Sooner or later, someone on your team wants to point an AI assistant at the production database. Maybe it's a support engineer who wants to answer "why is this customer's invoice stuck?" without writing SQL. Maybe it's you, wanting Claude or Cursor to draft a gnarly multi-join query against real tables instead of guessing at column names.
The moment you decide to do this, you hit a fork in the road. You can give the AI tool a direct database connection — hand it a connection string and let it talk straight to Postgres or MySQL. Or you can put a broker in between using something like the Model Context Protocol (MCP), so the AI never touches your credentials and only ever sees what you allow.
Both work. They feel similar from the developer's chair — you type a question, SQL comes back. But under the hood they make very different trade-offs on security, blast radius, and workflow. Here's how they compare, with concrete examples, so you can pick deliberately instead of by accident.
The two setups, side by side
A direct connection is exactly what it sounds like. The AI tool (or an agent you wrote) holds a connection string like this:
