You can now use Kviklet to manage agentic access to database. Kviklet now has an MCP server! 🎉 Connect AI agents like Claude Code or Codex directly to your Kviklet instance and they will go through the exact review requirements that humans have to go through:

claude mcp add --transport http kviklet https://<your-instance>/api/mcp

You log in to Kviklet in the browser, approve the client, and from then on the agent acts with your own permissions. It can create and list requests, execute approved ones, look at configuration and more, but everything still goes through the same reviews and ends up in the audit log. The agent gets no shortcut around the four-eyes principle. Admins can switch the MCP server on or off under Settings → MCP, where every user can also find the ready-to-copy setup commands for their instance.

The MCP server is an enterprise only feature. If you want to try it out, feel free to contact us via https://kviklet.dev/ for a trial license.

Other notable changes:

• Kviklet now shows a banner when a newer version is out
• Database warnings (e.g. Postgres skipping an ANALYZE because of missing permissions) are now shown alongside query results
• Invalid MongoDB queries now return a helpful error instead of a generic 500
• Result downloads of large queries no longer fail with HTTP 414 behind reverse proxies
• Fixed listing requests when there are more than Postgres's parameter limit
• Fixed Swagger UI and Redoc showing the wrong API docs
• NULL cells in stored query results stay readable

Full changelog:

• Only reset approvals when an edit actually changes what was reviewed by @Askir in #595
• Keep the stored role ARN when a connection update leaves it out by @Askir in #599
• Show the license in force in the config by @Askir in #601
• MCP server by @Askir in #603
• Send the OAuth provider under the name the login page reads by @DerkSchooltink in #613
• Update nginx base image to 1.30 stable by @Askir in #617
• Show a banner when a newer Kviklet is out by @Askir in #616
• Fix Swagger UI and Redoc showing the wrong API docs by @Askir in #615
• Bump Playwright to 1.64.1 by @Askir in #619
• Show database warnings with query results by @DerkSchooltink in #618
• Use POST for result downloads to avoid URL length limits by @prithvin in #614
• Return invalid MongoDB queries as error results by @Askir in #621
• Bump frontend dependencies by @Askir in #620
• Keep NULL cells readable in stored query results by @Askir in #622
• Upgrade to Zod 4 by @Askir in #623

New Contributors

• @prithvin made their first contribution in #614

Full Changelog: 0.9.2...0.10.0

This release fixes two major security issues, we recommend to update asap if you use any of the mentioned features:

• Fixed: Approved Kubernetes requests no longer allow arbitrary commands by authorized users with execute permission without further reviews
• Fixed: Live Sessions no longer log resultset verbatim into the application log

Full Changelog: 0.9.1...0.9.2

A few fixes onto 0.9.0 mainly supporting IAM Auth in the proxy code as well as username/password auth.

What's Changed

• Show a disabled license upload area to non-admins by @Askir in #585
• Align connection table columns across categories by @Askir in #586
• Support AWS IAM authentication for proxied sessions by @Askir in #587
• Report IAM token failures as connection errors instead of a 500 by @Askir in #588
• Let the stock mysql CLI and PyMySQL connect to the MySQL proxy by @Askir in #589

Full Changelog: 0.9.0...0.9.1

The main story of this release is that the proxy now also works for mariadb and mysql!! 🎉
However we have also significantly reworked the postgres proxy and made it much more robust. In turn the whole proxy feature is now enterprise only though. It was previously only ever an experiment, and is now slowly graduating into a fully supported feature.

Still carefuly in beta, but give it a shot and let us know if you find anything off!

Other than that there is a few furhter UX improvements, some security cleanup as well as a functioning rejections of running sessions and a new deactivate button for existing users, in case you use the password login or need to free up slots on your enterprise license!

Additionally Kviklet now tracks anonymous usage statistics, you can disable this via an env var. But it helps us to continue improving the product!

