Veto — SQL Safety & Cost Oracle

com.vetosql由 vetosql.com 發布官方發布者v0.5.0更新於 Oct 25, 2026

Deterministic safety, correctness & cost gate that vets Postgres SQL before your AI agent runs it.

已驗證Streamable HTTP可網頁執行資料庫開發者工具安全與監控

概覽

AI 產生的概覽

遠端 MCP 伺服器，在 AI 代理執行 Postgres SQL 與遷移前先行審查，回傳確定性的 ok、warn 或 block 判定及發現項目與成本。

可以做什麼
分析 SQL 與遷移中的破壞性操作、鎖定風險、正確性陷阱、反模式與查詢成本，回傳附穩定發現項目 ID 的判定，並在提供 schema DDL 時附上查詢計畫。為 Pro 金鑰儲存自訂組織原則集，以完整新集合取代或清空。讀取目前儲存的原則集，也就是分析時在內建規則之上額外套用的規則。
適用情境
當 AI 程式開發代理撰寫或執行 Postgres SQL 時，希望在執行前以確定性關卡攔截無條件的刪除、DROP、高鎖定遷移與默默回傳錯誤結果的查詢。也適合在 CI 或代理流程中依具名規則 ID 做門檻檢查。
執行需求
遠端 streamable-HTTP 端點，無需安裝或本機執行環境。免費方案不需金鑰，限制為每分鐘 60 次請求。Pro 功能需要付費訂閱，並將 VETO 金鑰以 Authorization bearer 權杖標頭送出。需要能連線至該託管服務的網路。
安裝前請注意
Pro 功能需要付費訂閱（每月 9.90 歐元）與 VETO 金鑰，該金鑰屬於需保密的憑證。伺服器只分析 SQL 文字、不連線你的資料庫，但送出的 SQL 會傳送至第三方託管服務。原則變更會整批取代已儲存的集合，送出空陣列會清空所有原則。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Veto — SQL Safety & Cost Oracle，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/com.vetosql%2Fveto/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "veto-sql-safety-cost-oracle": {
      "type": "http",
      "url": "https://vetosql.com/mcp"
    }
  }
}

README

Veto — SQL Safety & Cost Oracle (MCP)

Veto is a deterministic MCP server that vets Postgres SQL for safety, correctness, and cost before an AI coding agent runs it. It returns an ok / warn / block verdict on every statement — no LLM in the core, and it never connects to your database.

Website: https://vetosql.com · MCP endpoint: https://vetosql.com/mcp (remote, streamable-http)

AI coding agents (Claude Code, Cursor, …) write and execute SQL. Occasionally they write DELETE FROM payments with no WHERE, or a DROP TABLE during a migration. More prompting doesn't fix a probabilistic system — a deterministic gate does. Veto is that gate: given the same statement, it returns the same verdict, every time, with stable finding ids you can audit and gate CI on.

What it catches

VerdictMeaningWhat falls here
blockDestructive / data lossUnscoped DELETE/UPDATE, TRUNCATE, dropping data-bearing objects — including destructive statements hidden inside CTEs
warnRisky but recoverableLock-heavy schema changes, expensive scans, correctness traps that silently return wrong rows (= NULL, NOT IN (subquery), a LEFT JOIN filtered into an inner join), common anti-patterns like SELECT *
okSafe to runRoutine, reversible migrations

Every finding carries a stable dotted id (e.g. destructive.delete_without_where) so your pipeline can branch on it. The exact rule set lives server-side and evolves over time.

Why deterministic

  • Reproducible — same input, same verdict. Testable, so trustable.
  • Auditable — a named rule fired, not "the model felt it was risky."
  • No drift — can't be talked out of a block by a clever prompt; doesn't get worse on a bad day.
  • Never touches your DB — cost is measured with a real EXPLAIN on a throwaway scratch Postgres inside a transaction that is always rolled back. Your production database is never connected.

Tools

analyze_sql

Returns a deterministic safety + cost verdict for Postgres SQL / migrations.

