Veto — SQL Safety & Cost Oracle

com.vetosql由 vetosql.com 发布官方发布者v0.5.0更新于 Oct 25, 2026

Deterministic safety, correctness & cost gate that vets Postgres SQL before your AI agent runs it.

已验证Streamable HTTP可网页运行数据库开发者工具安全与监控

概览

AI 生成的概览

远程 MCP 服务器，在 AI 代理执行 Postgres SQL 和迁移前进行审查，返回确定性的 ok、warn 或 block 结论及发现项和成本。

可以做什么
分析 SQL 和迁移中的破坏性操作、锁风险、正确性陷阱、反模式和查询成本，返回带稳定发现项 ID 的结论，并在提供 schema DDL 时给出查询计划。为 Pro 密钥存储自定义组织策略集，用完整新集合替换或清空。读取当前存储的策略集，即分析时在内置规则之上额外执行的规则。
适用场景
当 AI 编程代理编写或执行 Postgres SQL 时，希望在运行前用确定性关卡拦截无条件的删除、DROP、重锁迁移和静默返回错误结果的查询。也适合在 CI 或代理流程中按具名规则 ID 做门禁。
运行要求
远程 streamable-HTTP 端点，无需安装或本地运行时。免费层无需密钥，限制为每分钟 60 次请求。Pro 功能需要付费订阅，并将 VETO 密钥作为 Authorization bearer 令牌请求头发送。需要能访问该托管服务的网络。
安装前请注意
Pro 功能需要付费订阅（每月 9.90 欧元）和 VETO 密钥，该密钥属于需保密的凭据。服务器只分析 SQL 文本、不连接你的数据库，但提交的 SQL 会发送到第三方托管服务。策略变更会整体替换已存储的集合，发送空数组会清空所有策略。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Veto — SQL Safety & Cost Oracle，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/com.vetosql%2Fveto/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "veto-sql-safety-cost-oracle": {
      "type": "http",
      "url": "https://vetosql.com/mcp"
    }
  }
}

README

Veto — SQL Safety & Cost Oracle (MCP)

Veto is a deterministic MCP server that vets Postgres SQL for safety, correctness, and cost before an AI coding agent runs it. It returns an ok / warn / block verdict on every statement — no LLM in the core, and it never connects to your database.

Website: https://vetosql.com · MCP endpoint: https://vetosql.com/mcp (remote, streamable-http)

AI coding agents (Claude Code, Cursor, …) write and execute SQL. Occasionally they write DELETE FROM payments with no WHERE, or a DROP TABLE during a migration. More prompting doesn't fix a probabilistic system — a deterministic gate does. Veto is that gate: given the same statement, it returns the same verdict, every time, with stable finding ids you can audit and gate CI on.

What it catches

VerdictMeaningWhat falls here
blockDestructive / data lossUnscoped DELETE/UPDATE, TRUNCATE, dropping data-bearing objects — including destructive statements hidden inside CTEs
warnRisky but recoverableLock-heavy schema changes, expensive scans, correctness traps that silently return wrong rows (= NULL, NOT IN (subquery), a LEFT JOIN filtered into an inner join), common anti-patterns like SELECT *
okSafe to runRoutine, reversible migrations

Every finding carries a stable dotted id (e.g. destructive.delete_without_where) so your pipeline can branch on it. The exact rule set lives server-side and evolves over time.

Why deterministic

  • Reproducible — same input, same verdict. Testable, so trustable.
  • Auditable — a named rule fired, not "the model felt it was risky."
  • No drift — can't be talked out of a block by a clever prompt; doesn't get worse on a bad day.
  • Never touches your DB — cost is measured with a real EXPLAIN on a throwaway scratch Postgres inside a transaction that is always rolled back. Your production database is never connected.

Tools

analyze_sql

Returns a deterministic safety + cost verdict for Postgres SQL / migrations.

InputTypeNotes
sqlstringThe SQL / migration to analyze — one or more statements (required)
schemastring?Optional CREATE TABLE/INDEX DDL — enables EXPLAIN-based cost analysis on scratch Postgres
rowCountHintsobject?Optional map of table name → estimated row count, for realistic cost estimates

Returns { verdict, findings[], plan?, meta } where verdict ∈ ok | warn | block.

set_policies (Pro)

Stores custom org policies keyed to your Pro key; analyze_sql then enforces them on top of the built-in rules. Policies are declarative data — validated and never executed (max 50, replaces the previously stored set).