Full changelog:

• Fix flaky WebSocketHandlerTest timing by @Askir in #536
• Proxy cleanup by @Askir in #559
• Automate the README screenshots via the e2e stack by @Askir in #560
• Resolve demo chart dependency at deploy time instead of from a committed lock by @Askir in #561
• End temporary-access proxy sessions when a request is rejected by @Askir in #562
• Improve temporary access sessions with a shared workspace by @Askir in #563
• Show the proxy connection card in place of the session editor by @Askir in #564
• Use a better-mixing hash for avatar bubble colors by @Askir in #566
• Break the LiveSession screenshot query across three lines by @Askir in #565
• Show rejected temporary access sessions as rejected instead of expired by @Askir in #567
• Return to the originally requested page after login by @Askir in #569
• Build event DTOs from the event itself instead of the parent's events collection by @Askir in #570
• Store ids as VARCHAR without trailing-space padding by @Askir in #571
• Remove the Open session link from the requests list by @Askir in #573
• Add a request type filter to the requests page by @Askir in #574
• Use authenticated encryption with key ids for stored credentials by @Askir in #575
• Replace user deletion with deactivation by @Askir in #576
• Fix Dependabot alerts in frontend dependencies by @Askir in #577
• Add anonymous usage telemetry via PostHog by @Askir in #578
• Add inline search to the connection and author filter dropdowns by @Askir in #572
• Slightly cleanup readme by @Askir in #579
• Open clipped result cells in a full-value dialog by @Askir in #580

Full Changelog: 0.8.0...0.9.0

It's been a while since we pushed a new release. This one is heavily focused on UI/UX polish. There are few actual new features in this release but a lot of cleanup. Kviklet over all should feel nicer to use. There is also more features coming of course, and as always: If you find a bug or miss something do not hesitate to open an issue!

The most important changes are:

• GitHub-style review sidebar with one-click Approve, plus a widened review page and newest-first activity ordering
• The UI is now permission-aware: buttons and pages you can't use are hidden or disabled based on your roles
• Filters on the requests page (connection, author, date range) and nicer request list cards
• Approved single-execution requests can now be executed by anyone with execute rights, not just the author
• AWS IAM authentication for MariaDB connections
• Time-range filtering for the audit log (Enterprise feature)
• Teams notifications are fixed and now use Adaptive Cards

Full list of changes

• hide the username and password fields by default when oidc is configured by @DerkSchooltink in #439
• Show author and connection name on request list cards by @Askir in #445
• Polish request list layout and mobile responsiveness by @Askir in #446
• Fix live session layout issues and mobile responsiveness by @Askir in #448
• Overhaul spinner with indigo color and context-aware sizes by @Askir in #449
• Fix Monaco editor not responding to dark/light mode toggle by @Askir in #450
• Serialize LocalDateTime as UTC and add local-time tooltips by @Askir in #454
• Add time-range filtering to audit log (enterprise) by @Askir in #456
• Add GitHub OAuth2 SSO support by @Askir in #458
• Send Teams notifications as Adaptive Cards and widen webhook column by @Askir in #486
• Allow an IdP group to map to multiple roles in role sync by @Askir in #490
• Reflect connection type in the new-request header by @Askir in #493
• Validate create-user form fields client-side by @Askir in #501
• Allow clearing a connection category once set (#470) by @Askir in #500
• Fix false JSON error when deleting a role-sync mapping (#466) by @Askir in #499
• Auto-dismiss toasts and remove them from the queue (#476) by @Askir in #503
• Populate Kubernetes request fields once pods load (#472) by @Askir in #502
• Reject connection creation when the id is already taken by @Askir in #504
• Simplify result download by @Askir in #505
• Allow non-authors to execute approved single execution requests by @Askir in #510
• Order review page activity newest first with the comment box on top by @Askir in #511
• Streamline entry into temporary access sessions by @Askir in #509
• Fix loading spinner alignment across pages by @Askir in #512
• Support AWS IAM authentication for MariaDB connections by @Askir in #513
• Allow comments on rejected requests by @Askir in #514
• Add cross-site request protections for session auth by @Askir in #515
• Remove DENY policy support. RBAC becomes ALLOW-only by @Askir in #517
• Make UI Permission-aware by @Askir in #516
• Widen review page container to allow more SQL to be visible by @joannakimberlyw in #520
• Link the connection name on the review page to its settings page by @Askir in #521
• GitHub-style review sidebar with one-click Approve by @Askir in #522
• Fix SSO broken by empty Java trust store in Docker image by @ztnewman in #525
• Fix rejected concurrent execution clearing the active session lock by @Askir in #528
• Add connection, author, and date range filters to the requests page by @Askir in #529

New Contributors

• @joannakimberlyw made their first contribution in #520
• @ztnewman made their first contribution in #525

Full Changelog: 0.7.0...0.8.0

Not going to wait a full year again for a release! There have been a bunch of cool features since 0.6.0 so here we go!

