v0.7.0

SQLGuard Ninja v0.7.0

Highlights

• Interactive playground. Try SQL policy enforcement on a synthetic retail database with three roles: Sales Analyst, Customer Support and Store Manager. It has 20 example queries, explanations with fixes, lineage, tenant-isolation demonstrations, a role-permission browser, and a benchmark dashboard that labels every result as internal (1,070) and shows that no independent results exist (0). There is no login or API key: pip install "sqlguard-ninja[demo]" && sqlninja demo serve.
• A sandbox the database enforces. Allowed queries run in an in-memory synthetic SQLite database with an authorizer allowlist, query_only, engine limits and a time budget. Denied and review queries never run.
• Runs in the browser. scripts/build_static_demo.py builds a static site in which Pyodide runs the same code in a Web Worker. Everything is self-hosted and checksum-verified, and a browser test confirms the site makes no third-party requests.
• Deployment references. A hardened Dockerfile, Compose and Kubernetes manifests with health checks, validated configuration, rate limiting, body limits, query timeouts, non-root execution and resource limits. CI builds and runs the container under those restrictions and validates the manifests.

Notes

• Live demo: https://pratik653.github.io/SQLGuard_Ninjapy/ (GitHub Pages; added after release, once deployment was verified in an unauthenticated browser).
• All benchmark results remain internal (issues #5 and #6). SQL Server and Oracle remain parser-level experimental.

Installation

python -m pip install "sqlguard-ninja[demo]==0.7.0"
sqlninja demo serve

PyPI: https://pypi.org/project/sqlguard-ninja/0.7.0/

v0.6.0

SQLGuard Ninja v0.6.0

Highlights

• OpenTelemetry tracing and Prometheus metrics. Install the optional extras [otel] and [prometheus]. Pass SQLCheckpoint(telemetry=Telemetry(tracer=..., metrics=GuardMetrics())) to get spans for checkpoint and validation decisions. Metrics cover decisions, findings by rule, latency, errors, resource-limit rejections and checkpoint outcomes, all with bounded labels.
• Privacy by default. Spans, metrics and audit events contain no SQL text, literals, comments, request-context values or internal detail. Traces and metrics also omit tenant ids and principals. Canary tests check this across many literal forms.
• SARIF 2.1.0. sqlninja scan validates every statement in SQL files and writes SARIF for code scanning. The output validates against the OASIS schema in the tests and in CI.
• Grafana dashboard. It ships with a local Prometheus + Grafana stack fed by synthetic traffic, which CI starts and checks.

Security fix

• Audit redaction previously let hex, bit, E'', dollar-quoted, U&'' and N'' strings, and INTERVAL text, through into sql_redacted. All are now redacted, and redacted SQL is withheld if any literal token survives. If you keep audit logs from earlier versions, review them for inlined secrets.

Notes

• All benchmark results are still internal (issues #5 and #6). SQL Server and Oracle remain parser-level experimental.

Installation

python -m pip install "sqlguard-ninja[otel,prometheus]==0.6.0"

PyPI: https://pypi.org/project/sqlguard-ninja/0.6.0/

v0.5.0

SQLGuard Ninja v0.5.0

Highlights

• MySQL 8, tested within a documented scope. A MySQL 8.4 service container in CI loads the synthetic fixture and executes every MySQL allow case in the corpus as a SELECT-only account through the new read-only executor (sqlguard_ninja.integrations.mysql, extra [mysql]).
• Conservative MySQL semantics. Identifiers are compared exactly and never case-folded. Mixed-case references such as o.ID are denied: a documented, fail-closed false positive. Named placeholders are bound through the AST (ADR-013); unknown or anonymous placeholders and values containing backslash or NUL are refused. The executor also refuses sessions whose sql_mode would make the server read validated SQL differently (ANSI_QUOTES, NO_BACKSLASH_ESCAPES, PIPES_AS_CONCAT, HIGH_NOT_PRECEDENCE, ANSI).
• Corpus 1.2.0. It adds 26 MySQL cases, with no existing labels changed. The results are in docs/benchmarks/RESULTS_v1.2.md.
• Compatibility matrix. docs/guides/DATABASE_COMPATIBILITY.md covers the dialects. SQL Server and Oracle remain parser-level experimental. Oracle denies everything against a lower-case catalog.

