Vericto Proxy

Vericto Proxy is the TCP proxy component of Vericto, made by Vericto S.A.S. It sits between clients (AI agents, scripts, applications) and a PostgreSQL or MySQL database, parses each statement with the vericto-engine AST parser, and either forwards it or returns a native SQL error. It is source-available under FSL-1.1-ALv2, and the latest release shown is v4.23.0.

What It Is

A database guardrail that works on the database's own wire protocol, so an application only changes the host and port in its connection string. One proxy instance fronts one database and speaks one protocol, chosen with VERICTO_WIRE_PROTOCOL (PostgreSQL by default, or MySQL). Evaluation is deterministic: the same input and rules always produce the same verdict, with no AI in the decision.

Blocked statements come back as a normal error (SQLSTATE 42501 on Postgres, ERROR 1142 on MySQL), and the error names the rule, the AST node and a suggested fix so an agent can correct and retry.

What It Blocks and Controls

The built-in ruleset stops DELETE or UPDATE without WHERE, DROP TABLE and DROP SCHEMA, TRUNCATE, OR-tautology injection and risky ALTER TABLE operations. Lower-severity findings such as SELECT * without WHERE are forwarded and recorded. Connected to the Vericto control plane, the proxy also supports:

• Sensitive-column policies (block, flag or mask with full, last4, email or hash), on Team and Enterprise plans
• Per-database-user allowlists of tables and columns, plus a kill switch for blocked agents
• Bounded reads that add or lower a LIMIT through business policies (opt-in preview)
• Telemetry and rule sync to the Vericto API; without it the proxy runs on the built-in rules and reports nothing

MCP Mode and Deployment

vericto-proxy mcp runs an MCP server that gives agents an execute_sql tool without a database credential. Statements are evaluated first and run read-only in a rolled-back transaction with row, size and time caps. It also offers describe_schema, check_sql and whoami, over stdio or Streamable HTTP.

Images are published on Docker Hub and GHCR for linux/amd64 and linux/arm64, with build provenance and SBOM attestations. Other dialects (Oracle, SQL Server, Snowflake, SQLite) have no wire proxy and are checked through the HTTP API, CLI or MCP.