InputTypeNotes
sqlstringThe SQL / migration to analyze — one or more statements (required)
schemastring?Optional CREATE TABLE/INDEX DDL — enables EXPLAIN-based cost analysis on scratch Postgres
rowCountHintsobject?Optional map of table name → estimated row count, for realistic cost estimates

Returns { verdict, findings[], plan?, meta } where verdict ∈ ok | warn | block.

set_policies (Pro)

Stores custom org policies keyed to your Pro key; analyze_sql then enforces them on top of the built-in rules. Policies are declarative data — validated and never executed (max 50, replaces the previously stored set).

Each policy: table (exact name or glob, e.g. payments, audit_*, *), operations (any of select/insert/update/delete/truncate/drop/alter), action (block/warn), optional message.

json
{  "policies": [    { "table": "payments", "operations": ["delete", "truncate"], "action": "block",      "message": "Never delete from payments — use the refund flow." }  ]}

Sending the full set updates it; sending an empty array clears it.

get_policies (Pro)

Returns the custom org policy set currently stored for your key — the same rules analyze_sql enforces on top of the built-ins. Read-only; returns an empty list if none are set.

Setup

Veto is a remote MCP server — no install, no source needed. Point your client at the endpoint.

Claude Code — .mcp.json

json
{  "mcpServers": {    "veto": {      "type": "http",      "url": "https://vetosql.com/mcp"    }  }}

Cursor — ~/.cursor/mcp.json

json
{  "mcpServers": {    "veto": {      "url": "https://vetosql.com/mcp"    }  }}

The free tier needs no key (60 req/min). Pro: add your VETO-… key as a bearer token (keep the word Bearer and the space):

json
"headers": { "Authorization": "Bearer VETO-…" }

Pricing

TierPriceLimitsExtras
Free€060 req/minFull deterministic verdict — all destructive, locking, correctness & cost rules
Pro€9.90 / mo1200 req/minCustom org policies (set_policies), maintainer support

Subscribe at vetosql.com.

FAQ

What databases does Veto support? PostgreSQL. Works with any Postgres host (Supabase, Neon, RDS, self-hosted) and any migration tool, because Veto analyzes the SQL text — it doesn't connect to your database.

Is it safe? Can it see or modify my data? No. Veto never connects to your production database. Cost analysis runs inside a transaction that is always rolled back, against a separate scratch Postgres — no data is read or written.

How is Veto different from a linter like Squawk or sqlfluff? Those are CI/style tools. Veto is a real-time runtime gate an AI agent calls over MCP, returning an ok/warn/block verdict on the exact statement it's about to execute — plus cost estimation and custom org policies.

Why not just give the agent a read-only or restricted DB role? Roles are coarse and easy to misconfigure, and they don't catch a costly sequential scan or a full-table UPDATE inside a write-allowed role. Veto adds a statement-level verdict on top of whatever roles you use.

Does it use an LLM? No. The core is deterministic static analysis + EXPLAIN. The calling agent narrates the structured verdict; the verdict itself never comes from a model.

Links

Built by Metawear. The hosted service runs at vetosql.com; this repository is the public documentation and MCP registry manifest for the Veto server.

來源：README.md，提交 91b3e06

工具

3

analyze_sql

Analyze SQL safety & cost

Analyze Postgres SQL/migrations for destructive operations, locking risk, correctness traps (NULL handling that silently returns wrong results), anti-patterns, and query cost. Returns a deterministic verdict (ok/warn/block) with findings. Pass the optional `schema` argument (your CREATE TABLE/INDEX DDL) to also get EXPLAIN-based cost analysis run on a throwaway scratch Postgres — no separate tool or DB connection needed.

輸入參數sql必填schemadialectrowCountHints

set_policies

Set custom org policies (Pro)

Replace the stored custom org policy set for your Pro key (this is also how you update or clear them: send the full new set to update, or an empty array to remove all). Each policy blocks or warns on an operation against matching tables (e.g. no DELETE on payments). Policies are declarative data — validated, never executed — and apply transparently to every later analyze_sql call made with this key. Use get_policies to read the current set.

輸入參數policies必填

get_policies

Get custom org policies (Pro)

Return the custom org policy set currently stored for your Pro key — the same rules analyze_sql enforces on top of the built-ins. Read-only; returns an empty list if none are set. Use set_policies to change them.

無需輸入參數。

版本歷史

1
  1. v0.5.0最新Sep 16, 2026

評分

已滿足適用檢查項的 90%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。