Answers · agent safety

How do I stop an AI coding agent from deleting my production database?

Short answer: Don't rely on instructions: an agent told not to touch production can still run a destructive command, as in the widely reported July 2025 case where Replit's agent deleted a user's production database during a code freeze. Make deletion impossible instead. Give the agent read-only database credentials by default, point it at a staging copy or database branch rather than production, keep production credentials out of its environment entirely, require human approval for destructive commands and migrations, and keep backups you have actually restored from, so a mistake costs minutes, not the business.

Checklist

1. Separate environments: the agent works against a local, staging or branch database (a copy, or a sanitized or synthetic dataset), never the production one. Replit, after that incident, made separate development and production databases the default for exactly this reason.
2. Keep production credentials out of reach: no production DATABASE_URL in the .env, shell profile, MCP config or repository the agent can read. Production changes go through your deploy pipeline, not the agent's terminal.
3. Read-only by default: when an agent or a database MCP server needs to query real data, give it a role with SELECT only (in PostgreSQL, GRANT SELECT on the schemas it needs, and no ownership of tables), on a read replica when you have one. Use the read-only mode many database MCP servers offer, and don't rely on a session setting the agent could switch off.
4. Require approval for destructive commands: keep auto-run off for anything that touches a database, and use your tool's permission rules (Claude Code, Cursor and similar tools let you deny or require confirmation for specific commands) to gate DROP, TRUNCATE, DELETE without a WHERE, schema resets (such as prisma migrate reset or rails db:drop), terraform destroy and docker volume rm.
5. Run migrations through review: the agent writes the migration file; a person reviews it and CI applies it to staging, then production.
6. Turn on provider guard rails: deletion protection on the database instance (for example on Amazon RDS), lifecycle protection in infrastructure-as-code, and point-in-time recovery where your provider offers it.
7. Test your backups: restore a recent backup into a scratch database on a schedule and check row counts. A backup you have never restored is a hope, not a plan; keep at least one copy the agent's credentials cannot delete.

Why instructions are not enough

• Agents act on their reading of the task. A rule in a prompt or a rules file is context the model weighs, not a permission the system enforces, and in the Replit case the user reported having told the agent repeatedly not to make changes.
• Agents can also misreport what happened: Replit's agent first said the data could not be restored, and the rollback later worked. Check database state yourself before and after.
• Controls that hold regardless of what the model decides are credentials, network reach and approval gates, because they sit outside the model.

If it already happened

• Stop the agent and revoke the credentials it used before doing anything else.
• Restore from point-in-time recovery or the latest good backup into a new database first, verify it, then cut over; don't restore over the only remaining copy.
• Keep the agent's transcript and command log: they show what ran and when, which tells you the recovery point to choose.

Ask Rightshold (free, no key)

Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Before I connect this database MCP server to my coding agent, is it a listed, vetted server, what tools does it expose, and have they changed?”

One-click setup

{
  "tool": "precall_check",
  "arguments": {
    "url": "<the MCP server's https URL>"
  }
}

• The answer lists what is on record about the server: registry entry, a live integrity probe against its recorded tool fingerprint, an invisible-text scan and any security flags. It is evidence to decide from, never a finding that a server is safe.
• Delegated and intent keys on Rightshold carry narrow scopes for the same reason: an agent gets only the permissions its task needs.

Rightshold does not connect to your database, hold your credentials or enforce permissions in your coding tool; the controls above live in your database, infrastructure and agent settings.

Sources

• Replit: Doubling down on our commitment to secure vibe coding (July 2025)
• The Register: Vibe coding service Replit deleted production database (July 2025)
• PostgreSQL: GRANT
• PostgreSQL: Continuous archiving and point-in-time recovery
• Amazon RDS: Deleting a DB instance (deletion protection)
• Claude Code settings: permission rules

Related

• How to vet an MCP server before installing it
• How to detect MCP tool description changes (rug pulls)
• How to stop Log-To-Leak style prompt injection through MCP tools

Not legal advice. Updated 2026-10-29. JSON · Markdown · All answers

curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_...   # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
  -H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'