Lomberk

Every agent write, reversible. Lomberk is an MCP gateway for PostgreSQL. AI agents send SQL through it instead of holding database credentials. It blocks destructive commands, holds large or sensitive writes for a human, records every changed row, and can undo any applied write, including foreign-key cascades.

Just want a seatbelt for Claude Code? Lomberk Seatbelt is a free plugin that makes your agent ask before DROP, TRUNCATE, DELETE without WHERE, prisma migrate reset, dropdb and friends. Install it in two commands.

Quickstart (60 seconds)

You need uv and the owner's connection string of a PostgreSQL 14+ database (a role that can create roles: postgres on Supabase, Neon and RDS).

uvx lomberk setup     # asks for the owner connection string; what you type stays out of your shell history

In a script, set LOMBERK_INSTALL_DSN instead and add --yes. Setup creates two least-privilege roles with generated passwords, installs Lomberk, lists your tables and makes the ones you pick undoable, then writes lomberk.yaml and a private .env (mode 600) and runs lomberk doctor on them. It never changes a role or file that already exists. The owner connection string is used once and never saved. At the end it prints the line for your MCP client, for example:

claude mcp add lomberk -e LOMBERK_CONFIG=/path/to/lomberk.yaml -- uvx lomberk serve

Cursor, Claude Desktop, VS Code and Codex get their config snippet too. Then ask your agent to change something:

lomberk log                 # what your agents changed, newest first
lomberk undo cp_…           # put it back, cascades included
lomberk approve cp_…        # let a held write run (or: lomberk reject cp_…)
lomberk doctor              # check the setup any time

Supabase, Neon, RDS, Railway: docs/hosted-postgres.md. On Supabase, use the session pooler connection string (IPv4); setup derives the lomberk_agent.<project-ref> login names from it.

What the agent gets

The agent can't approve or undo anything. That takes the admin key, the CLI or (Pro) Slack, SSO or the panel.

9-second database deletion demo

In April 2026 an autonomous coding agent deleted a production database in 9 seconds (through an over-privileged infrastructure token). Lomberk closes the other door: an agent's own database access. Here is what a rogue agent can and can't do when its SQL goes through Lomberk.

1. Start the stack

git clone https://github.com/e

... [View full README on GitHub](https://github.com/ege-usta/lomberk#readme)