LogCarverGuard

io.github.caiderek/logcarverguard · v0.1.0

Guardrail for AI agents on SQL Server: statement blocking, optional read-only mode and an audit log.

Website Source code Set it up

Connect Runs on your machine

Terminal

claude mcp add logcarverguard -e LOGCARVERGUARD_CONNECTION_STRING=<LOGCARVERGUARD_CONNECTION_STRING> -e LOGCARVERGUARD_READ_ONLY=<LOGCARVERGUARD_READ_ONLY> -e LOGCARVERGUARD_AUDIT_DB_PATH=<LOGCARVERGUARD_AUDIT_DB_PATH> -e LOGCARVERGUARD_TRUNCATE_ALLOWLIST=<LOGCARVERGUARD_TRUNCATE_ALLOWLIST> -e LOGCARVERGUARD_EXEC_WHITELIST=<LOGCARVERGUARD_EXEC_WHITELIST> -e LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST=<LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST> -- dnx LogCarverGuard.Local --yes

claude_desktop_config.json

{
  "mcpServers": {
    "logcarverguard": {
      "command": "dnx",
      "args": [
        "LogCarverGuard.Local",
        "--yes"
      ],
      "env": {
        "LOGCARVERGUARD_CONNECTION_STRING": "<LOGCARVERGUARD_CONNECTION_STRING>",
        "LOGCARVERGUARD_READ_ONLY": "<LOGCARVERGUARD_READ_ONLY>",
        "LOGCARVERGUARD_AUDIT_DB_PATH": "<LOGCARVERGUARD_AUDIT_DB_PATH>",
        "LOGCARVERGUARD_TRUNCATE_ALLOWLIST": "<LOGCARVERGUARD_TRUNCATE_ALLOWLIST>",
        "LOGCARVERGUARD_EXEC_WHITELIST": "<LOGCARVERGUARD_EXEC_WHITELIST>",
        "LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST": "<LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST>"
      }
    }
  }
}

~/.cursor/mcp.json

{
  "mcpServers": {
    "logcarverguard": {
      "command": "dnx",
      "args": [
        "LogCarverGuard.Local",
        "--yes"
      ],
      "env": {
        "LOGCARVERGUARD_CONNECTION_STRING": "<LOGCARVERGUARD_CONNECTION_STRING>",
        "LOGCARVERGUARD_READ_ONLY": "<LOGCARVERGUARD_READ_ONLY>",
        "LOGCARVERGUARD_AUDIT_DB_PATH": "<LOGCARVERGUARD_AUDIT_DB_PATH>",
        "LOGCARVERGUARD_TRUNCATE_ALLOWLIST": "<LOGCARVERGUARD_TRUNCATE_ALLOWLIST>",
        "LOGCARVERGUARD_EXEC_WHITELIST": "<LOGCARVERGUARD_EXEC_WHITELIST>",
        "LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST": "<LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST>"
      }
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "logcarverguard": {
      "type": "stdio",
      "command": "dnx",
      "args": [
        "LogCarverGuard.Local",
        "--yes"
      ],
      "env": {
        "LOGCARVERGUARD_CONNECTION_STRING": "<LOGCARVERGUARD_CONNECTION_STRING>",
        "LOGCARVERGUARD_READ_ONLY": "<LOGCARVERGUARD_READ_ONLY>",
        "LOGCARVERGUARD_AUDIT_DB_PATH": "<LOGCARVERGUARD_AUDIT_DB_PATH>",
        "LOGCARVERGUARD_TRUNCATE_ALLOWLIST": "<LOGCARVERGUARD_TRUNCATE_ALLOWLIST>",
        "LOGCARVERGUARD_EXEC_WHITELIST": "<LOGCARVERGUARD_EXEC_WHITELIST>",
        "LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST": "<LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

Name	Description
`LOGCARVERGUARD_CONNECTION_STRING` Required, secret	SQL Server connection string the statements run as. Example: Server=localhost;Database=MyDb;Integrated Security=true;TrustServerCertificate=true
`LOGCARVERGUARD_READ_ONLY` Optional	Set to true to allow queries only (SELECT without INTO; remote sources such as OPENQUERY are blocked). Leave unset for the default guard rules.
`LOGCARVERGUARD_AUDIT_DB_PATH` Optional	Path of the audit log SQLite file. Defaults to LogCarverGuard/audit.db under the local application data folder.
`LOGCARVERGUARD_TRUNCATE_ALLOWLIST` Optional	Comma-separated schema.table entries where TRUNCATE TABLE is allowed. Empty means all TRUNCATE is blocked.
`LOGCARVERGUARD_EXEC_WHITELIST` Optional	Comma-separated schema.procedure entries that may be run with EXEC. Empty means all EXEC is blocked.
`LOGCARVERGUARD_ALTER_DROP_COLUMN_ALLOWLIST` Optional	Comma-separated schema.table entries where ALTER TABLE ... DROP COLUMN is allowed. Empty means it is blocked.

Details

Package	`[email protected]` (NUGET, stdio)
First published	12 Oct 2026
Last updated	12 Oct 2026
Registry name	`io.github.caiderek/logcarverguard`

More databases servers See all

Live status

Local install

Installed and run on your own machine, so there is no public endpoint to check.

Pair it with live search

Agents that use LogCarverGuard often also need current facts. NestDaddy MCP gives your AI today's internet: web search, real-time breaking news and full page reading in one connector.

See NestDaddy MCP

For maintainers

[![NestDaddy MCP](https://nestdaddy.com/mcp/servers/io-github-caiderek-logcarverguard/badge.svg)](https://nestdaddy.com/mcp/servers/io-github-caiderek-logcarverguard)

Add the badge to your README. It turns green while your server passes our daily check. Listing details come from the official MCP registry; update them there.

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.