Veto — SQL Safety & Cost Oracle

com.vetosqlPublished by vetosql.comOfficial publisherv0.5.0Updated Oct 25, 2026

Deterministic safety, correctness & cost gate that vets Postgres SQL before your AI agent runs it.

VerifiedStreamable HTTPWeb executableDatabasesDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A remote MCP server that vets Postgres SQL and migrations before an agent runs them, returning a deterministic ok, warn or block verdict with findings and cost.

What you can do
Analyze SQL and migrations for destructive operations, locking risk, correctness traps, anti-patterns and query cost, returning a verdict with stable finding IDs and an optional query plan when schema DDL is supplied. Store a custom organization policy set for a Pro key, replacing or clearing it with a full new set. Read back the stored policy set that analysis enforces on top of built-in rules.
When to use it
Use it when an AI coding agent writes or executes Postgres SQL and you want a deterministic gate that flags unscoped deletes, drops, lock-heavy migrations and silently wrong queries before they run. Useful for gating CI or agent workflows on named rule IDs.
Requirements
A remote streamable-HTTP endpoint; no install or local runtime. The free tier needs no key and is limited to 60 requests per minute. Pro features need a paid subscription and a VETO key sent as an Authorization bearer token header. Network access to the hosted service.
Before you install
Pro features require a paid subscription (€9.90 per month) and a VETO key, which is a credential to keep private. The server analyzes SQL text and does not connect to your database, but the SQL you submit is sent to a third-party hosted service. Policy changes replace the whole stored set, and an empty array clears all policies.

Installation

In SourceWeft

  1. Open Veto — SQL Safety & Cost Oracle in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.vetosql%2Fveto/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "veto-sql-safety-cost-oracle": {
      "type": "http",
      "url": "https://vetosql.com/mcp"
    }
  }
}

README

Veto — SQL Safety & Cost Oracle (MCP)

Veto is a deterministic MCP server that vets Postgres SQL for safety, correctness, and cost before an AI coding agent runs it. It returns an ok / warn / block verdict on every statement — no LLM in the core, and it never connects to your database.

Website: https://vetosql.com · MCP endpoint: https://vetosql.com/mcp (remote, streamable-http)

AI coding agents (Claude Code, Cursor, …) write and execute SQL. Occasionally they write DELETE FROM payments with no WHERE, or a DROP TABLE during a migration. More prompting doesn't fix a probabilistic system — a deterministic gate does. Veto is that gate: given the same statement, it returns the same verdict, every time, with stable finding ids you can audit and gate CI on.

What it catches

VerdictMeaningWhat falls here
blockDestructive / data lossUnscoped DELETE/UPDATE, TRUNCATE, dropping data-bearing objects — including destructive statements hidden inside CTEs
warnRisky but recoverableLock-heavy schema changes, expensive scans, correctness traps that silently return wrong rows (= NULL, NOT IN (subquery), a LEFT JOIN filtered into an inner join), common anti-patterns like SELECT *
okSafe to runRoutine, reversible migrations

Every finding carries a stable dotted id (e.g. destructive.delete_without_where) so your pipeline can branch on it. The exact rule set lives server-side and evolves over time.

Why deterministic

  • Reproducible — same input, same verdict. Testable, so trustable.
  • Auditable — a named rule fired, not "the model felt it was risky."
  • No drift — can't be talked out of a block by a clever prompt; doesn't get worse on a bad day.
  • Never touches your DB — cost is measured with a real EXPLAIN on a throwaway scratch Postgres inside a transaction that is always rolled back. Your production database is never connected.

Tools

analyze_sql

Returns a deterministic safety + cost verdict for Postgres SQL / migrations.

InputTypeNotes
sqlstringThe SQL / migration to analyze — one or more statements (required)
schemastring?Optional CREATE TABLE/INDEX DDL — enables EXPLAIN-based cost analysis on scratch Postgres
rowCountHintsobject?Optional map of table name → estimated row count, for realistic cost estimates

Returns { verdict, findings[], plan?, meta } where verdict ∈ ok | warn | block.

set_policies (Pro)

Stores custom org policies keyed to your Pro key; analyze_sql then enforces them on top of the built-in rules. Policies are declarative data — validated and never executed (max 50, replaces the previously stored set).