Notes

• All benchmark results are still internal (issues #5 and #6). There is no MySQL plan inspection. There is no guarantee against SQL injection or data leakage. Use least-privilege accounts and row-level controls.

Installation

python -m pip install "sqlguard-ninja[mysql]==0.5.0"

PyPI: https://pypi.org/project/sqlguard-ninja/0.5.0/

SQLGuard Ninja v0.4.0

SQLGuard Ninja v0.4.0

Highlights

• MCP server. sqlninja mcp --policy ... --role ... --tenant ... exposes validate_sql, explain_policy_decision, inspect_query_cost and get_policy_capabilities to MCP-compatible agents over stdio. It is built on the official MCP Python SDK (2.x).
• Security model. The identity is fixed by the operator at start-up, and tools take no role, tenant, credential or connection-string arguments. The server never executes SQL or connects to a database, withholds internal detail, and does not reveal ungranted tables or columns. Inputs are size-capped and calls are rate-limited.
• Verified with a real client. The end-to-end test launches the server as a subprocess and uses the SDK's stdio_client and ClientSession to discover and call the tools, including a forged role argument.

Notes

• Remote (Streamable HTTP) transport is not enabled. A remote deployment needs an authenticated gateway that binds each caller to an identity (see the MCP guide).
• Known limitations are unchanged: all benchmark results are internal (issues #5 and #6), only PostgreSQL and SQLite are supported, and there is no guarantee against SQL injection or data leakage.

Installation

python -m pip install "sqlguard-ninja[mcp]==0.4.0"

PyPI: https://pypi.org/project/sqlguard-ninja/0.4.0/

SQLGuard Ninja v0.3.0

SQLGuard Ninja v0.3.0

Enterprise policy-as-code and tenant enforcement.

Highlights

• Role inheritance with sticky explicit denies: a child role can add permissions, but cannot undo an inherited deny. Conflicts, unknown parents and cycles fail at load time.
• Review before activation: sqlninja policy diff classifies every change as relaxes / restricts / neutral (--fail-on-relaxation for CI). policy simulate --against shows decision changes on example queries, and policy explain traces effective access through the inheritance chain.
• Auditability: every decision has a decision_id, the policy revision and fingerprint. Audit events add a correlation id, a literal-insensitive query fingerprint and a tenant-rewrite flag.
• Templates: minimal, multi_tenant_saas, analytics_readonly.
• Opt-in AST tenant-filter rewrite: missing tenant pins are added as bind-parameter predicates and the rewrite is re-validated. It is refused on any other problem or on RIGHT/FULL-join ownership ambiguity.

Compatibility

Existing policies behave as before; the new fields are optional.

Known limitations

• All benchmark results are internal. There is no independent dataset yet (issue #6), and no restricted-function or system-catalog cases (issue #5).
• The tenant rewrite emits sqlglot-normalised SQL. Database row-level security remains the authoritative tenant control.
• Only PostgreSQL and SQLite are supported; writes are denied; no guarantee against SQL injection or data leakage.

Installation

python -m pip install sqlguard-ninja==0.3.0

PyPI: https://pypi.org/project/sqlguard-ninja/0.3.0/

SQLGuard Ninja v0.2.0

SQLGuard Ninja v0.2.0

Lineage-aware privacy and tenant enforcement, and a more rigorous benchmark.

Highlights

• Lineage through CTEs and derived tables. Aggregate-only columns can now be projected raw in an inner scope when every downstream use is a statistical aggregate, while filters, ordering, windows, MIN/MAX, whole-row or any raw use stay denied. Tenant pins applied to an unmodified projection of the tenant column now cover the inner read, under strict conditions (no aggregation, windows or row limits; every consumer pinned). The small-cohort check follows identifiers through derived scopes.
• Benchmark rigour. Internal versus independent dataset tiers, policy versus unsupported-SQL basis for denials, F1, 95% Wilson intervals, throughput, CSV export, and per-file SHA-256 dataset hashes.
• Reviewed relabels. Label changes must be listed in the CODEOWNERS-protected LABEL_CHANGES.yaml, or the CI gate fails.
• Corpus 1.1.0: 551 cases / 1,044 evaluations, including 21 lineage boundary cases.

