DBX Database Client: Features and Security Risks

The MCP Workflow and Database Support

DBX functions as a cross-platform database client supporting over 90 engines, including MySQL, PostgreSQL, Redis, and MongoDB. Its primary differentiator is a first-party Model Context Protocol (MCP) server that allows AI coding agents, such as Claude, to query saved database connections directly without requiring the user to manually paste connection strings or credentials into the chat interface. Users can install the MCP server via npm or directly through Claude, enabling the agent to list connections, describe table schemas, and execute cross-database queries across multiple engines simultaneously.

Architecture and Security Concerns

While the project markets itself as lightweight by utilizing native system web views (WKWebView on macOS) rather than Electron, actual memory usage can scale significantly under load. The most critical issue is the handling of sensitive data: DBX stores all saved database credentials in plaintext within a local SQLite database file named dbx.db. Despite the project's rapid development cycle and frequent patches for other issues, this security vulnerability (tracked as issue 1081) remains unresolved. Users should exercise caution, as the lack of encryption for stored credentials makes the tool unsuitable for production environments until the maintainers implement secure storage via the operating system keychain.