Add Gatekeeper plugin to community-plugins.json

[Gldywn]

Gatekeeper puts a human approval in front of every SQL statement an AI agent proposes. The agent submits SQL over MCP, the statement shows up in Beekeeper Studio, and it only runs after someone clicks approve on the visible SQL text. Read-only is the default.

gatekeeper-demo.mp4

Entry added to community-plugins.json, since Gatekeeper is a third-party plugin and not published by Beekeeper Studio.

Security model

The agent is treated as untrusted input, and the human approval is the security boundary.

• The agent never receives a connection or credentials. Approved statements run inside the plugin, on Beekeeper Studio's already authenticated connection. Nothing is executed by the MCP server.
• Execution requires an explicit human decision. Every statement, including reads, is approved by a click on the SQL text as submitted. Nothing an agent sends runs on its own.
• Read-only by default. Write (INSERT / UPDATE) and destructive (DELETE / DROP / TRUNCATE / ALTER) statements need a mode the human arms explicitly, with a second confirmation by default. That mode lives in memory only, is never persisted, and resets to read-only on connection switch or re-pair. The plugin re-classifies the statement and re-checks the armed mode at execution time.
• Fail-closed classification. The plugin parses each statement in the connection's dialect, escalates on modifying nodes hidden in CTEs, subqueries or MySQL executable comments, and classifies as destructive when a parse fails, so an unreadable statement needs the strictest confirmation instead of slipping through as a read.
• Loopback only, authenticated. The local broker binds 127.0.0.1, rejects any request whose Host header is not the expected loopback host (421, DNS-rebinding defense), and requires an Authorization: Bearer capability token on every request. The token is generated on first run, stored 0600 inside a 0700 directory, and reaches the plugin through a single-use 6-digit pairing code with an attempt cap.
• Visible-by-construction review. Unicode bidirectional overrides and other invisible characters are surfaced as [U+XXXX] markers in the approval card, the audit trail and every export, so the reviewer sees exactly what was submitted. The executed SQL is never altered by that display step.

Limits are documented rather than glossed over: read mode limits statement shape, not runtime side effects of volatile functions, and the capability token does not create a boundary between two processes running as the same OS user. Both are stated in SECURITY.md, along with the threat model, retention windows and the supply-chain policy.

Registry readiness

• Latest release, v0.2.0 at the time of writing: releases/latest, carrying the two required assets, manifest.json and gatekeeper-0.2.0.zip, with the tag matching the manifest version.
• manifest.json: id gatekeeper, manifestVersion 1, minAppVersion 5.4.0, one base-tab view and a Tools menu command.
• Public repository, MIT licensed, with a README and a security policy.

The entry points at the repository rather than a fixed version, so the plugin manager keeps resolving the latest release.

Links

• Repository: https://github.com/Gldywn/gatekeeper
• Security policy: https://github.com/Gldywn/gatekeeper/blob/main/SECURITY.md
• Latest release: https://github.com/Gldywn/gatekeeper/releases/latest