SSRF in MCP servers: the flaw Google and JPMorgan shared
The same SSRF class hit MCP servers at Google, JPMorgan, Weaviate and two governments. The database gateway case shows where the missing check belongs.
Analysis
8 min read
Notes on databases and the agents that work on them
Guides, comparisons, and research from the Datapace team on documenting, running, and governing databases.
Postgres 14 to 18 upgrade: the pg_upgrade runbook
A pg_upgrade runbook for the Postgres 14 to 18 jump: the two decisions to make before any command runs, the rehearsal, the cutover, and the first hour.
Guide
7 min read
Apache Ossie in dbt: how to load semantic models
dbt reads Apache Ossie documents natively from an osi/ directory, under two version pins the docs state quietly. The four-step setup, and what gets dropped.
Guide
7 min read
DigitalOcean Managed Agents: the brokered credential
DigitalOcean Managed Agents brokers credentials so agents never hold them. What that closes for AI database access, and what the exercised grant still allows.
Analysis
8 min read
Microsoft Postgres MCP server: the role is the boundary
Microsoft open-sourced a Postgres MCP server plus expert skills for coding agents. What each layer supplies, and where its security model says enforcement ends.
Analysis
8 min read
Denial of wallet attacks on LLM agents: billed every turn
A denial of wallet attack no longer needs request volume. One malicious tool return retained in an agent's context is metered again on every later turn.
Analysis
8 min read
Supabase acquires Turso: one database per agent
Supabase is buying Turso to give every AI agent its own SQLite database, with Postgres as the graduation path. What crosses that boundary, and what does not.
Analysis
8 min read
Nvidia Open Agent Safety Platform: what the DPU can't see
Nvidia's Open Agent Safety Platform pairs the OpenShell runtime with Sentry, a DPU watchdog that quarantines agents in milliseconds. Where that span ends.
Analysis
8 min read
Apache Polaris 1.8.0: semantic models get privileges
Apache Polaris 1.8.0 stores Ossie semantic models as catalog entities with their own privilege class. What the grants enforce, what breaks, what to do.
Guide
8 min read
CData Connect AI Gateway: governance at the connector
CData Connect AI Gateway puts model routing, MCP management, and record-level policy in one control point. What that vantage covers, and what stays open.
Analysis
8 min read
Postgres 14 end of life: the jump is four majors wide
Community support for Postgres 14 ends this November. Leaving it means crossing every incompatibility that 15, 16, 17 and 18 shipped, in one maintenance window.
Guide
8 min read
Supabase RLS: how 16,326 databases ended up public
UpGuard's scan of 300,000 domains found Supabase databases readable with only the public anon key. The cause is a creation-path default, auditable in SQL.
Analysis
9 min read
dbt v2 DuckDB adapter: what's built in and what's not
dbt 2.0.0 is the first release with a DuckDB adapter inside the engine. What the pinned driver adds, what stays in dbt-duckdb, and how to choose.
Analysis
8 min read
AlloyDB agentic database architecture: the read-only bet
Google previewed PostgreSQL for agents in AlloyDB: microVM nodes reading production state from separate Colossus segments. The load-bearing word is read-only.
Analysis
8 min read
Datadog Bits AI alternatives: the two questions that sort them
Every page ranking for Datadog Bits AI alternatives is a vendor putting itself first, most under the product's old name. Two questions sort the field: what the agent can see, and what it may do.
Comparison
8 min read
What is Jev? TypeSafe AI's decision-only model, explained
Jev is TypeSafe AI's decision-only model: calibrated typed answers instead of text. What it does, its limits, and where it fits for agents on databases.
Guide
9 min read
Governed metrics: what they are and what enforces them
Governed metrics are definitions with an enforcement point: one compiled query path every consumer shares. Most metric YAML never gets that path.
Guide
9 min read
Index bloat in Postgres: why VACUUM never shrinks an index
B-tree pages split but never merge, and VACUUM reclaims only completely empty ones. Why indexes bloat when tables do not, and when REINDEX is the fix.
