Block destructive SQL
DELETE and UPDATE without WHERE, DROP, TRUNCATE and risky DDL, inside CTEs and in every statement of a multi-statement string too. Every block comes with the rule, the AST node and a suggested fix.
SEMANTIC AST
Deterministic SQL firewall for AI agents
Your LLM generated a DELETE without WHERE. We blocked it before it reached production.
Connect it as a TCP proxy, an API, the CLI or MCP. Vericto parses each query's AST and blocks destructive operations before they reach your database.
AI agent
Vericto
Database
-
DELETE FROM usersBLOCKEDVERICTO-001DELETE without WHERE: it never reaches the database. The agent gets an SQL error and the suggested fix.DELETE FROM users WHERE id = $1 -
SELECT email FROM customersMASKEDVERICTO-085email is a sensitive column: the proxy rewrites the query and the database returns the masked value.a***@example.com -
SELECT id, total FROM orders WHERE id = $1ALLOWEDorders is in the agent's allowlist: the query passes untouched.id · total
No code changes required
No credit card required
Same query, same verdict, every time
FEATURES
What Vericto does with every query
A deterministic AST engine decides on every statement before it runs. Four controls run on top of it.
Mask sensitive columns
Tag columns such as email or card_number and decide per column: block, flag or mask (full, last4, email or hash). Through the TCP proxy, the database returns the value already masked. Team and Enterprise.
An allowlist per agent
Each agent uses only the tables and columns you give it, read-only or read-write. Everything else is denied. Start in observe and switch to enforce once the traffic confirms it. Team and Enterprise.
Simulate before you enforce
Replay a rule change against your real traffic (up to 30, 90 or 180 days depending on the plan) and see which legitimate flows it would block, before it blocks anything. From the dashboard or from CI. Builder, Team and Enterprise.
The panels reproduce the output as the docs describe it; the data is sample data.
- MCP: the agent checks its SQL while it writes it
- CLI and GitHub Action: fail the PR before the deploy
- LLM agents and Text-to-SQL
- Custom YAML rules over the AST
- Signed audit trail and alerts
- Fail-open by default, fail-closed if you choose
- Credentials never leave your network
- AST versus operation allowlists
COVERAGE
42 rules · 6 dialects · 8 incident families · 52 scenarios
Each scenario is a concrete SQL pattern a rule catches, tested against vericto-engine 4.1.1. It is counted once, not once per dialect or per position.
10
Mass data deletion or rewrite
DELETE and UPDATE without WHERE or with an always-true WHERE, TRUNCATE, MERGE, data-modifying CTEs
7
Schema destruction
DROP TABLE, DATABASE and SCHEMA, DROP COLUMN, RENAME, Snowflake CREATE OR REPLACE
6
Disabling protections
RLS and triggers disabled, constraints dropped, masking policies removed, unsafe SQLite PRAGMAs
10
Exfiltration and data leakage
Whole-table copies, sensitive columns, access outside the allowlist, Snowflake unloads and shares, ATTACH and VACUUM INTO
6
Code execution and privilege escalation
COPY … PROGRAM, DO blocks, GRANT, Snowflake role switches and tasks, load_extension
4
Injection and evasion
OR 1=1 tautologies, time-based probes, stacked statements, MySQL executable comments
5
Performance and cost
Unbounded SELECT, SELECT * without WHERE, batches over 10,000 rows, Snowflake warehouses
4
Recovery and data quality
Lossy type changes, INSERT without columns, DELETE … LIMIT 0, Snowflake retention set to 0
Who causes it
The same rule stops a person's mistake, an ORM bug and a compromised agent's attack. Each scenario is counted under its most typical origin:
- 5 Developer or DBA console
- 7 Application or ORM bug
- 9 CI/CD migration
- 9 AI agent or text-to-SQL
- 9 SQL-injection attacker
- 13 Insider or compromised agent
Inside the statement, not just at the top
A DELETE hidden in a CTE, a tautology in a derived table or a UNION arm, a DROP stacked after a COMMIT, an INSERT … SELECT inside a SQLite trigger: the engine walks the syntax tree down to 50 levels and evaluates every statement of a multi-statement string. Anything deeper, or anything the parser cannot read, does not pass silently: it is recorded as a parse error, and blocked if you choose parse_error: block.
Pathological nesting does not take it down
About 950 chained NOTs, roughly 4 KB of SQL, overflow a recursive parser's stack and kill the process running it. Vericto measures the text's nesting before parsing it and refuses anything past 200 levels: the proxy stays up and the statement is recorded as too complex (blocked under parse_error: block).
In 6 public incidents we documented, the destructive SQL (the published statement, or the one the mechanism implies) is BLOCKED by these rules when the connection goes through Vericto: a DELETE FROM on every production table, DROP TABLE requested from text-to-SQL frameworks (two CVEs), a schema push that dropped tables, COPY … TO PROGRAM on a "read-only" MCP server and a COMMIT; DROP SCHEMA that escaped a read-only transaction. The cases, with their sources.
HOW IT WORKS
Three steps. Start wherever you want.
