Server-side validation
The agent sends a structured query instead of raw SQL. valv rebuilds and re-checks it against the live schema on the server before any SQL runs.
valv
valv gives AI agents safe, scoped access to databases by validating structured queries, applying caller-specific policies, and running the resulting SQL. It is aimed at developers who want agent-driven database access without exposing raw SQL or unrestricted data.
Safe database access for AI agents
valv is a developer tool for giving AI agents safe, scoped access to a database. The model does not write raw SQL; instead, it emits a structured query that valv validates against the live schema, scopes to the current caller, compiles to SQL, and runs.
The product is built for situations where an agent needs real database access without seeing everything in the database. Policies are defined in code, access is deny-by-default, and the same query can return different results depending on the caller’s tenant or role.
Why valv
Caller-specific policies
Policies are written in TypeScript and can scope rows and columns per caller. The docs describe deny-all as the recommended default, with access added explicitly.
Analytics-friendly querying
The query layer supports filters, aggregates, time-series, and top-N queries, so agents can ask for more than simple lookups.
Token-aware output limits
Responses are capped so a broad query cannot return more data than the model can handle. The homepage describes this as token-aware output control.
Database adapters
valv works with Postgres, MySQL, SQLite, and ClickHouse, and the docs describe adapters for Prisma and ClickHouse.
Agent and MCP integration
You can hand tools to the Vercel AI SDK or expose them over MCP, which lets the same database policy work in different agent setups.
Where valv fits
Tenant-scoped app assistants
Add database-backed answers to an application agent while keeping row and column access tied to the current tenant or user context.
Analytical querying
Let analysts ask for aggregates, filters, time-series, or top-N outputs without exposing unrestricted SQL to the model.
MCP-based agent access
Expose a database to a coding agent through MCP when you want no-code access from tools such as Claude Code.
Per-caller policy enforcement
Centralize database access rules in code so different callers can see different results from the same question.
Pros and Cons
Pros
- Prevents the model from issuing raw SQL, reducing exposure to injection-style failures.
- Lets teams define row and column access in TypeScript, with policies applied per request.
- Supports analytical query patterns such as aggregates and time-series, not just simple key lookups.
- Works with multiple databases and can be used in-app or over MCP.
- Uses deny-by-default access so data stays hidden until it is explicitly allowed.
Cons
- The source materials do not include pricing details, so the commercial model is unclear from the available pages.
- Supported databases are listed on the homepage and docs, but the source only gives adapter detail for Prisma and ClickHouse; deeper setup differences are not fully documented here.
- The docs mention MCP and AI SDK integration, but the available sources do not show full implementation steps or edge-case limitations.
FAQ
How does valv work?
valv sits between the model and your database. The model emits a structured query, valv validates it against the schema, applies caller-specific policies, compiles it to SQL, and runs it.
What are common use cases?
The source materials point to agent-facing database access, row and column scoping, analytics queries such as filters and aggregates, and use with the Vercel AI SDK or MCP. They do not provide a longer list of named vertical use cases.
Is it secure?
valv is designed so the model never writes raw SQL and cannot access data outside the policies you define. It rebuilds and re-checks the query on the server before SQL exists, with deny-by-default access as the recommended starting point.
How does it compare to raw SQL?
Compared with a raw SQL tool, valv keeps the flexibility of agent-driven querying while adding server-side validation and policy scoping. The docs contrast this with both unrestricted SQL and narrow hand-written endpoints.
Quick Facts
- Category
- Developer Tool
- Primary use
- Safe database access for AI agents
- Supported databases
- Postgres, MySQL, SQLite, ClickHouse
- Integration paths
- Vercel AI SDK, MCP
- Policy model
- TypeScript policies with deny-by-default access
- Source URL
- valv.sh
Alternativas ao valv
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repositories and verifies changes with the real compiler, debugger, sanitizers, and tests before showing a diff. It offers a free tier plus paid plans, with editor connectors and zero-retention handling described in the source.
hob
hob is an independent workspace for coding agents that keeps agent sessions, terminals, history, and follow-up work organized around the tools and providers you already use. It is aimed at developers who want local control over routing, history, and workspace structure rather than a bundled model stack.
Manta AI
Manta AI is an autonomous web app testing tool for teams that want to map application behavior, catch regressions, and generate tests without writing scripts or maintaining selectors. It works from a URL and supports plain-English test flows, run results with screenshots, and scheduled or deployment-triggered checks.
SonOf
SonOf connects to your repo and PM tool, audits the codebase and surrounding product context, and turns approved work into shipped tickets with senior engineering review. It is aimed at founders and engineering leaders who need backlog help without hiring a full team immediately.
Ghost
Ghost é um assistente de IA para terminal, para conversar, gerar código e executar tarefas no prompt. Traz modelos gratuitos, funciona no Linux, macOS e Windows e é open source.
Codeswtch
Codeswtch is an engineering subscription for founders building with AI. It provides senior engineering guidance and hands-on help through one ongoing plan, with unlimited projects and one request at a time.