Each policy: table (exact name or glob, e.g. payments, audit_*, *), operations (any of select/insert/update/delete/truncate/drop/alter), action (block/warn), optional message.

json
{  "policies": [    { "table": "payments", "operations": ["delete", "truncate"], "action": "block",      "message": "Never delete from payments — use the refund flow." }  ]}

Sending the full set updates it; sending an empty array clears it.

get_policies (Pro)

Returns the custom org policy set currently stored for your key — the same rules analyze_sql enforces on top of the built-ins. Read-only; returns an empty list if none are set.

Setup

Veto is a remote MCP server — no install, no source needed. Point your client at the endpoint.

Claude Code — .mcp.json

json
{  "mcpServers": {    "veto": {      "type": "http",      "url": "https://vetosql.com/mcp"    }  }}

Cursor — ~/.cursor/mcp.json

json
{  "mcpServers": {    "veto": {      "url": "https://vetosql.com/mcp"    }  }}

The free tier needs no key (60 req/min). Pro: add your VETO-… key as a bearer token (keep the word Bearer and the space):

json
"headers": { "Authorization": "Bearer VETO-…" }

Pricing

TierPriceLimitsExtras
Free€060 req/minFull deterministic verdict — all destructive, locking, correctness & cost rules
Pro€9.90 / mo1200 req/minCustom org policies (set_policies), maintainer support

Subscribe at vetosql.com.

FAQ

What databases does Veto support? PostgreSQL. Works with any Postgres host (Supabase, Neon, RDS, self-hosted) and any migration tool, because Veto analyzes the SQL text — it doesn't connect to your database.

Is it safe? Can it see or modify my data? No. Veto never connects to your production database. Cost analysis runs inside a transaction that is always rolled back, against a separate scratch Postgres — no data is read or written.

How is Veto different from a linter like Squawk or sqlfluff? Those are CI/style tools. Veto is a real-time runtime gate an AI agent calls over MCP, returning an ok/warn/block verdict on the exact statement it's about to execute — plus cost estimation and custom org policies.

Why not just give the agent a read-only or restricted DB role? Roles are coarse and easy to misconfigure, and they don't catch a costly sequential scan or a full-table UPDATE inside a write-allowed role. Veto adds a statement-level verdict on top of whatever roles you use.

Does it use an LLM? No. The core is deterministic static analysis + EXPLAIN. The calling agent narrates the structured verdict; the verdict itself never comes from a model.

Links

Built by Metawear. The hosted service runs at vetosql.com; this repository is the public documentation and MCP registry manifest for the Veto server.

来源：README.md，提交 91b3e06

工具

3

analyze_sql

Analyze SQL safety & cost

Analyze Postgres SQL/migrations for destructive operations, locking risk, correctness traps (NULL handling that silently returns wrong results), anti-patterns, and query cost. Returns a deterministic verdict (ok/warn/block) with findings. Pass the optional `schema` argument (your CREATE TABLE/INDEX DDL) to also get EXPLAIN-based cost analysis run on a throwaway scratch Postgres — no separate tool or DB connection needed.

输入参数sql必填schemadialectrowCountHints

set_policies

Set custom org policies (Pro)

Replace the stored custom org policy set for your Pro key (this is also how you update or clear them: send the full new set to update, or an empty array to remove all). Each policy blocks or warns on an operation against matching tables (e.g. no DELETE on payments). Policies are declarative data — validated, never executed — and apply transparently to every later analyze_sql call made with this key. Use get_policies to read the current set.

输入参数policies必填

get_policies

Get custom org policies (Pro)

Return the custom org policy set currently stored for your Pro key — the same rules analyze_sql enforces on top of the built-ins. Read-only; returns an empty list if none are set. Use set_policies to change them.

无需输入参数。

版本历史

1
  1. v0.5.0最新Sep 16, 2026

评分

已满足适用检查项的 90%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。