AI agents are the next step beyond the chatbot: they don’t just answer questions, they act. They call tools, read and write data, kick off processes. The bridge between the language model and those tools is the Model Context Protocol (MCP). And the interesting question for us is: how do you let an agent loose on the Oracle database in a controlled way?

Oracle 26ai offers one answer: with Select AI Agent and a managed MCP endpoint, the database ships a ready-made path that exposes in-database tools and vector search directly as agent tools. As an API enthusiast, I offer my own answer: an MCP server over ORDS that exposes exactly the business logic I actually want to hand over.

That’s exactly what I did. I built an MCP server in TypeScript that talks to an existing ORDS API (Oracle 26ai, PL/SQL) and exposes around 60 declarative tools, purely through the REST API, without a single direct database call. Using this example, I show live what matters: how an OpenAPI contract turns into clean tools, how authentication runs through Keycloak (service account via client_credentials versus user-token passthrough in the context of the real user), and how role-based guardrails ensure an agent can only read what it’s allowed to read and only write what’s been approved.

But above all it’s about what really counts: security. Secret handling with no secrets in the code, multi-tenant isolation, the difference between local stdio operation and a server hosted remotely on Kubernetes, and the simple truth that write-capable tools never belong on the network unprotected. Which actions can we safely leave to the AI on its own, and where does the human belong in the loop?

This session includes detailed, hands-on live demos.