Headline features:

• Role sync between IDP and Kviklet roles (Enterprise feature)
• Store execution results in the kviklet db
• Dry run execution requests within transactions
• Configure specific role reviews as requirements for Requests (Enterprise feature)
• And a bunch of QoL fixes

Full list of changes

• Consolidate IdP user sync logic into UserAuthService by @Askir in #410
• Restructure identity provider files into dedicated packages by @Askir in #411
• Normalize IdP principals to UserDetailsWithId at login time by @Askir in #412
• Add role sync feature for IdP group-to-role mapping by @Askir in #413
• Fix license status not updating after upload by @Askir in #416
• Prevent double submission on execution request creation by @Askir in #417
• Add non-MIT license headers to role sync files by @Askir in #418
• Add close endpoint for request authors to withdraw requests by @Askir in #419
• Add grid and list view toggle for connection selection by @Askir in #420
• Update app version to 0.6.0 in docs, charts by @sh-cho in #424
• Add category field to connections for organization by @Askir in #421
• Add "Create category" option for new categories in autocomplete by @Askir in #427
• Fix e2e test by fixing connection creation test ids by @Askir in #428
• Add optional result storage for execution requests by @Askir in #422
• Add version info footer displaying build metadata by @Askir in #429
• Fix new optional fields breaking temporary access requests by @Askir in #431
• Add dry run execution feature by @Askir in #432
• Add role-based review requirements (enterprise feature) by @Askir in #434
• Fix MongoDB stored results display in event history by @Askir in #436
• Add user:get permission to default role by @Askir in #437
• feat: Make the kubernetes exec command timeout configurable per connection by @itungxp in #415
• Add review gates docs and enterprise feature highlights by @Askir in #442
• Clear Spring Sessions on upgrade to fix OIDC deserialization error by @Askir in #441
• Fix all Dependabot security alerts in frontend dependencies by @Askir in #443

New Contributors

• @sh-cho made their first contribution in #424
• @itungxp made their first contribution in #415

Full Changelog: 0.6.0...0.7.0

What's Changed

• Consolidate IdP user sync logic into UserAuthService by @Askir in #410
• Restructure identity provider files into dedicated packages by @Askir in #411
• Normalize IdP principals to UserDetailsWithId at login time by @Askir in #412
• Add role sync feature for IdP group-to-role mapping by @Askir in #413
• Fix license status not updating after upload by @Askir in #416
• Prevent double submission on execution request creation by @Askir in #417
• Add non-MIT license headers to role sync files by @Askir in #418
• Add close endpoint for request authors to withdraw requests by @Askir in #419
• Add grid and list view toggle for connection selection by @Askir in #420
• Update app version to 0.6.0 in docs, charts by @sh-cho in #424
• Add category field to connections for organization by @Askir in #421
• Add "Create category" option for new categories in autocomplete by @Askir in #427
• Fix e2e test by fixing connection creation test ids by @Askir in #428
• Add optional result storage for execution requests by @Askir in #422
• Add version info footer displaying build metadata by @Askir in #429

New Contributors

• @sh-cho made their first contribution in #424

Full Changelog: 0.6.0...0.7.0-pre

It has been a long time since we released a version but it is finally here.
May the next one only take a few weeks!

What's New

There have been a bunch of small fixes since 0.5.1 see the PR list below.
The main notable change is about that temporary Access requests have been overhauled under the hood:

• They now use websockets, this means you can see live what other people are executing in terms of queries and even see the results (Kviklet still does not store results on the server side)
• They also have a live log of what is being executed
• They can now have a max request time configured.

Additionally this is the first release that is not only open source. In addition to the features above we are shipping a few enterprise features that you unlock via a license file. Contact us via our website https://kviklet.dev/ or directly at jascha@kviklet.dev for more details. The enterprise version allows the following features:

• Downloading of the audit log as a simpel text file
• Authentication via SAML (OIDC and LDAP are still available for free)
• Access directly to kviklet API via API Keys for e.g. automating connections in Kviklet via custom scripts

Paying for a license ensures the continued development of Kivklet, Thank you for your support!