Behaviour changes

Exactly two corpus cases changed decision (PRV-026, TEN-021: deny → allow). Both are documented false positives of 0.1.x, and both relabels are approved in LABEL_CHANGES.yaml.

Known limitations (unchanged)

• No restricted-function or system-catalog benchmark cases (issue #5), and no independent external dataset yet (issue #6). All published benchmark numbers are internal.
• Only PostgreSQL and SQLite are supported; writes are denied; no guarantee against SQL injection or data leakage.

Installation

python -m pip install sqlguard-ninja==0.2.0

PyPI: https://pypi.org/project/sqlguard-ninja/0.2.0/

SQLGuard Ninja v0.1.1

SQLGuard Ninja v0.1.1

Documentation and governance patch release. The enforcement behaviour is identical to v0.1.0.
v0.1.0 remains published and unchanged on PyPI.

Fixed

• The README's documentation links now work on the PyPI project page (they were relative in 0.1.0).

Added

• Limits of static SQL analysis and dialect support
• Benchmark bias review:
  the v1 results reflect consistency with the engine's own semantics, not independent detection quality.
• External dataset intake rules; no external cases yet.
• CODEOWNERS and branch protection on main.

Known limitations (unchanged)

• No benchmark cases for restricted functions (server file access, sleep, dynamic SQL,
  administrative functions) or system catalogs (pg_catalog, information_schema,
  sqlite_master, sqlite_schema). The rules ship and run, but their detection is not measured.
• Writes are denied. Only PostgreSQL and SQLite are supported. No guarantee against SQL injection or data leakage.

Installation

python -m pip install sqlguard-ninja==0.1.1
python -m pip install "sqlguard-ninja[all]==0.1.1"

PyPI: https://pypi.org/project/sqlguard-ninja/0.1.1/

SQLGuard Ninja v0.1.0

SQLGuard Ninja v0.1.0

First public release. This is an alpha: the API may change before 1.0.

Highlights

• Policy engine for read-only, LLM-generated SQL on sqlglot 30: table and column grants,
  tenant isolation via equality pins, function and catalog rules, structural limits. Fails
  closed when analysis is incomplete.
• Privacy pack: explicit classification labels with deny / aggregate-only / review per
  role, JSON-path labels, small-cohort review, minimisation hints and safer alternatives.
• Agent checkpoint: block / review / audit modes, approvals bound to the SQL hash (single
  use, expiry, no self-approval), retry lock-out, redacted audit events. Integrations for
  LangChain, LangGraph and FastAPI.
• Query cost: an explainable static score, plus optional PostgreSQL EXPLAIN (FORMAT JSON)
  inspection that only runs on allowed SQL, in a read-only, time-limited, rolled-back
  transaction.
• Benchmark: corpus v1.0.0 with 530 labelled cases / 1,002 dialect evaluations; allow
  labels validated by execution on SQLite and PostgreSQL 16. Adapters for three existing
  open-source guards run in isolated environments.
• CI: sqlninja benchmark compare and a composite GitHub Action that fail on security,
  usability, error and label-change regressions against a baseline taken from the base branch.

Known limitations

The benchmark corpus does not contain cases for two categories: restricted functions
(e.g. calls to server file-access, sleep, dynamic-SQL or administrative functions) and
system catalogs (PostgreSQL pg_catalog/information_schema, SQLite
sqlite_master/sqlite_schema, in qualified, joined, CTE and nested positions). The
corresponding rules (function.*, catalog.system_object) ship and run by default; their
mechanics are unit-tested with fictitious function names, but their detection is not
measured by the benchmark.

Also: writes are denied; only PostgreSQL and SQLite are tested; the native benchmark score
reflects a corpus developed together with the engine; no guarantee against SQL injection or
data leakage — use database grants, row-level security and timeouts. See KNOWN_LIMITATIONS.md.

Installation

python -m pip install sqlguard-ninja==0.1.0
python -m pip install "sqlguard-ninja[all]==0.1.0"   # LangChain, LangGraph, FastAPI, psycopg

PyPI: https://pypi.org/project/sqlguard-ninja/0.1.0/