Guide
9 min read
AIUC-1 certification vs runtime enforcement for AI agents
AIUC-1 tests an agent against up to 5,000 scenarios and issues a one-year certificate. Runtime enforcement decides each tool call. The standard asks for both.
Comparison
9 min read
What is Agents Schema? The spec behind Fivetran Context Layer
Agents Schema is the open warehouse schema for agent context behind Fivetran Context Layer, launched at dbt Summit 2026. We read the spec: one registry table, and agent instructions delivered as rows.
Analysis
8 min read
Cockroach Continuum bets agents multiply databases, not load
Cockroach Labs launched Continuum, pooling thousands of virtual clusters on shared hosts. The bet: agents multiply databases faster than load.
Analysis
8 min read
Mem0 Gateway separates connecting a tool from granting it
Mem0 Gateway puts per-agent tool grants behind one key and splits connecting a tool from granting it. Why that matters to everyone building on agents.
Analysis
8 min read
Data valorization: a working definition for data teams
Data valorization defined as work, not outcomes: an operational definition for data teams, plus a Postgres audit of how much of your estate produces no value.
Guide
8 min read
LLMjacking: the cloud intrusion that wanted GPU quota
Google documented an intrusion whose objective was AI capacity. It entered on a leaked token and left with a GPU quota increase, never meeting a model control.
Analysis
8 min read
DUSTMAKER: valid SLSA attestations on malicious packages
Google documented malware that steals OIDC tokens from CI runners and publishes backdoored packages under a real publisher identity. The signature verifies.
Analysis
8 min read
Odoo data migration: the target model is the hard part
Odoo's upgrade service does not cover moving another ERP into Odoo. That job is a semantic transformation into a model that enforces its own opinions.
Guide
10 min read
AI schema migration: the rewrite hidden in a DEFAULT
Two ALTER TABLE statements one word apart took 16 ms and 14.3 seconds on the same table. Measured on Postgres 16, and why an agent cannot tell them apart.
Pattern
9 min read
LLM schema matching: why constraints beat a bigger model
LLM-only schema matching produces fluent but invalid mappings. New research shows schema constraints, not bigger models, deliver the accuracy lift.
Analysis
8 min read
Claude Code token usage: what Spotify's 90% cut proves
Spotify cut Claude Code token usage 90 percent with two hooks and a cheap worker model. The pattern, routing tool output out of context, goes well beyond files.
Analysis
8 min read
CVE-2026-85664: Chroma's unbounded HNSW index parameters
A collection-create request could size Chroma's HNSW index without limits and exhaust server memory. Postgres closed this failure class decades ago.
Analysis
8 min read
dbt Core 2.0 changes the artifacts every catalog ingests
dbt Core 2.0 ships Parquet artifacts, a strict spec, and render-time lineage. Every catalog and lineage tool that parses manifest.json is affected.
Analysis
8 min read
llms.txt security risks: what 6,214 scanned domains showed
A researcher registered package names that corporate llms.txt files referenced but nobody owned. The first callback came in under four minutes.
Analysis
9 min read
Postgres autoscaling: what it can and can't optimize
The average Postgres database on Neon now resizes compute every 81 seconds. Autoscaling ends provisioning waste; query-level waste scales up and gets billed.
Analysis
8 min read
OpenAI's Hugging Face incident was a covert storage channel
METR found 1,200 isolated OpenAI agents coordinating through a shared package cache, 700 of them in a real intrusion. The boundary that failed was storage.
Analysis
12 min read
Chroma Fission: agent transactions that never roll back
Chroma's Foundation memory ships with Fission, a transaction protocol for agent swarms that treats every abort as an early commit. Who inherits the conflict?
Analysis
9 min read
MCP servers write into your system prompt. Nobody logs it.
MCP's instructions field lets any server add text to your agent's system prompt. A registry-scale probe finds it in routine use, and most clients hide it.
Analysis
9 min read
AWS is buying DuckLabs. What happens to DuckDB?
AWS is acquiring DuckLabs, the company behind DuckDB. Code and trademarks stay with an independent foundation under MIT. The maintainers' payroll moves.
Analysis
9 min read
Supabase query performance: find, read, and fix slow queries
Find slow queries in Supabase with pg_stat_statements, read EXPLAIN ANALYZE BUFFERS output, and fix the sequential scans that inflate your bill.
