SQL guard: single statement, read-only, table allowlist

$0.005 USDC per call · Developer and security · POST /api/v1/sql-check · Id sql-check

Checks one SQL string (up to 20000 characters; PostgreSQL, MySQL, SQLite or generic) before an agent executes it: exactly one statement, read-only (SELECT/VALUES/SHOW/EXPLAIN without side effects), and every table it reads or writes on a caller allowlist. Tokenizer-level: comments, string literals, quoted identifiers and dollar quoting cannot hide a second statement; reports statement kind, referenced tables after FROM/JOIN/INTO/UPDATE, SELECT INTO, locking reads, writable CTEs and known side-effect functions. Returns unsupported for constructs it cannot classify and for any transpile request; it is not a full SQL parser and does not prove a query safe (a user-defined function may write).

What you get

Stops an injected second statement or an unexpected table reaching the database from an agent's generated SQL.

Call it

Send the JSON body below to https://agents.writerslogic.com/api/v1/sql-check. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.

curl -i -X POST https://agents.writerslogic.com/api/v1/sql-check \
  -H 'content-type: application/json' \
  -d '{"sql":"SELECT u.id, o.total FROM users u JOIN orders o ON o.user_id = u.id WHERE u.id = $1","dialect":"postgres","allowedTables":["users","orders"]}'

Input

Field	Type	Required	Description
`sql`	string; length 0..20000	yes
`dialect`	string; one of "postgres", "mysql", "sqlite", "ansi"	no	Lexical rules; default ansi.
`readOnly`	boolean	no	Default true: anything but a plain read fails.
`allowedTables`	array<string; length 0..200>; max 200 items	no	Allowed tables, lower-cased match: 'users', 'public.users' or 'public.*'. Unqualified and qualified names are different entries.
`transpileTo`	string; one of "postgres", "mysql", "sqlite", "bigquery", "snowflake", "tsql"	no	Always answered unsupported.

Example request body

{
  "sql": "SELECT u.id, o.total FROM users u JOIN orders o ON o.user_id = u.id WHERE u.id = $1",
  "dialect": "postgres",
  "allowedTables": [
    "users",
    "orders"
  ]
}

Result

The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.

Field	Type	Required	Description
`status`	string; one of "pass", "fail", "unknown", "unsupported"	no	pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass.
`dialect`	string	no
`readOnly`	boolean	no
`statementCount`	integer	no
`statements`	array<object>	no
`witnesses`	array<object>	no
`versions`	object	no	Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile).
`limits`	array<string>	no
`deterministic`	boolean	no	Always true: pure code, no model.

Pay and connect

Available through: x402 (USDC on Base), MCP. MCP clients reach it through the code-preflight-kit package.

Machine-readable

This agent as JSON (schemas, example, OpenAPI operation)
Free signed sample response
OpenAPI 3.1 · Catalog · Index of every agent