Understand an Oracle schema
Ask your AI to list the permitted tables and describe their columns and relationships before writing a query. Schema discovery keeps the discussion grounded in the structures visible to the restricted user.
Databases · MCP Firewall integration
Protect Oracle access with scoped reads and reviewed changes.
Use GateRook’s MCP Firewall to control AI access to one Oracle service through JDBC Thin. Keep database credentials in GateRook, restrict schemas and tables, and separate bounded read queries from changes that require approval by default. Database grants remain an independent security boundary.
Connection in GateRook
stage-oracle
Oracle Database
stage / QA- Name / environment
- stage-oracle / stage
- Host / port
- oracle.example.test / 1522
- Service name
- orders.example.test
- User / password
- GATEROOK_READER / enter in GateRook
The security boundary
Your AI requests a tool. GateRook checks its mode and policy, requires approval when configured, and resolves credentials locally before an allowed call runs.
Understand the request flowAsk your AI
Read pending orders from APP.ORDERS through stage-oracle. Return no more than ten rows and do not change anything.
sql_query · arguments
{
"connection": "stage-oracle",
"sql": "SELECT ORDER_ID, STATUS, TOTAL FROM APP.ORDERS WHERE STATUS = 'PENDING' ORDER BY ORDER_ID",
"limit": 10
}Example result
{
"columns": [
"ORDER_ID",
"STATUS",
"TOTAL"
],
"rows": [
[
"48213",
"PENDING",
"149.00"
],
[
"48214",
"PENDING",
"89.50"
]
],
"rowCount": 2,
"truncated": false
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Useful access. Explicit control.
What you can do with Oracle Database and AI
Investigate a business record
Read a small set of orders or processing records from trusted tables. Use explicit columns and filters, and check whether the result was truncated before drawing conclusions.
Review a targeted correction
When writes are needed, expose sql_execute in Approval mode and keep database grants narrow. Review the exact target and SQL, then use a separate read to verify the result and inspect the call in Activity.
From service to MCP Firewall
How to connect Oracle Database
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select Oracle Database. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Prepare a restricted Oracle user
Use Oracle Database 19c or later and a dedicated user with CREATE SESSION and SELECT on the intended tables or trusted views. Grant write access only when needed. Confirm that the computer running GateRook can reach the service through your existing network or VPN.
Add the service connection
In Connections, choose Add connection and Oracle Database. Set the name and environment, listener host and port, service name, and protected user credentials. Supply the service name directly rather than a SID or TNS alias.
Configure TLS and schema scope
In Advanced, match SSL mode to the listener and keep verify-full for a TCPS server. Add its private CA when required. Set the schema allowlist and an explicit default schema when the login reads another schema; use uppercase for unquoted Oracle identifiers.
Test connectivity and begin with reads
Run Test connection and review the database identity, connectivity and permissions. Save only the intended service. Start with schema discovery and a bounded SELECT against a known table; leave sql_execute Off until you intend to review changes.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure Oracle Database in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Name / environment | stage-oracle / stage | Choose Oracle Database in Connections. The values in this guide are illustrative; replace the host, service, user and schema with your own. |
Host / port | oracle.example.test / 1522 | Use the host and TCP port of your Oracle listener. Port 1522 here illustrates a configured TCPS listener; the form defaults to 1521. Verify the actual listener port with your administrator. |
Service name | orders.example.test | Enter an Oracle service name. One connection reaches one service; SID connections, TNS aliases and Oracle wallets are not supported. |
User / password | GATEROOK_READER / enter in GateRook | Use a dedicated database user with only the required grants. Enter the password in the protected connection field, not in a prompt or tool arguments. Do not use SYS. |
SSL mode / CA certificate | verify-full / your private CA PEM when needed | The default verifies the CA and host name over TCPS. The chosen port must have a TLS listener. An empty CA field uses the system trust store; verify-ca omits host-name verification and disable uses unencrypted TCP. |
Default schema / schema allowlist | APP / APP | Default schema is the authenticated user unless specified. Set APP explicitly when using a reader account for another schema, and allow only the needed schemas. Unquoted Oracle names are uppercase; double-quote case-sensitive names. |
Statement timeout / connection timeout | 5000 ms / 5000 ms | Choose a bounded statement timeout for the workload; an unset statement timeout follows policy. The connection timeout defaults to 5000 ms. Oracle query cancellation rounds the statement timeout up to whole seconds. |
Pool size | 2 | The default is two connections; supported values are one through ten. Environment policies may tighten query limits. |
Know what you expose
Oracle Database tools and access boundaries
The connector defines available operations. GateRook’s MCP Firewall enforces endpoint modes and connection policies before an AI client can use them.