Some other small neat features:

• There is a new healthcheck endpoint
• The requests page is now paginated so if you have a lot of requests it should still load fine!
• LDAP has slightly better configuration options (see readme)
• Descriptions can now be longer than 255 characters (whoops)
• You can now use certificates to authenticate kviklet with its own db
• It is now possible to create connections with AWS IAM Auth as the auth mechanism (postgres and mysql only)
• You can now configure a base url for notifications to ensure slack and teams point to the right path

The full list of PRs since the last release is here:

• Add option to manage MySQL Dump requests by @Askir in #228
• Add a CONTRIBUTING.md by @Askir in #230
• Add health check endpoint by @Askir in #233
• Bump path-to-regexp from 6.2.1 to 6.3.0 in /frontend by @dependabot[bot] in #236
• Allow setting a custom search base for LDAP by @Askir in #238
• Bump vite from 4.5.3 to 4.5.5 in /frontend by @dependabot[bot] in #239
• Add option to configure access time when creating a Request by @Askir in #242
• Bump rollup from 3.29.4 to 3.29.5 in /frontend by @dependabot[bot] in #244
• Allow descriptions longer than 255 characters by @Askir in #245
• Fix postgres proxy not respecting configured max time by @Askir in #249
• Add synchronized Live Sessions behind feature flag (beta) by @Askir in #251
• Add activity history to live session by @Askir in #254
• Bump cross-spawn from 7.0.3 to 7.0.6 in /frontend by @dependabot[bot] in #260
• Update playwright to latest version by @Askir in #266
• Bump nanoid from 3.3.6 to 3.3.8 in /frontend by @dependabot[bot] in #264
• Allow to use certificate auth for kviklet db by @Askir in #268
• Update README by @Askir in #269
• Add helm chart and move to gcs demo by @Askir in #272
• Fix proxy not supporting infinite request times by @Askir in #273
• Add option for AWS iam auth in connections by @Askir in #278
• Update jvm deps by @Askir in #279
• Support IAM Auth for Kviklets own db by @Askir in #280
• Allow editing authentication method by @Askir in #292
• Allow users to disable temp access by connection by @Askir in #295
• Allow explain without approval and being author, only explain selects by @Askir in #296
• Make explain feature configurable for each connection by @Askir in #300
• Disable Explain and Download buttons when criteria are not met by @Askir in #301
• Ensure password is not accidentally reset when not edited by @Askir in #306
• Fix Table overlaying drop down; disable run button when executed or n… by @Askir in #307
• Indentation of "externalSecretName" is wrong by @CloudyDevops375 in #283
• Change authentication mechanism for users when new ones are accepted by @Askir in #312
• Add test for case of switching oidc providers by @Askir in #313
• Update chart values.yaml to refer to main image for now by @Askir in #314
• Make csv download on error display error message and not retry by @Askir in #315
• Reset execution and approval count on error by @Askir in #317
• Don't reset reviews on temporary access requests after failed statement by @Askir in #318
• Fix some Readme typos by @Askir in #319
• Implement role assumption in RDS IAM connections by @DerkSchooltink in #310
• Remove AWS Demo deploy by @Askir in #325
• Allow configuration of host url for notifications, ignore health check in url introspection by @Askir in #326
• Allow sections of code to not be MIT licensed by @Askir in #328
• Saml support by @Askir in #329
• Slightly improve execution request loading by @Askir in #332
• Fix CSV export encoding issue with special characters by @Askir in #333
• Bump vite from 4.5.5 to 4.5.14 in /frontend by @dependabot[bot] in #334
• Refactor pg proxy by @dd-georgiev in #309
• Allow sending cookies cross origin by @Askir in #338
• Add max temporary access duration by @Askir in #342
• Add /api to saml paths for in docker deployments by @Askir in #343
• Update gradle to newest 8.X release by @Askir in #344
• Disable arm build by @Askir in #345
• Enable arm build of docker image by @Askir in #346
• Attempt to fix gradle build on arm64 by using docker included version of gradle by @Askir in #347
• Add the option to create API keys to create connections automatically. by @Askir in #349
• Add missing images for api keys by @Askir in #350
• Add the option to download the audit log as a text file by @Askir in #351
• Change button component property names by @Askir in #352
• Align settings table styles to be more consistent by @Askir in #353
• Fix creating kubernetes connections by @Askir in #357
• Fix kubernetes statement execution by @Askir in #358
• Fix testing connections without temp access by @Askir in #360
• Unify maxtemp access cleaning in hooks by @Askir in #361
• Allow configurable java memory management via JAVA_OPTS env by @muhammad-asn in #340
• Add CSV download and query cancellation to WebSocket live sessions by @Askir in #366
• Bump tmp and inquirer in /frontend by @dependabot[bot] in #369
• Bump form-data from 4.0.0 to 4.0.4 in /frontend by @dependabot[bot] in #368
• Provide a default pw for userdetails of non pw users in ApiKey flow by @Askir in #374
• Bump vite and @vitejs/plugin-react in /frontend by @dependabot[bot] in #370
• Fix null pointer exceptions in SQL parser validation by @Askir in #375
• Fix validation logic for Dump request type by @Askir in #376
• Bump form-data from 4.0.0 to 4.0.4 in /frontend by @dependabot[bot] in #377
• Fix HTTP login loop by making cookie security configurable based on SAML by @Askir in #371
• Fix security vulnerabilities in frontend and e2e dependencies by @Askir in #384
• Paginate /requests response and store review and execution status in execution requests table by @Askir in #379
  ...

