Veto Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Veto Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
*Veto is a deterministic MCP server that vets Postgres SQL for safety, correctness, and cost before an AI coding agent runs it.* It returns anok/warn/blockverdict on every statement — no LLM in the core, and it never connects to your database.
Website: https://vetosql.com · MCP endpoint: https://vetosql.com/mcp (remote, streamable-http)
AI coding agents (Claude Code, Cursor, …) write and execute SQL. Occasionally they write DELETE FROM payments with no WHERE, or a DROP TABLE during a migration. More prompting doesn't fix a probabilistic system — a deterministic gate does. Veto is that gate: given the same statement, it returns the same verdict, every time, with stable finding ids you can audit and gate CI on.
| Verdict | Meaning | What falls here |
|---|---|---|
block | Destructive / data loss | Unscoped DELETE/UPDATE, TRUNCATE, dropping data-bearing objects — including destructive statements hidden inside CTEs |
warn | Risky but recoverable | Lock-heavy schema changes, expensive scans, correctness traps that silently return wrong rows (= NULL, NOT IN (subquery), a LEFT JOIN filtered into an inner join), common anti-patterns like SELECT * |
ok | Safe to run | Routine, reversible migrations |
Every finding carries a stable dotted id (e.g. destructive.delete_without_where) so your pipeline can branch on it. The exact rule set lives server-side and evolves over time.
block by a clever prompt; doesn't get worse on a bad day.EXPLAIN on a throwaway scratch Postgres inside a transaction that is always rolled back. Your production database is never connected.analyze_sqlReturns a deterministic safety + cost verdict for Postgres SQL / migrations.
| Input | Type | Notes |
|---|---|---|
sql | string | The SQL / migration to analyze — one or more statements (required) |
schema | string? | Optional CREATE TABLE/INDEX DDL — enables EXPLAIN-based cost analysis on scratch Postgres |
rowCountHints | object? | Optional map of table name → estimated row count, for realistic cost estimates |
Returns { verdict, findings[], plan?, meta } where verdict ∈ ok | warn | block.
set_policies (Pro)Stores custom org policies keyed to your Pro key; analyze_sql then enforces them on top of the built-in rules. Policies are declarative data — validated and never executed (max 50, replaces the previously stored set).
Each policy: table (exact name or glob, e.g. payments, audit_*, *), operations (any of select/insert/update/delete/truncate/drop/alter), action (block/warn), optional message.
{
"policies": [
{ "table": "payments", "operations": ["delete", "truncate"], "action": "block",
"message": "Never delete from payments — use the refund flow." }
]
}Sending the full set updates it; sending an empty array clears it.
get_policies (Pro)Returns the custom org policy set currently stored for your key — the same rules analyze_sql enforces on top of the built-ins. Read-only; returns an empty list if none are set.
Veto is a remote MCP server — no install, no source needed. Point your client at the endpoint.
.mcp.json{
"mcpServers": {
"veto": {
"type": "http",
"url": "https://vetosql.com/mcp"
}
}
}~/.cursor/mcp.json{
"mcpServers": {
"veto": {
"url": "https://vetosql.com/mcp"
}
}
}The free tier needs no key (60 req/min). Pro: add your VETO-… key as a bearer token (keep the word Bearer and the space):
"headers": { "Authorization": "Bearer VETO-…" }| Tier | Price | Limits | Extras |
|---|---|---|---|
| Free | €0 | 60 req/min | Full deterministic verdict — all destructive, locking, correctness & cost rules |
| Pro | €9.90 / mo | 1200 req/min | Custom org policies (set_policies), maintainer support |
Subscribe at vetosql.com.
What databases does Veto support? PostgreSQL. Works with any Postgres host (Supabase, Neon, RDS, self-hosted) and any migration tool, because Veto analyzes the SQL text — it doesn't connect to your database.
Is it safe? Can it see or modify my data? No. Veto never connects to your production database. Cost analysis runs inside a transaction that is always rolled back, against a separate scratch Postgres — no data is read or written.
How is Veto different from a linter like Squawk or sqlfluff? Those are CI/style tools. Veto is a real-time runtime gate an AI agent calls over MCP, returning an ok/warn/block verdict on the exact statement it's about to execute — plus cost estimation and custom org policies.
Why not just give the agent a read-only or restricted DB role? Roles are coarse and easy to misconfigure, and they don't catch a costly sequential scan or a full-table UPDATE inside a write-allowed role. Veto adds a statement-level verdict on top of whatever roles you use.
Does it use an LLM? No. The core is deterministic static analysis + EXPLAIN. The calling agent narrates the structured verdict; the verdict itself never comes from a model.
https://vetosql.com/mcpcom.vetosql/vetoBuilt by Metawear. The hosted service runs at vetosql.com; this repository is the public documentation and MCP registry manifest for the Veto server.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.