Connect an existing MariaDB application
Reuse a narrowly scoped MariaDB login and select MySQL in the connection wizard. The server stays on your existing network; GateRook supplies the MCP tools your AI app can discover.
Databases · MCP integration
Connect MariaDB to your AI, with control over every query.
Connect MariaDB to an MCP-compatible AI app using GateRook’s built-in MySQL connector. The SQL implementation recognizes MariaDB and applies its database behavior, including MariaDB statement timeouts. You get schema discovery, read queries and explicit approval for changes through the same endpoint model.
Connection in GateRook
stage-mariadb
MariaDB
stage / QA- Connector type
- MySQL
- Name / environment
- stage-mariadb / stage
- Host / port
- mariadb.stage.internal / 3306
- Database
- orders
The route
Your AI requests a tool. GateRook checks the endpoint policy, resolves credentials locally, and calls the configured service.
Understand the request flowAsk your AI
Check the status and total of order 48213 in MariaDB. Read only.
sql_query · arguments
{
"connection": "stage-mariadb",
"sql": "SELECT id, status, total FROM orders WHERE id = 48213",
"limit": 10
}Example result
{
"columns": [
"id",
"status",
"total"
],
"rows": [
[
48213,
"pending",
"149.00"
]
],
"rowCount": 1,
"truncated": false
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Put context to work
What you can do with MariaDB and AI
Explain a data discrepancy
Ask the agent to inspect a table definition and run a limited query for a specific record. Compare the result with an API response on the same endpoint without giving the agent either service credential.
Inspect schema during a migration
Compare table definitions, indexes and read results across separately named connections. Keep writes disabled while investigating differences between MySQL and MariaDB environments.
From service to MCP
How to connect MariaDB
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select MySQL. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Prepare a database login
Create or select a MariaDB user with read access to the intended tables. Keep the database reachable from your desktop. A read-only login adds a database-level boundary alongside the endpoint policy.
Choose MySQL and configure the connection
Open Connections, choose Add connection, then MySQL. Set the name, environment, host, port and database. Enter credentials in the connection form, separately from anything you paste into an AI conversation.
Set TLS, scope and query limits
Keep verify-full for a server with TLS, add its private CA when needed, and restrict the database allowlist. Advanced settings include statement timeout, pool size and connection timeout. Policies may impose stricter limits.
Test the connection before saving
Continue to Test and review connectivity and the privileges reported for the login. Finish Add to endpoint to save the connection. Leave mutation tools Off unless you intend to review proposed changes.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure MariaDB in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Connector type | MySQL | MariaDB uses the built-in MySQL connector and its database settings. |
Name / environment | stage-mariadb / stage | A recognizable connection name becomes the connection argument in tool calls. |
Host / port | mariadb.stage.internal / 3306 | Use a host reachable from the computer running GateRook, including its VPN. |
Database | orders | Optional default database; when omitted, qualify tables with the database name. |
User / password | gateway_reader / Enter in GateRook (write-only) | Start with a database account that can only read. Choose Encrypted here or a configured secret store. |
SSL mode | verify-full | Checks both the certificate authority and host name. Add a PEM CA certificate for a private CA. |
Database allowlist | orders | Limit which schemas or databases this connection exposes; environment policies can tighten the scope. |
Know what you expose
MariaDB tools and access boundaries
The connector determines what is possible. Endpoint modes and connection policies determine what a particular AI client may use.
| Tool | Purpose | Access behavior |
|---|---|---|
sql_list_schemas | Discover the schemas, databases and tables visible to the connection user. | Read only |
sql_describe_table | Inspect columns, types, indexes and foreign keys before writing a query. | Read only |
sql_query | Run a read query or EXPLAIN in a read-only transaction, with endpoint limits. | Read only |
sql_execute | Propose INSERT, UPDATE or DELETE. You review and approve the exact SQL before execution. | Approval |
Before you enable access
- sql_query runs reads in a read-only transaction. sql_execute is a separate tool and requires approval for changes; a read-only database login still cannot write after approval.
- The endpoint caps rows and execution time. Do not treat a truncated result as the full dataset.
- Unknown user-defined functions are not automatically trusted as reads: they require approval, and are refused on prod unless allowed by policy.
- A query result can contain application data. Choose tables, columns and access scope deliberately before exposing them to an AI app.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
MariaDB connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Is GateRook a MariaDB MCP server or an AI client?
GateRook connects to MariaDB and exposes selected database tools through an MCP endpoint. Your AI app is the MCP client. It receives the endpoint configuration, while the database password stays with the GateRook connection.
Can the AI change database records?
Only when you expose sql_execute in Approval mode, the policy permits the statement, the database user has permission, and you approve the exact action. There is no mode for unattended writes.
Why is there no separate MariaDB type in the picker?
MariaDB is handled by the built-in MySQL connector. Choose MySQL and enter the MariaDB server address, database and credentials. GateRook recognizes the server from its version information.
Which MariaDB generation is targeted?
The connector implementation targets MariaDB 10.6 and later. Run Test connection against your actual server before exposing its tools to an endpoint.
Do I need to expose the database to the public internet?
No. The local GateRook core connects from your computer, so an existing VPN and private network route can be used. The database must be reachable by that computer.
Keep exploring
Connect the rest of your stack
MySQL
Connect MySQL to an MCP-compatible AI app with GateRook. Explore schemas, run read-only SQL, review changes and keep database credentials out of prompts.
PostgreSQL
Connect PostgreSQL to an MCP-compatible AI app with GateRook. Explore schemas, run read-only SQL, review changes and keep database credentials out of prompts.
HTTP API
Connect a REST or HTTP API to AI through MCP. Scope base URLs and paths, keep API keys in GateRook, and approve requests that change data.
Your infrastructure, on your terms
Bring MariaDB into the conversation.
Start with one connection. Choose what your AI can do.