Gate SQL writes

@limetry/sql is a Limetry adapter. It owns DATABASE_URL, classifies statements, and evaluates sql.read / sql.write / sql.ddl intents before optional execute. Agents never receive write credentials from this package.

Evaluate against your self-run Limetry node. You operate tokens, operator auth for approvals, and audit retention on that server.

Run the live demo

• limetry-sql-gate.yml — allow SELECT 1 and execute it; deny DROP TABLE and DELETE before the database runs them
• Policy: packages/sql/policies/postgres.json

Register the MCP server

{
  "mcpServers": {
    "limetry-sql": {
      "command": "npx",
      "args": ["-y", "@limetry/sql"],
      "env": {
        "DATABASE_URL": "postgresql://...",
        "LIMETRY_API_KEY": "...",
        "LIMETRY_POLICY_ID": "...",
        "LIMETRY_SQL_DRY_RUN": "true"
      }
    }
  }
}

Set LIMETRY_BASE_URL to your evaluation server origin.

Apply the repo policy

limetry setup
limetry policy apply --file packages/sql/policies/postgres.json

policies/postgres.json is read-only: sql.write and sql.ddl are denied outright. Add those types to require_approval_action_types if you need limetry_sql_list_pending.