Short answer
It can be, if the connection controls what the AI can see and do. Check six things: scopes (read, write, build), row and column limits enforced by the database, a confirm step before any change, limits on sending messages, an audit log of every call, and instant revocation. Fieldproxy's MCP server has all six: the user's own role sets the ceiling, Postgres enforces row limits, writes are proposed and confirmed, and a revoked key is refused on the next request.
The checklist
| Control | Why it matters | Fieldproxy |
|---|---|---|
| Scopes | Reading is not the same as changing | data:read, data:write and build, capped by the user's own access |
| Row and column limits | A branch manager should not see every region | Enforced by Postgres; hidden columns refused however a query asks |
| Confirm before change | A wrong prompt should not rewrite data | Every write, send or action is proposed and confirmed within 30 minutes |
| Bulk limits | One request should not touch thousands of records | >5 rows needs bulk permission, >1,000 refused |
| Send limits | Protect customers from floods | Own mailbox only, 20 sends/hour/key, quiet hours; sandbox never sends |
| Audit and revoke | Know what happened and stop it fast | Every call logged; revoke applies on the next request |
Questions to ask any vendor
Which tools does the connection expose? Is a tool missing from the list refused even when called by name? Are keys shown once and hashed? Can an administrator see every connected app? Where is the audit log?
Fieldproxy facts on this page come from the Fieldproxy MCP reference. Competitor details are from each vendor's own documentation as of September 27, 2026; see the comparison table and sources.