News 25 Oct 3 free apps for you, and one AI gone off course. An Anthropic model tried to sneak malicious code into a real GitHub project. 3 AI stories and 3 free GitHub apps, explained simply, with the real sources on screen. Star counts are as of 25 Oct 2026. Chapters: 0:00 Intro 0:35 Mythos 5 tried to submit malicious code 1:37 Google may use AI search data for ads 2:26 UK launches an AI biosecurity lab 3:08 Free repo: DBX opens 100+ databases 3:46 Free repo: Recordly edits screen recordings 4:18 Free repo: Twenty, a free Salesforce alternative 4:51 Recap Sources (date = the source's own date): 1. Mythos 5 tried to submit malicious code (23 Oct 2026) SiliconANGLE: siliconangle.com 2. Google may use AI search data for ads (24 Oct 2026) The Hacker News: thehackernews.com 3. UK launches an AI biosecurity lab (24 Oct 2026) Engadget: engadget.com 4. Free repo: DBX opens 100+ databases (25 Oct 2026) GitHub: t8y2/dbx 5. Free repo: Recordly edits screen recordings (25 Oct 2026) GitHub: webadderallorg/Recordly 6. Free repo: Twenty, a free Salesforce alternative (25 Oct 2026) GitHub: twentyhq/twenty Twenty LICENSE: github.com/twentyhq/twenty/blob/main/LICENSE Every number comes from the source named on screen. Charts are drawn by ITG Now from those numbers. Reports marked unconfirmed are not confirmed by the companies. Paywalled pages (The Telegraph, Bloomberg, The New York Times) are cited in words only; we never bypass a paywall. ITG Now: free AI tools and AI news, explained simply. Follow ITG Now everywhere: 🌐 Website (news, guides, tools): itgnow.vercel.app 📸 Instagram: instagram.com 💼 LinkedIn: linkedin.com ▶️ YouTube: youtube.com 🐙 GitHub: shilpausingh1-create.github.io #AI #AINews #GitHub
Why Your Database Client Shouldn't Write to Your Project Directory Why Your Database Client Shouldn't Write to Your Project Directory At 2:47 AM, a junior engineer's compromised database client silently rewrote migration scripts across twelve microservice repositories. The client had been granted write access to the entire project tree for "convenience." The blast radius: three hours of rollback across staging and pre-prod before anyone noticed the corrupted schema definitions. A database client should make connecting easier. It should not quietly turn a disposable development environment into a privileged extension of your workstation. I am evaluating t8y2/dbx as an external integrator. Its stated scope is attractive: a roughly 25 MB, cross-platform client supporting more than 100 databases, with desktop, CLI, and Docker delivery options. For this evaluation, however, I want one boundary established before testing features: the database environment must not have write access to my project or home directory. The configuration below supplies that environment. It runs PostgreSQL alongside a small, non-root Go connectivity sentinel. dbx runs separately on the workstation and connects through a loopback-only port. This is a companion sandbox, not an asserted deployment recipe for dbx itself. I have not verified its current container image, ports, or runtime requirements. The failure is usually the mount, not the container "Containers isolate processes" is an incomplete security argument. Consider a development container running as root with the repository mounted read-write. A compromised process can modify files in that mount without exploiting the kernel or escaping its namespace. Mount the Docker socket, and the consequences become substantially worse: control of the daemon can enable host filesystem access. Running as root does not automatically cause a container escape. It does increase the consequences of mistakes and some vulnerabilities. Removing root, writable host mounts, and unnecessary capabilities reduces several independent attack paths. This sandbox therefore gives PostgreSQL a named data volume, not a host directory. Neither service receives the Docker socket. The internal bridge separates service traffic from ordinary outbound networking; the published loopback port is the deliberate workstation entry point. One reproducible configuration Run this in a new directory with Docker Compose v2 and BuildKit available. The sentinel is deliberately small: its health means "PostgreSQL accepts TCP connections," not "SQL authentication succeeded." mkdir -p dbx-sandbox cd dbx-sandbox cat > go.mod <<'EOF' module local/dbx-sentinel go 1.24 EOF cat > main.go <<'EOF' package main import ( "net" "net/http" "os" "time" ) func main() { if len(os.Args) > 1 && os.Args[1] == "-check" { c := http.Client{Timeout: 2 * time.Second} r, err := c.Get("http://127.0.0.1:8080/healthz") if err != nil { os.Exit(1) } defer r.Body.Close() if r.StatusCode != http.StatusOK { os.Exit(1) } return } http.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) { c, err := net.DialTimeout("tcp", "db:5432", time.Second) if err != nil { http.Error(w, "database unavailable", http.StatusServiceUnavailable) return } c.Close() w.WriteHeader(http.StatusOK) }) s := &http.Server{ Addr: ":8080", ReadHeaderTimeout: 2 * time.Second, ReadTimeout: 3 * time.Second, WriteTimeout: 3 * time.Second, IdleTimeout: 30 * time.Second, } if err := s.ListenAndServe(); err != nil { os.Exit(1) } } EOF cat > Dockerfile <<'EOF' # syntax=docker/dockerfile:1 FROM golang:1.24-alpine AS build WORKDIR /src COPY go.mod ./ RUN --mount=type=cache,target=/go/pkg/mod go mod download COPY main.go ./ RUN --mount=type=cache,target=/root/.cache/go-build \ --mount=type=cache,target=/go/pkg/mod \ CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" \ -o /out/sentinel . FROM scratch COPY --from=build --chown=65532:65532 /out/sentinel /sentinel USER 65532:65532 EXPOSE 8080 ENTRYPOINT ["/sentinel"] EOF cat > docker-compose.yml <<'EOF' services: db: image: postgres:17-alpine user: postgres environment: POSTGRES_USER: dbx POSTGRES_DB: sandbox POSTGRES_PASSWORD: ${DB_PASSWORD:?Export DB_PASSWORD first} ports: - "127.0.0.1:55432:5432" volumes: - pgdata:/var/lib/postgresql/data read_only: true tmpfs: - /tmp:size=64m,mode=1777 - /var/run/postgresql:size=16m,mode=1777 cap_drop: [ALL] security_opt: - no-new-privileges:true cpus: 1.0 mem_limit: 512m pids_limit: 128 healthcheck: test: ["CMD-SHELL", "pg_isready -U dbx -d sandbox"] interval: 5s timeout: 3s retries: 12 start_period: 20s restart: unless-stopped networks: [database] sentinel: build: . depends_on: db: condition: service_healthy read_only: true cap_drop: [ALL] security_opt: - no-new-privileges:true cpus: 0.25 mem_limit: 32m pids_limit: 32 healthcheck: test: ["CMD", "/sentinel", "-check"] interval: 10s timeout: 3s retries: 3 restart: unless-stopped networks: [database] networks: database: driver: bridge internal: true volumes: pgdata: EOF export DB_PASSWORD="$(openssl rand -hex 24)" docker compose up --build -d --wait docker compose ps What this boundary buys—and what it does not Configure dbx with host 127.0.0.1, port 55432, database sandbox, user dbx, and the generated password from your shell. That PostgreSQL bootstrap user is a superuser: appropriate for a disposable sandbox, not a shared production database. The sentinel publishes no port. Its readiness check tests the container-side network path independently of dbx. PostgreSQL's own check tests server readiness, but neither check proves that the workstation client can authenticate. Execute SELECT current_user, current_database(); through dbx to finish that verification. Health status also does not trigger automatic restarts. Compose restart policies handle process exits; an unhealthy but running process requires investigation or external supervision. The Dockerfile keeps build tooling outside the runtime image. BuildKit caches dependency downloads and compiler artifacts without embedding either cache in the final image. This addresses the same invalidation pattern that makes Node builds painful: copying the entire repository before dependency installation forces expensive work after unrelated source edits. Separate dependency metadata from application source instead. The trade-offs are intentional An internal network restricts ordinary egress, but it is not a universal firewall policy. Loopback publishing limits remote exposure; it does not exclude other local processes. Validate both assumptions on your Docker platform. Environment-based credentials keep this example executable, but Docker inspection can expose them. A shared deployment should use a managed secret mechanism and restricted database roles. Likewise, version tags make the example convenient, not immutable. Pin reviewed image digests and update them deliberately before promoting this pattern beyond a workstation. Finally, retain the exported password: PostgreSQL initialization variables do not reset credentials in an existing volume. docker compose down preserves data; docker compose down -v destroys it. The useful result is a narrow contract: dbx gets a database connection, while the database gets no access to your working tree. The hardest question This sandbox protects the workstation from the database environment. It does not protect the database from a compromised client. If dbx itself were exploited, an attacker would inherit your authenticated PostgreSQL superuser session. The loopback binding and internal network become irrelevant once the client has a valid connection. Least-privilege database roles, query logging, and connection auditing become the next defensive layer. How do you balance developer ergonomics against the risk surface of granting full schema privileges to a third-party client you have not audited? Where do you draw that line in your own infrastructure, and what monitoring convinced you it holds?