Tutorial
11 min read
AI agent security consolidation: five exits, one holdout
Alice, formerly ActiveFence, raised $140M as the last scaled independent in AI agent security. Invariant, Protect AI, Lakera, and Portkey sold first.
Analysis
9 min read
OpenMetadata 2.0 changed three defaults. None of them error.
OpenMetadata 2.0 went GA on August 24. The upgrade's real risk is the three changed defaults that never error: sampled profiling, dropped cardinality, MCP on.
Guide
9 min read
OpenAI hired the InstantDB team. Instant Cloud shuts down.
OpenAI acqui-hired the team behind InstantDB, the open source real-time sync backend. Instant Cloud shuts down within a year, and agent state loses a vendor.
Analysis
8 min read
ERP data migration: 55% deployed, 34% done, 16 months left
SAPinsider's 2026 benchmark: 55% of organizations have deployed S/4HANA, only 34% finished. The gap is the data: the target model deleted the legacy tables.
Analysis
9 min read
A quote in a table name minted bucket-wide cloud credentials
Three critical CVEs hit Apache Polaris credential vending in four months. When the catalog mints cloud credentials, table names become security policy.
Analysis
9 min read
Google Governance Agent: warehouse-native active metadata
Google's Governance Agent propagates descriptions, policy tags, and trust scores through column-level lineage, free. What that leaves for catalogs.
Analysis
9 min read
CLAUDE.md never shrinks. A 1,867-repo study shows why.
Agentic memory files grow 226 percent and almost never shrink. A study of 247,694 instruction lifetimes explains why safe deletion costs O(2^n).
Analysis
8 min read
pg_stat_statements eviction: why agent SQL disappears
AI agents mint more unique query shapes than pg_stat_statements can hold. Eviction is silent, and the tuning evidence disappears where agent traffic grows.
Analysis
9 min read
Apache Ossie: standardize joins, or just measures?
Ossie's definitions were easy for 50 signatories to sign. A foundational semantics spec pins down joins and fan-out. A counter-proposal wants SQL with measures.
Analysis
8 min read
Postgres 19: REPACK and plan advice, built for automation
PostgreSQL 19 Beta 4 is out after a month of feature reverts. REPACK and pg_plan_advice survived the cull, and what the survivors share says which interventions Postgres wants reviewable.
Analysis
10 min read
OpenMetadata 2.0 rebrands the catalog as a context layer
OpenMetadata's 2.0 line ships memories, MCP, and a knowledge graph, and now calls itself the open context layer. What the rebrand says about the category.
Analysis
9 min read
Databricks Lakebase: the governance layer came bundled
Databricks raised $5B at $190B and Lakebase, its Postgres for AI agents, crossed a $100M run-rate. The governance layer came bundled with the database.
Analysis
8 min read
Your agent's approval was valid. By commit time, it wasn't.
Agent guardrails check permissions at request time. Two 2026 papers show the check can be false by commit time. Databases have owned this race for decades.
Analysis
8 min read
Can multiple AI agents safely share one memory store?
Multiple AI agents sharing one memory store is becoming the default. A retrieval-time filter cannot secure it: derived and revoked memories leak around it.
Analysis
8 min read
Datapace and Soft Industry Alliance go to market together
Datapace signs its first partner in Eastern Europe: Soft Industry Alliance, technology partner to manufacturing, supply chain, and retail companies.
News
2 min read
Can an LLM replace a DBA? What two new benchmarks found
Two new studies score LLM agents on the full DBA job. Agents managed a 12.4 percent safe pass rate on production-fidelity scenarios; a human hit 93.4.
Analysis
8 min read
MCP added a cache. Now one server can poison every user.
Two unpatched MCP flaws chain into one attack: poisoned instructions marked public-cacheable, cached once, then re-served to every user behind a shared gateway.
Analysis
9 min read
pgrust passed every Postgres test. Tests are not the spec.
An AI-coded Postgres rewrite passed all 46,066 regression tests. A fuzzer broke it within days. What each layer of Postgres-compatible actually proves.
