Veto — SQL Safety & Cost Oracle (MCP)

Veto is a deterministic MCP server that vets Postgres SQL for safety, correctness, and cost before an AI coding agent runs it. It returns an ok / warn / block verdict on every statement — no LLM in the core, and it never connects to your database.

Website: https://vetosql.com · MCP endpoint: https://vetosql.com/mcp (remote, streamable-http)

AI coding agents (Claude Code, Cursor, …) write and execute SQL. Occasionally they write DELETE FROM payments with no WHERE, or a DROP TABLE during a migration. More prompting doesn't fix a probabilistic system — a deterministic gate does. Veto is that gate: given the same statement, it returns the same verdict, every time, with stable finding ids you can audit and gate CI on.

What it catches

Every finding carries a stable dotted id (e.g. destructive.delete_without_where) so your pipeline can branch on it. The exact rule set lives server-side and evolves over time.

Why deterministic

• Reproducible — same input, same verdict. Testable, so trustable.
• Auditable — a named rule fired, not "the model felt it was risky."
• No drift — can't be talked out of a block by a clever prompt; doesn't get worse on a bad day.
• Never touches your DB — cost is measured with a real EXPLAIN on a throwaway scratch Postgres inside a transaction that is always rolled back. Your production database is never connected.

Tools

analyze_sql

Returns a deterministic safety + cost verdict for Postgres SQL / migrations.

Returns { verdict, findings[], plan?, meta } where verdict ∈ ok | warn | block.

set_policies (Pro)

Stores custom org policies keyed to your Pro key; analyze_sql then enforces them on top of the built-in rules. Policies are declarative data — validated and never executed (max 50, replaces the previously stored set).

Each policy: table (exact name or glob, e.g. payments, audit_*, *), operations (any of select/insert/update/delete/truncate/drop/alter), action (block/warn), optional message.

{
  "policies": [
    { "table": "payments", "operations": ["delete", "truncate"], "action": "block",
      "message": "Never delete from payments — use the refund flow." }
  ]
}

Sending the full set updates it; sending an empty array clears it.

get_policies (Pro)

Returns the custom org policy set currently stored for your key — the same rules analyze_sql enforces on top of the built-ins. Read-only; returns an empty list if none are set.

Setup

Veto is a remote MCP server — no install, no source needed. Point your client at the endpoint.

Claude Code — .mcp.json

{
  "mcpServers": {
    "veto": {
      "type": "http",
      "url": "https://vetosql.com/mcp"
    }
  }
}

Cursor — ~/.cursor/mcp.json

{
  "mcpServers": {
    "veto": {
      "url": "https://vetosql.com/mcp"
    }
  }
}

The free tier needs no key (60 req/min). Pro: add your VETO-… key as a bearer token (keep the word Bearer and the space)

... View full README on GitHub