Block destructive SQL
DELETE and UPDATE without WHERE, DROP, TRUNCATE and risky DDL, inside subqueries and CTEs too. Every block comes with the rule, the AST node and a suggested fix.
SEMANTIC AST
Deterministic SQL firewall for AI agents
Your LLM generated a DELETE without WHERE. We blocked it before it reached production.
Connect it as a TCP proxy, an API, the CLI or MCP. Vericto parses each query's AST and blocks destructive operations before they reach your database.
AI agent
Vericto
Database
-
DELETE FROM usersBLOCKEDVERICTO-001DELETE without WHERE: it never reaches the database. The agent gets an SQL error and the suggested fix.DELETE FROM users WHERE id = $1 -
SELECT email FROM customersMASKEDVERICTO-085email is a sensitive column: the proxy rewrites the query and the database returns the masked value.a***@example.com -
SELECT id, total FROM orders WHERE id = $1ALLOWEDorders is in the agent's allowlist: the query passes untouched.id · total
No code changes required
No credit card required
Same query, same verdict, every time
FEATURES
What Vericto does with every query
A deterministic AST engine decides on every statement before it runs. Four controls run on top of it.
Mask sensitive columns
Tag columns such as email or card_number and decide per column: block, flag or mask (full, last4, email or hash). Through the TCP proxy, the database returns the value already masked. Team and Enterprise.
An allowlist per agent
Each agent uses only the tables and columns you give it, read-only or read-write. Everything else is denied. Start in observe and switch to enforce once the traffic confirms it. Team and Enterprise.
Simulate before you enforce
Replay a rule change against your real traffic (up to 30, 90 or 180 days depending on the plan) and see which legitimate flows it would block, before it blocks anything. From the dashboard or from CI. Builder, Team and Enterprise.
The panels reproduce the output as the docs describe it; the data is sample data.
- MCP: the agent checks its SQL while it writes it
- CLI and GitHub Action: fail the PR before the deploy
- LLM agents and Text-to-SQL
- Custom YAML rules over the AST
- Signed audit trail and alerts
- Fail-open by default, fail-closed if you choose
- Credentials never leave your network
- AST versus operation allowlists
HOW IT WORKS
Three steps. Start wherever you want.
Start wherever there's least friction: TCP proxy, Runtime API, CLI, Validation API or MCP. All five call the same deterministic AST engine, so the verdict is the same through any of them.
DELETE has no WHERE. English narration, with English and Spanish captions.Connect however you prefer
Five modes over the same engine. Two act at runtime and block inline; three act before execution, in your pipeline or in the agent's editor. How to choose.
AT RUNTIME
Proxy TCPjust change the connection string host; blocks inlineRuntime APIyour application asks before running; also Oracle and SQL Server
BEFORE EXECUTION
CLIvalidates in pre-commit and CI, with an exit code by verdictValidation APIbatches of SQL over HTTPS, nothing to installMCPthe agent validates the SQL while it writes it
Vericto parses the full AST, not the text
Each query is parsed into its syntax tree: with pg_query (the Postgres parser) for Postgres and with sqlparser-rs for MySQL, Oracle and SQL Server. The full tree, not just the first token or text patterns. The same engine in all five modes, so the verdict does not depend on where the statement came in.
DeleteStmt
relation: users
whereClause: NULL ⚠
Destructive ones blocked. Safe ones pass.
Queries that violate the ruleset are blocked with the offending AST node, the triggered rule and the suggested safe version. At runtime the statement never reaches the database; before execution, the verdict comes back as an exit code or as the agent's response. Clean ones pass untouched.
BLOCKED
DELETE FROM users
ALLOWED
SELECT * FROM users WHERE id = $1
INTEGRATIONS
Works with your current stack
Vericto is compatible with any driver or ORM that uses a standard connection string. No code changes.
Databases
PostgreSQL
TCP ProtocolVia APICLI
MySQL
TCP ProtocolVia APICLI
Oracle
Via APICLI
SQL Server
Via APICLIOn the roadmap: SQLite and Snowflake.
Frameworks & tools
LangChain
Compatible
Vercel AI SDK
Compatible
Supabase
Compatible
MCP Servers
Native
GitHub Actions
CI/CDTCP proxy, HTTP API, CLI and more. Vericto works with any driver that uses a standard connection string. See all integrations →
SOC 2 · ISO 27001
Audit evidence, ready every month
What Vericto blocks and records in production is already the evidence a SOC 2 or ISO 27001 auditor asks for. Vericto delivers it ready to read, and signed:
- Ed25519-signed PDF report with every export: period summary, rules, controls and configuration. From the Team plan.
- Mapping to 12 controls in SOC 2 (CC6.1–CC8.1) and ISO 27001 (A.5.18–A.8.32), with what weakens them.
- A report every month, kept 13 months on Enterprise: the full audit period, without exporting anything by hand.
PRICING
Simple pricing. No surprises.
Prices exclude tax. Any VAT, GST or sales tax due in your country is added at checkout.
Team
$249/mo
- 50M queries/month
- Go over the volume with no cut-off: we let you know
- Sensitive columns and agent access
Enterprise
From
$2,500
/mo
- Annual contract
- 99.9% SLA (Standard); 99.95% and 99.99% with a dedicated deployment
- Automatic monthly compliance report, kept 13 months
Billed annually, Builder is $63/month and Team $199/month.
START TODAY
Your AI agent shouldn't have unrestricted access to production.
Connect your first database in less than 5 minutes.
No credit card required
Onboarding in <5 minutes
Cancel anytime
Deterministic and verifiable. We don't ask for blind trust.
Vericto does not use AI to decide what to block. The engine, the proxy and the CLI are public source, and every claim on this page can be checked.
Public source
The AST engine, the TCP proxy and the CLI, on GitHub, source-available under the Elastic License 2.0 (ELv2): vericto-engine, vericto-proxy, vericto-cli.
CLI on npm
Install it and check your migrations against your rules:
@vericto/vericto-cliEvidence you can verify offline
Compliance reports are signed with Ed25519 and your auditor checks the signature with the public key, with no account and no network. How to verify them.
Public changelog and status
Every release, with what changed and why, in the changelog. Service availability on the status page.
p99 < 2 ms
Design target for parsing and rule evaluation, not a measurement. The proxy latency benchmark is not published yet.
Deterministic
The same query with the same rules always gets the same verdict. Before you enforce a rule, the simulator shows which legitimate flows it would block.