Data platform
Data agents with warehouse write access
An in-product analytics agent writes SQL, edits dashboards, and toggles feature flags against your warehouse — the pattern every analytics tool now ships.
Real example — shipping today
source →PostHog · PostHog AI + hosted MCP server
A copilot built on the Claude Agent SDK that writes and runs SQL, creates dashboards, toggles feature flags, and runs sandbox scripts — plus a hosted MCP server exposing those actions to any client.
Their own controls — PostHog ships scoped API-key presets and append-only activity logs.
The danger without a gate
A coarse project-scoped key gives read across the whole warehouse and write to flags. A prompt-injected query exfiltrates another tenant’s events, or a DROP slips through with only after-the-fact logging to catch it.
How MCPIP handles it, step by step
Read it top to bottom. Each step shows the real command and exactly what MCPIP returns — the same allow / step-up / denied envelope every time.
A normal read flows straight through
A SELECT is routine, so MCPIP authorizes it on its payload, seals the record, and the query runs — sub-second.
$ mcpip --json authorize skill_warehouse_query --arg sql='SELECT sum(mrr) FROM revenue'{
"correlation_id": "19fe33a0",
"decision": "allow",
"status": "committed",
"transaction_ref": "txn_5a0be1",
"executed_target_class": "cloud_rest",
"worm_sequence": 48215,
"vended_credential": null
}attackThe attack: a DROP rides in on a prompt injection
A destructive statement is authorized per-call, on its own payload — not a blanket key scope. A DROP isn’t in the grant, so it never reaches the warehouse.
$ mcpip --json authorize skill_warehouse_query --arg sql='DROP TABLE revenue'{
"error": "denied",
"correlation_id": "c0a1f2d9"
}attackThe attack: a query reaches for another tenant
Warehouse and tenant identifiers are opaque-aliased and compartment-scoped, so another tenant’s data simply has no name the agent can reference. Cross-tenant probes fail closed.
The result
A data agent that explores freely but can’t leak across tenants or run an unreviewed destructive query.
The same flow, at a glance
Every command above runs against a local sandbox in one line.
run it yourself — curl … | bash && mcpip up →