A few fixes for issues discovered on the pre release.

What's Changed

• Fix license file loading to prefer newest valid by @Askir in #402
• Add single auth provider validation by @Askir in #403
• Fix WebSocket ClassCastException for OIDC and SAML users by @Askir in #406

Full Changelog: v0.6.0-pre...v0.6.0-pre2

Pre-release v0.6.0

It has been a long time since we released a version, since a few users might still be on v0.5.0 and there are significant changes since then. There will be a few days or weeks where we collect any feedback from this pre release before publishing the full v0.6.0

What's New

God this is a long list but I try to give an overview:

• Temporary Access requests now use websockets, this means you can see live what other people are executing in terms of queries and even see the results (we still don't store results on the server side)
• Temporary Access requests also have a live log of what is being executed
• Temporary Access requests now can have a max request time.
• There is a new healthcheck endpoint
• LDAP has slightly better configuration options (see readme)
• Descriptions can now be longer than 255 characters (whoops)
• You can now use certificates to authenticate kviklet with its own db
• It is now possible to create connections with AWS IAM Auth as the auth mechanism (postgres and mysql only)
• You can now configure a base url for notifications to ensure slack and teams point to the right path
• The requests site is now paginated!

Additionally this is the first release that is not only open source. In addition to the features above we are shipping a few enterprise features that you unlock via a license file. Contact us via our website https://kviklet.dev/ or directly at jascha@kviklet.dev for more details. The enterprise version allows the following features:

• Downloading of the audit log as a simpel text file
• Authentication via SAML (OIDC and LDAP are still available for free)
• API Keys for e.g. automating connections in Kviklet via custom scripts

Paying for a license ensures the continued development of Kivklet, Thank you for your support!

The full list of PRs since the last release is here:

