Skip to content

SQLGuard Ninja v0.1.0

Choose a tag to compare

View all tags
@Pratik653 Pratik653 released this 24 Oct 11:25
· 25 commits to main since this release
v0.1.0
f5ac314

SQLGuard Ninja v0.1.0

First public release. This is an alpha: the API may change before 1.0.

Highlights

  • Policy engine for read-only, LLM-generated SQL on sqlglot 30: table and column grants,
    tenant isolation via equality pins, function and catalog rules, structural limits. Fails
    closed when analysis is incomplete.
  • Privacy pack: explicit classification labels with deny / aggregate-only / review per
    role, JSON-path labels, small-cohort review, minimisation hints and safer alternatives.
  • Agent checkpoint: block / review / audit modes, approvals bound to the SQL hash (single
    use, expiry, no self-approval), retry lock-out, redacted audit events. Integrations for
    LangChain, LangGraph and FastAPI.
  • Query cost: an explainable static score, plus optional PostgreSQL EXPLAIN (FORMAT JSON)
    inspection that only runs on allowed SQL, in a read-only, time-limited, rolled-back
    transaction.
  • Benchmark: corpus v1.0.0 with 530 labelled cases / 1,002 dialect evaluations; allow
    labels validated by execution on SQLite and PostgreSQL 16. Adapters for three existing
    open-source guards run in isolated environments.
  • CI: sqlninja benchmark compare and a composite GitHub Action that fail on security,
    usability, error and label-change regressions against a baseline taken from the base branch.

Known limitations

The benchmark corpus does not contain cases for two categories: restricted functions
(e.g. calls to server file-access, sleep, dynamic-SQL or administrative functions) and
system catalogs (PostgreSQL pg_catalog/information_schema, SQLite
sqlite_master/sqlite_schema, in qualified, joined, CTE and nested positions). The
corresponding rules (function.*, catalog.system_object) ship and run by default; their
mechanics are unit-tested with fictitious function names, but their detection is not
measured by the benchmark.

Also: writes are denied; only PostgreSQL and SQLite are tested; the native benchmark score
reflects a corpus developed together with the engine; no guarantee against SQL injection or
data leakage — use database grants, row-level security and timeouts. See KNOWN_LIMITATIONS.md.

Installation

python -m pip install sqlguard-ninja==0.1.0
python -m pip install "sqlguard-ninja[all]==0.1.0"   # LangChain, LangGraph, FastAPI, psycopg

PyPI: https://pypi.org/project/sqlguard-ninja/0.1.0/

Assets 2
Loading