Server-side validation
The agent sends a structured query instead of raw SQL. valv rebuilds and re-checks it against the live schema on the server before any SQL runs.
valv
valv gives AI agents safe, scoped database access with validated queries, caller-based policies, and SQL execution for developers.
Safe database access for AI agents
valv is a developer tool for giving AI agents safe, scoped access to a database. The model does not write raw SQL; instead, it emits a structured query that valv validates against the live schema, scopes to the current caller, compiles to SQL, and runs.
The product is built for situations where an agent needs real database access without seeing everything in the database. Policies are defined in code, access is deny-by-default, and the same query can return different results depending on the caller’s tenant or role.
Why valv
Caller-specific policies
Policies are written in TypeScript and can scope rows and columns per caller. The docs describe deny-all as the recommended default, with access added explicitly.
Analytics-friendly querying
The query layer supports filters, aggregates, time-series, and top-N queries, so agents can ask for more than simple lookups.
Token-aware output limits
Responses are capped so a broad query cannot return more data than the model can handle. The homepage describes this as token-aware output control.
Database adapters
valv works with Postgres, MySQL, SQLite, and ClickHouse, and the docs describe adapters for Prisma and ClickHouse.
Agent and MCP integration
You can hand tools to the Vercel AI SDK or expose them over MCP, which lets the same database policy work in different agent setups.
Where valv fits
Tenant-scoped app assistants
Add database-backed answers to an application agent while keeping row and column access tied to the current tenant or user context.
Analytical querying
Let analysts ask for aggregates, filters, time-series, or top-N outputs without exposing unrestricted SQL to the model.
MCP-based agent access
Expose a database to a coding agent through MCP when you want no-code access from tools such as Claude Code.
Per-caller policy enforcement
Centralize database access rules in code so different callers can see different results from the same question.
Pros and Cons
Pros
- Prevents the model from issuing raw SQL, reducing exposure to injection-style failures.
- Lets teams define row and column access in TypeScript, with policies applied per request.
- Supports analytical query patterns such as aggregates and time-series, not just simple key lookups.
- Works with multiple databases and can be used in-app or over MCP.
- Uses deny-by-default access so data stays hidden until it is explicitly allowed.
Cons
- The source materials do not include pricing details, so the commercial model is unclear from the available pages.
- Supported databases are listed on the homepage and docs, but the source only gives adapter detail for Prisma and ClickHouse; deeper setup differences are not fully documented here.
- The docs mention MCP and AI SDK integration, but the available sources do not show full implementation steps or edge-case limitations.
FAQ
How does valv work?
valv sits between the model and your database. The model emits a structured query, valv validates it against the schema, applies caller-specific policies, compiles it to SQL, and runs it.
What are common use cases?
The source materials point to agent-facing database access, row and column scoping, analytics queries such as filters and aggregates, and use with the Vercel AI SDK or MCP. They do not provide a longer list of named vertical use cases.
Is it secure?
valv is designed so the model never writes raw SQL and cannot access data outside the policies you define. It rebuilds and re-checks the query on the server before SQL exists, with deny-by-default access as the recommended starting point.
How does it compare to raw SQL?
Compared with a raw SQL tool, valv keeps the flexibility of agent-driven querying while adding server-side validation and policy scoping. The docs contrast this with both unrestricted SQL and narrow hand-written endpoints.
Quick Facts
- Category
- Developer Tool
- Primary use
- Safe database access for AI agents
- Supported databases
- Postgres, MySQL, SQLite, ClickHouse
- Integration paths
- Vercel AI SDK, MCP
- Policy model
- TypeScript policies with deny-by-default access
- Source URL
- valv.sh
valv Alternatives
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repos and verifies changes with compilers, debuggers, sanitizers, and tests.
hob
hob is an independent workspace for coding agents, with local control over sessions, terminals, history, routing, and follow-up work.
Manta AI
Manta AI is an autonomous web app testing tool that maps app behavior, catches regressions, and generates tests from a URL, no scripts or selectors needed.
SonOf
SonOf connects to your repo and PM tool, audits your codebase, and turns approved work into shipped tickets with senior engineering review.
Ghost
Ghost is a terminal-based AI assistant for chatting, code generation, and CLI tasks. Includes free models, supports Linux, macOS, Windows, and is open source.
Codeswtch
Codeswtch is an engineering subscription for founders building with AI, offering senior engineering guidance and hands-on help in one ongoing plan.