• Add option to manage MySQL Dump requests by @Askir in #228
• Add a CONTRIBUTING.md by @Askir in #230
• Add health check endpoint by @Askir in #233
• Bump path-to-regexp from 6.2.1 to 6.3.0 in /frontend by @dependabot[bot] in #236
• Allow setting a custom search base for LDAP by @Askir in #238
• Bump vite from 4.5.3 to 4.5.5 in /frontend by @dependabot[bot] in #239
• Add option to configure access time when creating a Request by @Askir in #242
• Bump rollup from 3.29.4 to 3.29.5 in /frontend by @dependabot[bot] in #244
• Allow descriptions longer than 255 characters by @Askir in #245
• Fix postgres proxy not respecting configured max time by @Askir in #249
• Add synchronized Live Sessions behind feature flag (beta) by @Askir in #251
• Add activity history to live session by @Askir in #254
• Bump cross-spawn from 7.0.3 to 7.0.6 in /frontend by @dependabot[bot] in #260
• Update playwright to latest version by @Askir in #266
• Bump nanoid from 3.3.6 to 3.3.8 in /frontend by @dependabot[bot] in #264
• Allow to use certificate auth for kviklet db by @Askir in #268
• Update README by @Askir in #269
• Add helm chart and move to gcs demo by @Askir in #272
• Fix proxy not supporting infinite request times by @Askir in #273
• Add option for AWS iam auth in connections by @Askir in #278
• Update jvm deps by @Askir in #279
• Support IAM Auth for Kviklets own db by @Askir in #280
• Allow editing authentication method by @Askir in #292
• Allow users to disable temp access by connection by @Askir in #295
• Allow explain without approval and being author, only explain selects by @Askir in #296
• Make explain feature configurable for each connection by @Askir in #300
• Disable Explain and Download buttons when criteria are not met by @Askir in #301
• Ensure password is not accidentally reset when not edited by @Askir in #306
• Fix Table overlaying drop down; disable run button when executed or n… by @Askir in #307
• Indentation of "externalSecretName" is wrong by @CloudyDevops375 in #283
• Change authentication mechanism for users when new ones are accepted by @Askir in #312
• Add test for case of switching oidc providers by @Askir in #313
• Update chart values.yaml to refer to main image for now by @Askir in #314
• Make csv download on error display error message and not retry by @Askir in #315
• Reset execution and approval count on error by @Askir in #317
• Don't reset reviews on temporary access requests after failed statement by @Askir in #318
• Fix some Readme typos by @Askir in #319
• Implement role assumption in RDS IAM connections by @DerkSchooltink in #310
• Remove AWS Demo deploy by @Askir in #325
• Allow configuration of host url for notifications, ignore health check in url introspection by @Askir in #326
• Allow sections of code to not be MIT licensed by @Askir in #328
• Saml support by @Askir in #329
• Slightly improve execution request loading by @Askir in #332
• Fix CSV export encoding issue with special characters by @Askir in #333
• Bump vite from 4.5.5 to 4.5.14 in /frontend by @dependabot[bot] in #334
• Refactor pg proxy by @dd-georgiev in #309
• Allow sending cookies cross origin by @Askir in #338
• Add max temporary access duration by @Askir in #342
• Add /api to saml paths for in docker deployments by @Askir in #343
• Update gradle to newest 8.X release by @Askir in #344
• Disable arm build by @Askir in #345
• Enable arm build of docker image by @Askir in #346
• Attempt to fix gradle build on arm64 by using docker included version of gradle by @Askir in #347
• Add the option to create API keys to create connections automatically. by @Askir in #349
• Add missing images for api keys by @Askir in #350
• Add the option to download the audit log as a text file by @Askir in #351
• Change button component property names by @Askir in #352
• Align settings table styles to be more consistent by @Askir in #353
• Fix creating kubernetes connections by @Askir in #357
• Fix kubernetes statement execution by @Askir in #358
• Fix testing connections without temp access by @Askir in #360
• Unify maxtemp access cleaning in hooks by @Askir in #361
• Allow configurable java memory management via JAVA_OPTS env by @muhammad-asn in #340
• Add CSV download and query cancellation to WebSocket live sessions by @Askir in #366
• Bump tmp and inquirer in /frontend by @dependabot[bot] in #369
• Bump form-data from 4.0.0 to 4.0.4 in /frontend by @dependabot[bot] in #368
• Provide a default pw for userdetails of non pw users in ApiKey flow by @Askir in #374
• Bump vite and @vitejs/plugin-react in /frontend by @dependabot[bot] in #370
• Fix null pointer exceptions in SQL parser validation by @Askir in #375
• Fix validation logic for Dump request type by @Askir in #376
• Bump form-data from 4.0.0 to 4.0.4 in /frontend by @dependabot[bot] in #377
• Fix HTTP login loop by making cookie security configurable based on SAML by @Askir in #371
• Fix security vulnerabilities in frontend and e2e dependencies by @Askir in #384
• Paginate /requests response and store review and execution status in execution requests table by @Askir in #379
• Bump vite from 7.1.9 to 7.1.12 in /frontend...