SwarmDB

Overview

SwarmDB is a database designed from the ground up for multi-agent state management. It launched October 5, 2026 (232 HN points) as the first general-purpose database whose primary workload is concurrent agent access rather than human queries.

The design thesis is straightforward: agents don't read schemas or write ad-hoc SQL. They read and write structured state through tool calls, in parallel, at high frequency, with access controls that span both users and agents. SwarmDB abstracts that workload natively, providing an MCP server and SDK that treat agents as first-class principals.

SwarmDB supports the OWASP Agentic Top 10 v2.1 categories directly: prompt injection via tool output (A06), agent privilege escalation (A07), memory poisoning (A08), and cross-agent coordination attacks (A09) all have native mitigations.

Features

• Agent identities as principals — every agent has its own identity, permissions, and audit log entries; agents don't share service accounts
• Tool-call-native data model — state access is expressed as MCP tool calls, not SQL queries; the server translates to the underlying storage
• Cross-agent transaction isolation — concurrent agent writes are atomic per agent identity; cross-agent transactions require explicit coordination
• Built-in access control across agents — ACLs can constrain agent A from reading state written by agent B, or vice versa
• Streaming snapshots — long-running agent queries can stream partial results matching MCP 2.2 streaming semantics
• Memory-poisoning resistance — A08 mitigation through write-verification: every write is tagged with the writing agent, and reads can filter by writer identity
• Cross-agent coordination primitives — locks, barriers, and coordination tokens designed for agent swarms (built-in support for SwarmAuth)
• MCP 2.2 native — cross-server chaining and streaming results are supported out of the box

Installation

# Docker
docker pull swarmdb/server:latest
docker run -p 6432:6432 swarmdb/server:latest

# Homebrew
brew install swarmdb/tap/swarmdb

# npm package (embedded mode)
npm install swarmdb

Quick Start

from swarmdb import SwarmDB

db = SwarmDB.connect(url="swarmdb://localhost:6432")

# Create a schema for agent state
db.create_schema("project-tasks", {
    "title": "string",
    "assignee_agent_id": "agent_identity",
    "status": "enum:open,in_progress,done",
    "created_at": "timestamp",
})

# Agent A writes a task
client_a = db.client(agent_id="agent:planner-v1")
task_id = client_a.insert("project-tasks", {
    "title": "Fix the auth bug",
    "assignee_agent_id": "agent:coder-v2",
    "status": "open",
})

# Agent B queries tasks assigned to it
client_b = db.client(agent_id="agent:coder-v2")
assigned = client_b.query("project-tasks", where={"assignee_agent_id": "agent:coder-v2"})

Advanced Features

• Writer-provenance filtering — reads can specify which agents' writes to include, mitigating memory poisoning (A08)
• Audit log replay — every mutation is recorded with agent identity and timestamp; can be replayed for forensic analysis
• Snapshot-based time travel — query the database as of any past timestamp
• Cross-database coordination — multiple SwarmDB instances can coordinate through MCP 2.2 cross-server chaining
• Built-in monitoring — usage per agent, throughput, and anomaly detection

MCP Configuration

{
  "mcpServers": {
    "swarmdb": {
      "command": "swarmdb-mcp",
      "args": ["--url", "swarmdb://localhost:6432"],
      "env": {
        "SWARMDB_API_KEY": "***"
      }
    }
  }
}

Examples

A multi-agent planning workflow:

planner = db.client(agent_id="agent:planner-v1")
coder   = db.client(agent_id="agent:coder-v2")
reviewer = db.client(agent_id="agent:reviewer-v1")

# Planner creates tasks
for req in requirements:
    planner.insert("project-tasks", {"title": req.title, "assignee_agent_id": "agent:coder-v2"})

# Coder picks up tasks assigned to it
while task := coder.query_one("project-tasks", where={"assignee_agent_id": "agent:coder-v2", "status": "open"}):
    coder.update(task.id, {"status": "in_progress"})
    coder.run_task(task)  # Your task execution logic
    coder.update(task.id, {"status": "done"})

# Reviewer filters to only done tasks authored by the coder
reviewed = reviewer.query(
    "project-tasks",
    where={"status": "done", "writer_agent_id": "agent:coder-v2"},
)

Pros

• First database whose primary workload is agent access, not human queries
• Native access control across agent identities
• OWASP v2.1 compliance built in
• MCP 2.2 native for cross-server chaining and streaming
• Writer-provenance filtering prevents memory poisoning attacks

Cons

• Newer database with less provenance at scale than established systems
• Smaller ecosystem and fewer migration tools
• Not a replacement for human-facing databases — best as agent-state layer

When to Use

• Building multi-agent systems where agent state is the primary data model
• Needing cross-agent access control at the storage layer
• Wanting OWASP Agentic Top 10 v2.1 compliance as a substrate concern
• Wanting writer-provenance for auditability

Resources

• Website: https://swarmdb.dev
• GitHub: https://github.com/swarmdb/server
• Docs: https://swarmdb.dev/docs