How is this different from connecting Airbyte MCP directly?

Connected directly, an agent sees every tool the server exposes and holds the credential itself. Through TrustGate you choose which tools each agent gets, and every call is logged against the agent that made it.

What if the Airbyte MCP API changes?

We track the Airbyte MCP schema, so the tool catalogue stays current. Tools you have already allowed keep working, and anything new stays denied until you enable it.

Can I give different agents different Airbyte tools?

Yes. Access is set per agent: one can get a handful of read tools, another the full set. You grant the whole MCP or single tools within it.

Where can I see what my agents did in Airbyte?

Every call is logged against the agent that made it, with the tool it used. Activity can be sent on to your own monitoring.

Do I need to run the Airbyte MCP server myself?

No. TrustGate connects to the Airbyte MCP server and sits in front of it. Your agent only talks to your TrustGate URL, never to Airbyte directly.

Connect Airbyte MCP to your AI agents, securely.

Q: Is Airbyte MCP secure?

The server itself exposes 46 tools, and some of them can write to your Airbyte account. Behind TrustGate an agent only sees the tools you allow, requests and responses are inspected, and every call is logged. Anything outside the allowlist is denied before it reaches Airbyte.

One secured endpoint for every Airbyte call your AI agents make, scoped per user, inspected, and logged.

Get started for free

Get a demo

Try Airbyte MCP now

What your agents can ask once Airbyte MCP is connected.

Select the tools your AI agents can call

46 tools from the Airbyte MCP schema.

Showing 46 tools

list_cloud_connectionsreadLists the connections in a workspace.
describe_cloud_connectionreadGets a connection's details, including its streams, schedule and status.
get_connection_artifactreadReturns a connection's state or its configured catalog.
get_cloud_sync_statusreadReturns the status of a sync job.
list_cloud_sync_jobsreadLists the recent sync jobs for a connection.
get_cloud_sync_logsreadReads the logs from a sync job, for troubleshooting failures.
create_connection_on_cloudwriteCreates a connection between a source and a destination.
rename_cloud_connectionwriteRenames a connection.
set_cloud_connection_table_prefixwriteSets the table prefix a connection writes under.
update_cloud_connectionhigh riskTurns a connection on or off, or changes its sync schedule.
set_cloud_connection_selected_streamshigh riskChooses which streams a connection syncs, which decides what data moves at all.
run_cloud_synchigh riskStarts a sync, moving real data between systems and consuming credits.
cancel_cloud_synchigh riskCancels a running sync, which can leave a partial load in the destination.
permanently_delete_cloud_connectionhigh riskDeletes a connection. It only works if the connection's name contains delete-me or deleteme, so a person has to rename it first.
list_cloud_connectorsreadLists the sources and destinations in a workspace.
describe_cloud_connectorreadGets a source or destination's details, including its configuration, its connections and its direct read instructions.
check_cloud_connectorreadTests the configuration and credentials of a source or destination.
deploy_connector_to_cloudwriteCreates a source or destination in a workspace.
deploy_noop_destination_to_cloudwriteCreates a no-op destination for testing a source without writing anywhere real.
rename_cloud_connectorwriteRenames a source or destination.
update_cloud_connector_confighigh riskChanges the configuration of a source or destination, which is the credentials and settings a live pipeline runs on.
permanently_delete_cloud_connectorhigh riskDeletes a source or destination. It only works if the name contains delete-me or deleteme.
get_default_cloud_contextreadReturns the default organization and workspace for the signed-in user.
list_cloud_organizationsreadLists the organizations the user can access.
describe_cloud_organizationreadGets details about an organization.
get_cloud_organization_billing_statusreadReturns billing and account status for an organization. Requires an organization reader or admin role, and is Airbyte Cloud only.
list_cloud_workspacesreadLists the workspaces the user can access.
describe_cloud_workspacereadGets details about a workspace, such as its name, URL and organization.
set_default_cloud_workspacewriteChanges the default workspace. This also changes the default workspace in the Airbyte web app.
list_custom_source_definitionsreadLists the custom connectors in a workspace.
get_custom_source_definitionreadGets a custom connector, including its YAML manifest.
get_connector_builder_draft_manifestreadGets the unpublished draft of a custom connector from the Connector Builder.
publish_custom_source_definitionhigh riskPublishes a YAML manifest as a custom connector, shipping code that will run against real systems with stored credentials.
update_custom_source_definitionhigh riskUpdates a custom connector's YAML manifest.
permanently_delete_custom_source_definitionhigh riskDeletes a custom connector. It only works if the name contains delete-me or deleteme.
list_connectorsreadSearches the Airbyte connector catalog.
get_connector_inforeadReturns a connector's metadata, documentation URL and configuration specification.
get_connector_version_historyreadReturns a connector's recent versions and changelog.
get_api_docs_urlsreadReturns links to the documentation for a connector's third-party API.
search_airbyte_knowledge_sourcesreadSearches Airbyte's documentation, website, API specifications, YouTube videos and GitHub content. Hosted server only.
show_workspace_sync_statusreadShows a sync status dashboard for a workspace, as an interactive view in clients that support MCP Apps.
show_connection_sync_historyreadShows sync history, success rates and volume for a connection.
show_connectors_listreadShows a browsable catalog of Airbyte connectors.
get_agent_skill_docsreadReturns a connector skill: the entities, actions and parameters a source or destination supports for direct reads. The agent reads this before reading data, so it does not guess at parameter names.
execute_external_api_queryreadReads live records from a source's API with the list and get actions. The third-party system sees the credentials stored in that connector, not the caller's. It cannot create, update or delete records.
execute_external_sql_queryreadRuns a read-only SQL query on a Snowflake or BigQuery destination. Only SELECT statements and SHOW TABLES are allowed.

