Secretless record
Sharing another connection never creates another secret to rotate.
Provider resource, environment, policy, and revision travel with the workspace connection. A long-lived database secret does not.
Open source · Alpha · Local execution
Before you hand Codexyour prod database.
An Agent can ignore a system prompt. It cannot ignore authority. DopeDB pins every Agent to one connection at one revision, and a write runs only as the exact payload a human approved.
Personal Workspace needs no account · macOS and Windows · MIT licensed
Shared accessAccess boundary / reference flow
Exact scope
Team workspace
billing-prod · revision 12
Connection identity + policy · no password
Member access
Individual credential
OS store or short-lived managed lease
Agent session
Codex · pinned
Workspace + account + revision + process
Local execution
PostgreSQL · production
Database traffic never crosses the workspace service
No shared secret
Operation receipt
- Shared record
- Carries no password
- Managed access
- Neon · GCP · PlanetScale
- Agent authority
- Exact connection revision
- Query path
- Runs from your desktop
01 / Shared access
Share the connection, not the key.
One shared account makes every audit entry look like the same person. DopeDB gives the team what the database is and leaves how to open it with each member.
Member-specific access
Every teammate arrives through their own credential path.
Bind a credential in the member's OS store or issue a least-privilege, expiring managed credential for a supported provider.
Connection-pinned Agent
Every Agent inherits an exact grant, never the connection list.
Official Codex and Claude sessions are launched against one workspace, account, connection revision, process, and local policy.
02 / Desktop boundary
Your queries never pass through our servers.
DopeDB is not a database proxy. We know who may reach what; credentials, queries, results, cancellation, and rollback all happen on your machine. The only results that leave it are the bounded fragments a person reviewed and shared. With a connection already synchronized, our service going down does not stop your database work.
Captured from DopeDB Desktop
00:08 · REAL UIBundled demo data · no customer data
Control plane/Identity · policy · revisionsLocal boundary/Credentials · queries · recovery
Enforced, not prompted
Safety lives outside the Agent.
Authority, approval, and recovery are not promises the Agent keeps for you. They are bound to the operation itself, and the handles a human needs stay on screen.
Exact authority
Workspace role, connection grant, database privilege, revision, and local policy must agree.
Exact approval
Writes and DDL become immutable proposals. The Agent cannot approve its own payload.
Human recovery
Observe active work, cancel execution, roll back a supported transaction, and inspect the receipt.
03 / Exact operation
An approval screen makes the Agent faster.
When what is allowed and what can be undone are settled in advance, nobody has to confirm every step. Stop only the dangerous ones.
Operation console
Awaiting approvalBOUNDARY / OPERATION 0194
workspace team / production
connection billing@revision-12
member grant use + write
agent codex / process verified
PROPOSED WRITE
UPDATE customers
SET plan = 'pro'
WHERE id = 1842;
classification write
approval exact payload required
recovery manual transaction rollback
receipt pending human decision- / 01
Share the connection
Create a secretless workspace definition with one verified target.
- / 02
Resolve member access
Bind a local credential or receive a member-specific managed lease.
- / 03
Launch the Agent
Start the official adapter against that exact connection revision.
- / 04
Approve and recover
Review exact writes, stop work, roll back, and retain the result trail.
Before you trust it
Not convinced? Ask these first.
Do my queries pass through your servers?
No. The workspace service coordinates membership, connection metadata, policy, provider resources, revisions, and collaboration audit. Database traffic continues to run from your Desktop.
If I share a connection, does my database password go up with it?
No. Member-local credentials remain in that member's OS store. Supported managed access returns an expiring member-specific credential and does not persist the issued secret.
Can an Agent approve the write it just wrote?
No. Risky SQL becomes an immutable proposal. A human approves the exact payload in Desktop before the operation can proceed.
If DopeDB goes down, do we lose our database?
No. An already synchronized connection with your own credential keeps working, and Personal Workspace never needed an account. New managed credentials and membership or policy changes wait until the service is back.
Can I use it in production today?
It is still an alpha. Verify the supported provider and recovery scope, use least-privilege database roles, and validate your workflow before it touches production data.
ALPHA
Open-source alpha
Put one real connection in. The account can wait.
Personal Workspace runs without signing in. Sign in only when you want team sharing or managed provider access.
Building from source needs Rust 1.94+ · Node.js 24 · pnpm 11.17.0.
Choose a build · this browser will mark the best match
Legacy macOS alpha releases may show a developer warning.
For releases published before Developer ID notarization, confirm the file came from GitHub Releases, then use System Settings → Privacy & Security → Open Anyway.
Windows alpha installers may show a SmartScreen warning.
The installer is not code-signed yet. Confirm the file came from GitHub Releases, then choose More info → Run anyway.
Product evidence