SQL execution certificate firewall

Review a SQL statement an agent is about to run against production, and certify it. Send POST /api/sql-guard with the required field sql and pay $0.004 per call over x402 or MPP (there is no free tier). It returns a JSON object with verdict, mutating, statementCount, sha256, risks and 1 more.

Returns a policy verdict (pass / warn / block) with named risks - unbounded UPDATE or DELETE, tautological WHERE, DROP, TRUNCATE, DROP COLUMN, statement stacking, COPY ... FROM PROGRAM, GRANT/role changes, session_replication_role and trigger/constraint bypass, writes to pg_catalog - and, when the verdict is pass, an Ed25519 certificate binding that verdict to the SHA-256 of the exact statement. Your database layer verifies the certificate with sql-cert-verify before executing, so the check cannot be skipped by a confused or compromised agent. Literals and comments are scrubbed before analysis, so a keyword inside a string is never a false alarm. HONEST SCOPE: a lexical guard over a fixed, published risk catalogue - it catches the shapes that destroy production data, it is not a SQL parser and cannot know that a WHERE clause names the wrong tenant.

Category: Validation & parsing · Tags: sql postgres firewall guard safety database certificate ed25519

TRY IN PLAYGROUND →

Parameters

Example request

curl -i -X POST https://agent402.tools/api/sql-guard \
  -H "Content-Type: application/json" \
  -d '{"sql":"UPDATE users SET plan = '\''pro'\'' WHERE id = 42"}'

Without payment this returns HTTP 402 Payment Required with the exact price for sql-guard; any x402 v2 or MPP client pays it and retries.

Example response

{
  "verdict": "pass",
  "mutating": true,
  "statementCount": 1,
  "sha256": "635cf20a…",
  "risks": [],
  "certificate": {
    "token": "eyJ2Ijox….signature",
    "expiresAt": "2026-07-28T20:05:00Z"
  }
}

From an MCP client

catalog.call {
  "slug": "sql-guard",
  "params": {
    "sql": "UPDATE users SET plan = 'pro' WHERE id = 42"
  }
}

The hosted connector at https://agent402.tools/mcp needs a payment for sql-guard; the stdio package pays it from a wallet or from AGENT402_CREDITS_KEY. Local install: npx -y agent402-mcp.

Errors and behavior

• sql is required. An input the tool rejects returns an HTTP 4xx whose body carries error, tool, expected, required and example, so the caller can correct it.
• A paid call that ends in any status of 400 or above is not charged over x402, MPP or a prepaid credits key: settlement is cancelled when the tool fails. The exception is a Tempo push credential, a transfer the buyer sent before the call: it settles before the tool runs, so if the tool then fails the payment is recorded as a refund owed to the paying wallet.
• Wallet-only: this tool is pure computation, but it can mint an execution certificate signed with this server's key, so it is metered with money and has no proof-of-work tier. A prepaid card-credits key issued earlier (Authorization: Bearer a402_...) also pays it.
• A GET or HEAD to /api/sql-guard returns the same 402 quote, so the price can be read without a body.
• An Idempotency-Key header makes a retried paid call replay the first 200 instead of charging again (an answer larger than 1 MB is not replayed).

Paid call (JavaScript agent)

import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client();
client.setSpendControls?.(false); // keep your own spending ceiling in code
registerExactEvmScheme(client, { signer: privateKeyToAccount(KEY) });
const payFetch = wrapFetchWithPayment(fetch, client);

const res = await payFetch("https://agent402.tools/api/sql-guard", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "sql": "UPDATE users SET plan = 'pro' WHERE id = 42"
  }),
});

Related tools