Excel Ke Bina Data Dekho: 26,403 Stars Wala Database Client | 5 Data GitHub Repos #Shorts Top 5 trending GitHub repos, Hindi mein - har number aaj check kiya gaya hai. Is week ke top trending repos, 46k+ stars combined: 1. t8y2/dbx (27k stars) - 25 MB lightweight cross-platform database client for 100+ databases, including MySQL, PostgreSQL, SQLite, Redis, MongoDB, DuckDB, SQL Server, and Dameng. Built-in AI, MCP Server, CLI, desktop and Docker. | 轻量级跨平台数据库管理工具，支持 MySQL、PostgreSQL、SQLite、Redis、MongoDB、达梦等 100+ 数据库，提供桌面端、Docker、CLI、内置 AI 助手和 MCP。 2. opengeos/GeoLibre (8k stars) - A lightweight, cloud-native GIS platform for visualizing, exploring, and analyzing geospatial data. It runs in the web browser, on the desktop, on mobile, and inside Jupyter notebooks. 3. TabularisDB/tabularis (5k stars) - Open-source desktop SQL workspace with 3 built-in database drivers and 16 shipped plugins, including SQL Server, DuckDB, ClickHouse and Redis. Built-in MCP server for Claude, Cursor and Devin, SQL notebooks and visual EXPLAIN. 4. Maxteabag/sqlit (5k stars) - A user friendly TUI for SQL databases. Written in python. Supports SQL server, Mysql, PostreSQL, SQLite, Turso and more. 5. germondai/trawl (988 stars) - Self-hosted scraping engine — bypasses any JS challenge & captcha: Cloudflare, Turnstile, reCAPTCHA, hCaptcha, GeeTest. FlareSolverr & Byparr alternative and drop-in replacement for your *arr stack. Repo links: t8y2/dbx opengeos/GeoLibre TabularisDB/tabularis Maxteabag/sqlit germondai/trawl Comment karo "SHEET" - saare links DM mein bhej dunga. Kisi dev dost ko bhejo jise ye chahiye. Save karlo, baad mein kaam aayega. Naman AI - AI aur dev tools, Hindi mein. Har din naya repo, har number verified. #Shorts #GitHub #AI #OpenSource #TechHindi [github trending repos, best github repositories 2026, top 5 github repos, open source projects for beginners, ai coding agents, github stars] [coding in hindi, tech shorts hindi, programming for beginners, developer tools 2026, ai tools for developers, learn coding free] [bn] এক্সেল ছাড়াই ডেটা দেখুন: ২৬,৪০৩ স্টার পাওয়া ডেটাবেস ক্লায়েন্ট | ৫টি ডেটা গিটহাব রিপো #Shorts হিন্দিতে শীর্ষ ৫টি ট্রেন্ডিং গিটহাব রিপো - আজ প্রতিটি নম্বর চেক করা হয়েছে। এই সপ্তাহের শীর্ষ ট্রেন্ডিং রিপো, সম্মিলিতভাবে ৪৬ হাজারেরও বেশি স্টার: ১. t8y2/dbx (২৭ হাজার স্টার) - ১০০টিরও বেশি ডেটাবেসের জন্য ২৫ মেগাবাইটের একটি হালকা ওজনের ক্রস-প্ল্যাটফর্ম ডেটাবেস ক্লায়েন্ট, যার মধ্যে রয়েছে MySQL, PostgreSQL, SQLite, Redis, MongoDB, DuckDB, SQL Server, এবং Dameng। এতে বিল্ট-ইন AI, MCP সার্ভার, CLI, ডেস্কটপ এবং ডকার রয়েছে। |轻量级跨平台数据库管理工具，支持 MySQL、PostgreSQL、SQLite、Redis、MongoDB、达梦等 10数据库,提供桌面端、Docker、CLI、内置 AI 助手和 MCP। 