I've been running Cursor and Claude Code with MCP for a while now, and one thing became obvious pretty quickly:
Giving an agent a generic execute_sql tool is usually a terrible idea.
The first problem is context explosion. If an agent needs to understand a database, it often starts by pulling huge schema dumps, table definitions, or query results directly into the conversation. Context gets consumed incredibly fast.
The second problem is what I call the agent loop trap. The model writes a query, gets an error, rewrites it, gets another error, and continues indefinitely. If you're using paid models, this can become surprisingly expensive.
To explore a different approach, I spent the last few weeks building DBeast, an open-source MCP server for PostgreSQL focused on discovery, diagnostics, and safety rather than unrestricted SQL execution.