| Tool | Purpose | Access behavior |
|---|---|---|
sql_list_schemas | List schemas and accessible tables or views within the connection and policy allowlists. | Read only |
sql_describe_table | Inspect a permitted table or view, including columns, types, indexes and foreign keys. Qualify the schema when it differs from the default. | Read only |
sql_query | Run one analyzed SELECT or WITH ... SELECT with supported built-in functions, in an explicit read-only transaction that is rolled back afterward. Row, size and timeout limits apply. | Read only |
sql_execute | Request a permitted SQL change. Approval shows the exact statement and target; Oracle schema changes carry an implicit-commit warning. | Approval by default |
Before you enable access
- One connection targets one Oracle service. SID connections, TNS aliases and Oracle wallets are not supported; configure separate connections for separate services.
- Read calls run in an explicit read-only transaction and are rolled back. Oracle autonomous routines can still produce side effects through trusted views or implicit function references, so restrictive database grants and trusted schema objects remain necessary.
- The connector refuses procedural PL/SQL, database links, sequence-state expressions and explicit unknown function calls. It is not an unrestricted SQL console, and statements must be analyzed before they can run.
- Changes require approval by default. To retain human review, keep sql_execute in Approval mode and do not select Bypass. Database privileges, schema/table allowlists and DDL policies still apply after approval.
- Oracle DDL commits implicitly and cannot be rolled back; the approval preview warns about this. Plan-based impact estimates are unavailable because Oracle EXPLAIN PLAN writes to a plan table.
- Query results may contain business or personal data. GateRook applies configured masking and row, response-size and timeout limits, but you must choose the data exposed to your AI client.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
Oracle Database connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Which Oracle versions and connection methods are supported?
The built-in connector targets Oracle Database 19c and later using JDBC Thin and an explicit host, port and service name. It does not accept SID connections, TNS aliases or Oracle wallets.
Why does the default TLS connection fail against port 1521?
verify-full uses TCPS and requires a TLS-enabled Oracle listener. Check the actual listener port, server certificate name and CA chain. The default port does not establish that the server provides TCPS on that port.
Why can GateRook not find my table?
Check the user grants, schema allowlist and default schema. Unquoted Oracle names use uppercase. If the username comes from an external credential provider, set the default schema explicitly or use a qualified table name for introspection.
Can AI run PL/SQL or Oracle EXPLAIN PLAN?
No. This connector blocks procedural PL/SQL and EXPLAIN PLAN. The latter writes a plan table, so GateRook also leaves Oracle plan-based impact estimates unavailable rather than producing side effects while preparing an approval.
Does approval make an Oracle schema change reversible?
No. Oracle DDL commits implicitly even when a GateRook policy allows it and a person approves it. Keep DDL disabled when it is unnecessary and review the implicit-commit warning before an allowed schema change.
Keep exploring
Extend control across your stack
SQL Server
Put SQL Server behind GateRook’s MCP Firewall. Select databases and schemas, keep credentials local, and review SQL writes before execution.
PostgreSQL
Put PostgreSQL behind GateRook’s MCP Firewall. Follow the illustrated setup, scope AI queries, approve an UPDATE and inspect its Activity audit trail.
MySQL
Control MySQL access through GateRook’s MCP Firewall. Configure a scoped login, run read queries, approve an UPDATE and inspect each call in Activity.
Your MCP Firewall. Your access rules.
Control AI access to Oracle Database.
Start with read-only access. Approve changes. Inspect the audit trail.