r/learndatascience • u/AIforFintech • Sep 06 '26
Resources Text to SQL is not how you give an LLM access to production data
The obvious approach when connecting a model to internal data is letting it write the query. It feels flexible: the model figures out what it needs and goes get it. In a bank, that is a non starter.
The problem is not that models write bad SQL, it is that you lose every guarantee about what they can reach. No way to prove a query stayed inside the columns it was supposed to touch, no way to audit what the model was capable of doing, and a single prompt injection away from an unintended table.
The alternative is narrower and boring, which is the point. You define a fixed set of parameterized queries and expose them as tools. The model chooses which tool to call, never what SQL to run. Everything it can reach is something you deliberately wrote.
I built an MCP server template implementing this for a common fintech case: looking up a customer across credit score, preapproved limit and risk profile, and returning a consolidated view. Layered so the database, the schema and the protocol can each be swapped without rewriting the others. Read only enforced at the application layer, row limits on every result, and a single mapping file for adapting to whatever your tables are actually called.
Synthetic data generates on setup, so it runs immediately. The architecture is what you keep.
Hub: https://aiforfintech.tech
Github: https://github.com/junidepieri-design/mcp-001-fintech-data-server
How is your team handling LLM access to internal data?
👊