Analysis
9 min read
Neon backend GA: what a branch forks, and what it can't copy
Neon's backend is GA: Postgres, Object Storage, Functions, Managed Better Auth and AI Gateway fork together under one branch_id. What no fork can carry.
Analysis
10 min read
Supabase agent write access after Perplexity Computer
Supabase is now a Perplexity Computer connector: hosted agents read and write production Postgres across runs. A year ago the advice was read-only.
Analysis
8 min read
Google's approval-gated database agent: gated on what?
Google's database agent finds root cause in minutes and executes fixes with your approval. That approval is now the trust boundary. Is the screen a real gate?
Analysis
8 min read
Ephemeral credentials for AI agents in Postgres
How to give each AI agent its own Postgres identity: ephemeral credentials via a template role, session lifetime traps, audit attribution, and pooler pitfalls.
Pattern
9 min read
EU AI Act logging requirements for AI agents: Article 12
Article 12 requires high-risk AI systems to log events automatically. What the text demands, what it leaves open, and how a database audit trail answers it.
Guide
10 min read
What is Apache Ossie? What it standardizes and what it leaves out
What is Apache Ossie? Open Semantic Interchange, renamed on entering the Apache Incubator in July 2026. What the spec carries, what it leaves out, and why.
Analysis
9 min read
Memory Layer vs Context Layer: Perfect Recall, Wrong Answer
Mem0, Zep and Letta store what your agent experienced. None of them knows which revenue column is canonical. Where memory ends and a context layer begins.
Comparison
8 min read
LangMem vs Mem0 vs Zep vs Letta vs Cognee: how to choose
LangMem, Mem0, Zep, Letta and Cognee implement different memory types. We ran all five through four measurable gates and a public benchmark; the pick follows from the memory type your agent needs.
Comparison
25 min read
Living documentation: why resilient teams keep docs current
Why outdated documentation slows incident recovery, what living documentation means, and how to keep documentation up to date without discipline.
Essay
12 min read
How to give an AI agent safe access to a production database
The two-layer setup for safe AI agent access to production databases, with measured blast-radius numbers and a gated path for schema migrations.
Guide
14 min read
What Is a Context Layer for AI Agents? The 2026 Guide
A context layer gives AI agents what's there, what it means, and how it connects. The definition, components, and differences from memory and semantic layers.
Guide
10 min read
AI agent database access policy: template and six clauses
The six clauses a database access policy needs once AI agents hold credentials, with a copy-paste template and the Postgres commands that enforce it.
Tutorial
11 min read
OLTP vs OLAP vs HTAP: the difference, measured
OLTP, OLAP and HTAP measured on the same 50 million rows: a 46x columnar aggregation win, and co-location pushing the worst write from 38 ms to 332 ms.
Comparison
13 min read
LTAP vs HTAP: what Databricks actually changed
Databricks coined LTAP in June 2026 and declared HTAP a failure. What actually changed: the row-to-column copy moved from the engine into the storage layer.
Analysis
10 min read
How to give an AI agent context on your Postgres schema
A runbook for giving AI agents schema context: introspect the Postgres catalogs, harvest COMMENT metadata, map foreign keys, and assemble one context document.
Tutorial
9 min read
Source-to-target mapping: what the document must include
The field pairs are the smallest part of a source-to-target mapping. What the document must also carry to survive an ERP migration through to go-live.
Guide
9 min read
How to reverse engineer an undocumented database schema
A working method to reverse engineer an undocumented database schema: inventory tables, recover missing relationships, decode columns, validate the map.
Guide
12 min read
Which column is the source of truth for a metric?
How to find the source of truth when a database has duplicate columns like amount, total_amount, and revenue_net: trace writes, trace reads, reconcile.
Guide
9 min read
ERP Data Migration: Mapping Legacy Databases Faster
Legacy data mapping is where ERP projects slip after go-live. Why semantic discovery plus expert-validated mappings is a faster loop than mapping from scratch.
Guide
8 min read
AWS Performance Insights deprecated: the CloudWatch move
AWS Performance Insights is deprecated: the console is gone, the API survives, and AWS defaulted your fleet to Database Insights Standard. What to check now.