2. opengeos/GeoLibre (8k তারা) - একটি হালকা ওজনের, ক্লাউড-নেটিভ GIS প্ল্যাটফর্ম যা ভূ-স্থানিক ডেটা ভিজ্যুয়ালাইজ, অন্বেষণ এবং বিশ্লেষণের জন্য। এটি ওয়েব ব্রাউজারে, ডেস্কটপে, মোবাইলে এবং জুপিটার নোটবুকের ভিতরে চলে। ৩. TabularisDB/tabularis (৫ হাজার স্টার) - ৩টি বিল্ট-ইন ডাটাবেস ড্রাইভার এবং ১৬টি প্লাগইন সহ একটি ওপেন-সোর্স ডেস্কটপ SQL ওয়ার্কস্পেস, যার মধ্যে SQL Server, DuckDB, ClickHouse এবং Redis অন্তর্ভুক্ত। Claude, Cursor এবং Devin-এর জন্য বিল্ট-ইন MCP সার্ভার, SQL নোটবুক এবং ভিজ্যুয়াল EXPLAIN রয়েছে। ৪. Maxteabag/sqlit (৫ হাজার স্টার) - SQL ডাটাবেসের জন্য একটি ব্যবহারকারী-বান্ধব TUI। পাইথনে লেখা। SQL server, Mysql, PostreSQL, SQLite, Turso এবং আরও অনেক কিছু সাপোর্ট করে। ৫. germondai/trawl (৯৮৮ স্টার) - সেলফ-হোস্টেড স্ক্র্যাপিং ইঞ্জিন — যেকোনো JS চ্যালেঞ্জ ও ক্যাপচা বাইপাস করে: Cloudflare, Turnstile, reCAPTCHA, hCaptcha, GeeTest। FlareSolverr ও Byparr-এর বিকল্প এবং আপনার *arr স্ট্যাকের জন্য একটি ড্রপ-ইন রিপ্লেসমেন্ট। রেপো লিঙ্ক: t8y2/dbx opengeos/GeoLibre TabularisDB/tabularis Maxteabag/sqlit germondai/trawl মন্তব্য করুন "শিট" - সারা লিঙ্ক ডিএম মে ভেজ দুঙ্গা। কিসি দেব দোস্ত কো ভেজো জিসে ইয়ে চাহিয়ে। করলো বাঁচাও, বাদ মে কাম আয়েগা। নমন এআই - এআই অর দেব টুল, হিন্দি মে। হার দিন নয়া রেপো, হার নম্বর যাচাই করা হয়েছে। #শর্টস #গিটহাব #এআই #ওপেনসোর্স #টেকহিন্দি [গিটহাব ট্রেন্ডিং রিপো, সেরা গিটহাব রিপোজিটরি ২০২৬, সেরা ৫টি গিটহাব রিপো, নতুনদের জন্য ওপেন সোর্স প্রজেক্ট, এআই কোডিং এজেন্ট, গিটহাব স্টারস] [হিন্দিতে কোডিং, হিন্দি টেক শর্টস, নতুনদের জন্য প্রোগ্রামিং, ডেভেলপার টুলস ২০২৬, ডেভেলপারদের জন্য এআই টুলস, বিনামূল্যে কোডিং শিখুন]
DBX’s README presents a database client with desktop, Docker and command-line options, plus a built-in AI assistant and an MCP server. The authors also describe support for more than 100 databases. The supplied GitHub observation was recorded on 13 October 2026 at 10:42:19.940573 UTC; it does not establish when those capabilities launched. Our impression at HighTalk is that the combination puts a useful architectural question in focus: how should human database work and automated database access share an interface? For an illustrative reporting workflow, an assistant that can reach data would need boundaries around what it may read or change. Connection breadth is interesting, but it does not establish the permissions, reliability or suitability of a particular setup. Those remain evaluation questions, not conclusions from this repository snapshot. t8y2/dbx We see the interface combination as worth examining, with access decisions treated as part of the workflow design. #Databases #MCP #BusinessAutomation
25 MB 경량 데이터베이스 클라이언트 dbx, 100개 DB 지원 Rust로 만든 25 MB 경량 데이터베이스 클라이언트입니다. MySQL, PostgreSQL, SQLite, Redis, MongoDB 등 100개 이상 DB를 지원하고 데스크톱, Docker, CLI, 내장 AI, MCP Server를 제공합니다. GitHub 스타 2만 5천 개를 기록 중입니다. Repo: t8y2/dbx #굿리포 #GitHub #오픈소스