RaisinDB 0.3: A Versioned Database AI Agents Can Safely Connect To, With Row-Level Security, an Audit Trail and a Secrets Vault

Between the 0.2.0 release on 2 August and version 0.3.20 today, RaisinDB added a native Model Context Protocol server and client, row-level security for graph queries, an audit log that attributes changes to users and agents, and an encrypted secrets vault. On maravilla.cloud, two new services for RaisinDB tenants enter partner preview: Maravilla Connect and the Maravilla AI gateway.

MCP on Both Sides

RaisinDB serves the current Model Context Protocol specification, dated 28 July 2026, so assistants can connect to a tenant directly. Access runs through OAuth 2.1, including service accounts for automated agents, and tools can return interactive views following the MCP Apps proposal.

RaisinDB can also act as an MCP client and connect to external MCP servers, so functions and flows inside the database can use tools offered elsewhere. Changes to the available tools are announced live in both directions.

Guardrails Inside the Database

• Row-level security for graphs: The same access rules that apply to documents now also apply to graph queries through GRAPH_TABLE. The older CYPHER(...) function was withdrawn from SQL, so every graph query goes through the enforced path.
• Audit log: A persistent record of changes that names both the user and the agent acting on their behalf.
• Secrets vault: Envelope encryption with key identifiers and a keyring. Fields marked as encrypted in a schema are stored in the vault automatically and stay encrypted through copies, promotions and replication.
• Pinned reads: Point-in-time reads pinned to an exact revision, so an agent's view of the data does not shift while it works.

Connected to the Tools Teams Already Use

Connectors bring external data into the content tree as mounted, virtual nodes, with a write path back to the source: for example, marking an email as read. The Microsoft Graph connector covers shared mailboxes and SharePoint, and IMAP accounts can be connected with their own credentials. Functions can send email through a provider configured once per tenant, under a deny-by-default policy, and applications can offer sign-in by magic link.

On maravilla.cloud: Connect and the AI Gateway

Maravilla Connect lets a RaisinDB tenant on maravilla.cloud connect external services without registering its own OAuth applications with each provider. Maravilla holds the provider registrations and handles the token exchange; the broker does not keep users' access tokens. The first managed connector is Stripe, with checkout, the billing portal, refunds and webhook delivery.

The Maravilla AI gateway gives tenants one OpenAI-compatible API for text generation and embeddings, with model aliases for fast and reasoning workloads. Usage is metered in prepaid credits, API keys can be scoped and capped, and the gateway does not store prompts or responses. Models are served by international upstream providers, and Apertus, the open Swiss language model, is served from a data center in Switzerland.

Both services are available as a partner preview for organizations on maravilla.cloud.

Facts

• RaisinDB is written in Rust and organized into more than 40 crates.
• Client libraries are available for JavaScript, Python and Java.
• Its replication model is specified in TLA+ and checked with the TLC model checker.
• It is source-available under the Business Source License 1.1; each version converts to Apache 2.0 four years after release.

About Maravilla Labs

Maravilla Labs is a software research laboratory based in Basel, Switzerland focused on building original developer infrastructure. The lab develops systems for source control, software distribution, hosting, and runtime execution with an emphasis on simplicity, security, and open architecture.

Projects developed by Maravilla Labs include systems for git hosting, package registries, CI and CD execution, static hosting, edge runtime infrastructure and the versioned content database RaisinDB.