What Airbyte MCP exposes

Airbyte MCP groups its 46 tools into 7 categories, each with a suggested starting policy.

All 46 tools as JSON, ready to paste.

Category	Covers	Access	Suggested policy
Connections & Syncs	Listing and describing connections with their streams, schedule and status, creating and renaming them, turning them on or off, choosing which streams sync, setting the table prefix, reading connection state and catalog, deleting connections, and starting, cancelling and troubleshooting sync jobs	Read / Write	run_cloud_sync moves real data and consumes credits, and set_cloud_connection_selected_streams changes what data moves at all. Delete only works on a resource already renamed to contain delete-me
Sources & Destinations	Listing and describing sources and destinations including their configuration and direct read instructions, creating them, creating a no-op destination for testing, testing credentials, renaming, reconfiguring and deleting	Read / Write	update_cloud_connector_config changes the credentials and settings a live pipeline runs on, and describe_cloud_connector returns that configuration. deploy_noop_destination_to_cloud is the safe way to exercise a source without writing anywhere real
Workspaces & Organizations	The default organization and workspace, the organizations and workspaces the user can access with their details, organization billing and account status, and changing the default workspace	Read / Write	set_default_cloud_workspace also changes the default in the Airbyte web app, so an agent call alters what a person sees next time they log in
Custom Connectors	Listing custom connectors in a workspace, reading one with its YAML manifest, fetching an unpublished Connector Builder draft, publishing a manifest as a custom connector, updating it and deleting it	Read / Write	Publishing a manifest ships code that will run against real systems with stored credentials. Treat it as a deployment, not a metadata edit
Connector Registry & Docs	Searching the Airbyte connector catalog, connector metadata with documentation URL and configuration specification, version history and changelog, third-party API documentation links, and search across Airbyte's own documentation, site, API specs, videos and GitHub	Read	Read-only reference lookups against public material. search_airbyte_knowledge_sources is only available on the hosted server
Dashboards	Interactive views rendered through MCP Apps: a workspace sync status dashboard, sync history with success rates and volume for a connection, and a browsable connector catalog	Read	Read-only, and they degrade to plain text in clients without MCP Apps support
Direct Reads	Reading live records straight from a source's API with list and get actions, running read-only SELECT and SHOW TABLES against a Snowflake or BigQuery destination, and fetching the connector skill that tells the agent which entities and parameters a connector supports	Read	This is the one path where the request reaches a third-party system under the connector's stored credentials rather than the caller's identity. It needs an organization admin to enable the context layer and turn on agent access per connector, and it is Cloud only

Connect Airbyte MCP to your AI agent

Four steps, under ten minutes.

01
Sign in to NeuralTrust
Open the NeuralTrust platform, sign in and go to Getting started, then Connect your tools.
02
Choose your agent
When asked which agent you use, pick Claude Code, Codex, Cursor, Windsurf, Copilot or your own code.
03
Connect Airbyte
Find Airbyte in the tool list and connect it.
04
Connect your agent
Follow the steps on screen to add the config to your agent, then send the test prompt.

Permissions down to the single tool

You do not allow Airbyte MCP or block it. You allow the exact tools each agent can call, one by one.

Airbyte MCP	46 TOOLS AVAILABLE
Code review agent	4 tools, read only
Issue triage bot	9 tools
Platform team assistant	all 46 tools

Tool by toolConnecting the server is not the unit of access. Each tool is granted on its own.
Default denyA tool you have not enabled is never exposed to the agent.
Approval on writesTools that change or delete things can require a human to confirm.

Is Airbyte MCP secure?

One endpoint instead of raw credentials. Every call is checked against policy and logged.

AI agentsConnect through your MCP client configuration.	NeuralTrustApply controls based on your configuration.	Airbyte MCP46 documented tools, in open beta. Every tool tells the client whether it is read-only or destructive, delete tools require the resource name to contain delete-me or deleteme, and destructive tools can be hidden through advanced configuration.
Coding assistants	Connection & credentialsper user	Connections & Syncs14 tools
Internal copilots	Tool access policiesdeny by default	Sources & Destinations8 tools
Workflow automations	Request & response inspectioninline	Workspaces & Organizations7 tools
Compatible MCP clients	Activity monitoringalerts and logs	All other tools17 tools