Each policy: table (exact name or glob, e.g. payments, audit_*, *), operations (any of select/insert/update/delete/truncate/drop/alter), action (block/warn), optional message.

json
{  "policies": [    { "table": "payments", "operations": ["delete", "truncate"], "action": "block",      "message": "Never delete from payments — use the refund flow." }  ]}

Sending the full set updates it; sending an empty array clears it.

get_policies (Pro)

Returns the custom org policy set currently stored for your key — the same rules analyze_sql enforces on top of the built-ins. Read-only; returns an empty list if none are set.

Setup

Veto is a remote MCP server — no install, no source needed. Point your client at the endpoint.

Claude Code — .mcp.json

json
{  "mcpServers": {    "veto": {      "type": "http",      "url": "https://vetosql.com/mcp"    }  }}

Cursor — ~/.cursor/mcp.json

json
{  "mcpServers": {    "veto": {      "url": "https://vetosql.com/mcp"    }  }}

The free tier needs no key (60 req/min). Pro: add your VETO-… key as a bearer token (keep the word Bearer and the space):

json
"headers": { "Authorization": "Bearer VETO-…" }

Pricing

TierPriceLimitsExtras
Free€060 req/minFull deterministic verdict — all destructive, locking, correctness & cost rules
Pro€9.90 / mo1200 req/minCustom org policies (set_policies), maintainer support

Subscribe at vetosql.com.

FAQ

What databases does Veto support? PostgreSQL. Works with any Postgres host (Supabase, Neon, RDS, self-hosted) and any migration tool, because Veto analyzes the SQL text — it doesn't connect to your database.

Is it safe? Can it see or modify my data? No. Veto never connects to your production database. Cost analysis runs inside a transaction that is always rolled back, against a separate scratch Postgres — no data is read or written.

How is Veto different from a linter like Squawk or sqlfluff? Those are CI/style tools. Veto is a real-time runtime gate an AI agent calls over MCP, returning an ok/warn/block verdict on the exact statement it's about to execute — plus cost estimation and custom org policies.

Why not just give the agent a read-only or restricted DB role? Roles are coarse and easy to misconfigure, and they don't catch a costly sequential scan or a full-table UPDATE inside a write-allowed role. Veto adds a statement-level verdict on top of whatever roles you use.

Does it use an LLM? No. The core is deterministic static analysis + EXPLAIN. The calling agent narrates the structured verdict; the verdict itself never comes from a model.

Links

Built by Metawear. The hosted service runs at vetosql.com; this repository is the public documentation and MCP registry manifest for the Veto server.

Source: README.md at commit 91b3e06

Tools

3

analyze_sql

Analyze SQL safety & cost

Analyze Postgres SQL/migrations for destructive operations, locking risk, correctness traps (NULL handling that silently returns wrong results), anti-patterns, and query cost. Returns a deterministic verdict (ok/warn/block) with findings. Pass the optional `schema` argument (your CREATE TABLE/INDEX DDL) to also get EXPLAIN-based cost analysis run on a throwaway scratch Postgres — no separate tool or DB connection needed.

ParameterssqlrequiredschemadialectrowCountHints

set_policies

Set custom org policies (Pro)

Replace the stored custom org policy set for your Pro key (this is also how you update or clear them: send the full new set to update, or an empty array to remove all). Each policy blocks or warns on an operation against matching tables (e.g. no DELETE on payments). Policies are declarative data — validated, never executed — and apply transparently to every later analyze_sql call made with this key. Use get_policies to read the current set.

Parameterspoliciesrequired

get_policies

Get custom org policies (Pro)

Return the custom org policy set currently stored for your Pro key — the same rules analyze_sql enforces on top of the built-ins. Read-only; returns an empty list if none are set. Use set_policies to change them.

Takes no parameters.

Version history

1
  1. v0.5.0LatestSep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.