Start wherever there's least friction: TCP proxy, Runtime API, CLI, Validation API or MCP. All five call the same deterministic AST engine, so the verdict is the same through any of them.
DELETE has no WHERE. English narration, with English and Spanish captions.Connect however you prefer
Five modes over the same engine. Two act at runtime and block inline; three act before execution, in your pipeline or in the agent's editor. How to choose.
AT RUNTIME
Proxy TCPjust change the connection string host; blocks inlineRuntime APIyour application asks before running; also Oracle, SQL Server, Snowflake and SQLite
BEFORE EXECUTION
CLIvalidates in pre-commit and CI, with an exit code by verdictValidation APIbatches of SQL over HTTPS, nothing to installMCPthe agent validates the SQL while it writes it
Vericto parses the full AST, not the text
Each query is parsed into its syntax tree: with pg_query (the Postgres parser) for Postgres and with sqlparser-rs for MySQL, Oracle, SQL Server, Snowflake and SQLite. The full tree, not just the first token or text patterns. The same engine in all five modes, so the verdict does not depend on where the statement came in.
DeleteStmt
relation: users
whereClause: NULL ⚠
Destructive ones blocked. Safe ones pass.
Queries that violate the ruleset are blocked with the offending AST node, the triggered rule and the suggested safe version. At runtime the statement never reaches the database; before execution, the verdict comes back as an exit code or as the agent's response. Clean ones pass untouched.
BLOCKED
DELETE FROM users
ALLOWED
SELECT * FROM users WHERE id = $1
INTEGRATIONS
Works with your current stack
Two ways in. On PostgreSQL and MySQL, the TCP proxy needs no code changes. On all six databases, the SDKs, the Runtime API, the CLI and MCP check SQL before it runs.
Databases
Zero code changes
TCP proxy
Point your connection string at the proxy. It works with any driver or ORM and blocks destructive queries inline, before they reach the database.
Set up the proxy →
All six databases
SDK, Runtime API, CLI and MCP
The Python and Node SDKs and the Runtime API check each query before your code runs it. The CLI and MCP check SQL before it ships.
Frameworks & tools
- LangChainSQL agent guard in the Python and JS SDKs
- dbt
vericto-dbt checkreviews compiled models in CI - AirflowSQL operator and cluster policy in the Python SDK
- MCPRemote server:
check_sqlfor Claude Code, Kiro and more - GitHub ActionsThe
vericto/check-sqlaction annotates findings on the PR - GitLab CIReady-made job:
vericto initwith--target gitlab
Not on the list? Any PostgreSQL or MySQL driver works through the proxy, and the Runtime API works from any language. See all integrations →
SOC 2 · ISO 27001
Audit evidence, ready every month
What Vericto blocks and records in production is already the evidence a SOC 2 or ISO 27001 auditor asks for. Vericto delivers it ready to read, and signed:
- Ed25519-signed PDF report with every export: period summary, rules, controls and configuration. From the Team plan.
- Mapping to 12 controls in SOC 2 (CC6.1–CC8.1) and ISO 27001 (A.5.18–A.8.32), with what weakens them.
- A report every month, kept 13 months on Enterprise: the full audit period, without exporting anything by hand.
PRICING
Simple pricing. No surprises.
Prices exclude tax. Any VAT, GST or sales tax due in your country is added at checkout.
Team
$249/mo
- 50M queries/mo
- Go over the volume with no cut-off: we let you know
- Sensitive columns and agent access
Enterprise
From
$2,500
/mo
- Annual contract
- 99.9% SLA (Standard); 99.95% and 99.99% with a dedicated deployment
- Automatic monthly compliance report, kept 13 months
Billed annually, Builder is $63/month and Team $199/month.
START TODAY
Your AI agent shouldn't have unrestricted access to production.
Connect your first database in less than 5 minutes.
No credit card required
Onboarding in <5 minutes
Cancel anytime
Deterministic and verifiable. We don't ask for blind trust.
Vericto does not use AI to decide what to block. The engine, the proxy and the CLI are public source, and every claim on this page can be checked.
Public source
The AST engine, the TCP proxy and the CLI, on GitHub, source-available under the Functional Source License (FSL-1.1-ALv2), which becomes Apache-2.0 two years after each version: vericto-engine, vericto-proxy, vericto-cli.
CLI on npm
Install it and check your migrations against your rules:
@vericto/vericto-cliEvidence you can verify offline
Compliance reports are signed with Ed25519 and your auditor checks the signature with the public key, with no account and no network. How to verify them.
Public changelog and status
Every release, with what changed and why, in the changelog. Service availability on the status page.
+0.42 ms
What the proxy added at p50 on PostgreSQL with 1 connection, measured on staging on October 16, 2026 (vericto-proxy 4.12.0, 0.25 vCPU ARM64 task, Aurora Serverless v2 at 10 ACU, TLS, enforce mode). A measurement, not a guarantee: conditions and method.
Deterministic
The same query with the same rules always gets the same verdict. Before you enforce a rule, the simulator shows which legitimate flows it would block.