I've been building QueryBear (https://querybear.com) to fix the database part of this: instead of giving an agent your raw connection string, you give it a read-only MCP URL that only exposes the tables you approve and logs every query. The agent can still query your DB, answer business questions, help debug — it just can't delete anything.