Summary
Google staff engineers Avery Kitsch (technical lead for MCP Toolbox for Databases) and Prerna Kakkar (tech lead for Eval Bench) present a conference talk at AI Engineer dissecting why developer tools that work perfectly at build time often fail or create security holes when deployed to production agents. The talk centers on Google’s open-source MCP Toolbox for Databases, which has accumulated 15.7K GitHub stars, 132+ contributors, and support for 40+ database types — and handled 20 million tool calls in a single month on its managed version.
The core framework distinguishes three tool archetypes: control plane (admin) tools requiring human-in-the-loop oversight, NL2SQL tools for flexible analytical queries, and structured SQL tools with predefined parameterized queries for production use cases. The structured approach prevents SQL injection, reduces hallucination, and enables tighter latency control — critical properties once agents run autonomously.
The second half focuses on security, introducing Simon Willis’s “lethal trifecta” concept: a data breach occurs when an agent simultaneously accesses private data, processes untrusted content, and can expose results externally. Kitsch walks through a concrete confused-deputy attack scenario where a malicious ticket tricks a triage agent into leaking salary data. Their mitigation separates three identity layers — user, application, and agent — and pairs Google’s managed MCP with Model Armor for identity-aware access control. The talk is essential viewing for teams moving database-connected agents from prototype to production.
📺 Source: AI Engineer · Published September 09, 2026
🏷️ Format: Deep Dive
