AgentVera
TR Download

DB Guard: before an agent’s migration reaches production

When an agent writes a migration, the real question isn’t whether it runs but what it does to the production table. DB Guard scans changed migration files in the folder when an agent ends its turn, rates the risks and, if you want, tries the migration on a shadow database inside a transaction that is rolled back.

Download for free

What it catches

Changed files under paths like migrations/, prisma/migrations, db/migrate and Flyway V1__x.sql are checked. It reads SQL for Postgres, MySQL and SQLite, and migration code for Rails, Laravel, Django and Knex- or Sequelize-style tools.

  • DROP TABLE and DROP COLUMN, TRUNCATE, UPDATE and DELETE without WHERE.
  • CREATE INDEX without CONCURRENTLY, ALTER TYPE, SET NOT NULL, new FK, CHECK and UNIQUE constraints.
  • Migrations with no down step; RunPython without reverse_code in Django.
  • Risk levels: none, low, medium, high; data loss is flagged separately.

Real table sizes

Pick one of your database manager connections as “production-like” and real row counts are read, so the risk scales with table size. Without one, risks are rated without knowing sizes. High or medium risk, or data loss, triggers a desktop notification.

Try, review, fix

Every report has buttons for the next step.

  • Try on shadow DB: runs the migration on a development or staging connection inside a transaction that is always rolled back.
  • Review with Claude: a read-only Claude review.
  • Have the agent make it safe: the findings go to the agent that wrote the migration; if it is gone, a new “DB Guard düzeltme” Claude agent opens.
  • Analyse SQL: paste a Prisma migration.sql, artisan migrate --pretend or manage.py sqlmigrate output to check it.

How to set it up

  1. 1

    Open the DB Guard tab on a project’s Details page; automatic review is on by default.

  2. 2

    In its settings, pick a production-like connection for table sizes and a shadow connection for trial runs.

  3. 3

    When an agent writes a migration, read the report, and try it on the shadow DB or have an agent fix it.

Questions

Does it run anything on my production database?

Only table sizes are read from the production-like connection. Trial runs happen on the shadow connection, inside a transaction that is rolled back.

Which databases are supported?

SQL analysis covers Postgres, MySQL and SQLite; Rails, Laravel, Django and Knex-style migration code is read too.

Does it work without a connection?

Yes. Scanning works without one; risks are then rated without table sizes and trial runs aren’t available.

Related features

All featuresSee the 18 supported coding agents

Bring your agents to one desk.

Start on the free plan. Download it, add a project folder and open your first agent.

Download for free Pricing

Posts on this topic

Blog