Guide
9 min read
Agentjacking: why agent security gateways matter
Agentjacking proves coding agents can be hijacked via MCP in 85% of attempts. Here is what it means for agent security gateway design in 2026.
News
6 min read
What is an AI agent security gateway, and what must it do?
What an AI agent security gateway is, the threat model behind it, the controls it must enforce at the MCP and execution layer, and how to evaluate one.
Guide
9 min read
AI agent memory layer: architectures and what breaks
AI agent memory layer guide: the four memory types, three production architectures, and the retrieval and governance problems that surface at fleet scale.
Guide
11 min read
Replit's AI deleted a production database. What stops that?
A factual breakdown of the July 2025 Replit AI database deletion, and the control-plane checks that would have stopped each link in the failure chain.
Analysis
8 min read
Read-only access will not make your AI agent safe
Read-only blocks the fixes agents exist to make, and prompt guardrails leak. Classify every statement in the data path, gate risky writes, and log it all.
Guide
7 min read
Human-in-the-loop database migrations for agents
Most human-in-the-loop advice stops at approve database changes. How to render, gate, route, and record a pending migration before an agent runs it.
Guide
7 min read
AI governance audit trail: an immutable ledger architecture for agents
How an AI governance audit trail works as an immutable ledger: why tool-call logs cannot reconstruct what an agent changed, and what the ledger records.
Guide
8 min read
Railway's two migration outages, one CI check
Railway had two Postgres migration outages in six weeks. Same cascade, different trigger. A close reading of both post-mortems and the one pre- merge check.
Postmortem
10 min read
Time-series anomaly detection fails on Postgres
Yahoo S5, NAB, and UCR shaped the TSAD literature. Postgres metrics do not look like those benchmarks, and methods that score well on them alert poorly.
Pattern
11 min read
Self-driving databases in 2026: progress vs hype
The 2017 self-driving DBMS vision promised autonomous tuning, indexing, and healing. What actually shipped by 2026, and where a human still signs off.
Essay
13 min read
lock_timeout best practices: what it catches and misses
lock_timeout is necessary for safe Postgres migrations and not sufficient. What a pre-merge migration check adds, and what only the timeout catches.
Pattern
11 min read
Why staging did not catch your slow migration
A migration tested on 10,000 staging rows locked 84 million production rows for four hours. Staging is a biased sample, and the bias grows with scale.
Pattern
11 min read
Why does ALTER TABLE block SELECT in Postgres?
A SELECT issued during an ALTER TABLE waits even when locks are compatible. Why Postgres queues reads behind DDL, with pg_locks proof and the fixes.
Pattern
12 min read
auto_explain vs pg_stat_statements in production
The two Postgres diagnostic extensions are complementary, not competitors. When each lies, how to join them via queryid, and the minimum production setup.
Reference
12 min read
Online DDL: pgroll vs pg-osc vs pg_karnak vs gh-ost
Four online DDL tools, four architectures: versioned views, shadow tables, 2PC, and binlog streaming. A neutral comparison with failure modes named.
Comparison
13 min read
Who reviews your schema changes now that the DBA is gone
Between 2015 and 2025 the DBA role dissolved at mid-size SaaS. Capacity, backups, and tuning found new owners. The judgment about what the data means did not.
Essay
11 min read
Which commit caused the database regression?
DBSherlock, iSQUAD, D-Bot, and RCRank each infer a database root cause. None names the commit. Six depths of causal inference explain why the gap exists.
Essay
12 min read
The 5 most common Postgres SQL mistakes
Most Postgres performance problems come from a short list of avoidable SQL patterns: unindexed filters, SELECT *, deep OFFSET, N+1, and casts in WHERE.
Best Practices
9 min read
The N+1 cascade EXPLAIN ANALYZE cannot see
EXPLAIN ANALYZE plans one query at a time. N+1 storms are a hundred fast queries adding up to a slow page. The signal lives in pg_stat_statements.
Pattern
8 min read
Want to see your own schema resolved?
Bring one database. We will show you what Datapace resolves, what your experts validate, and what AI can safely do with it.