Stop a bad statement before it reaches your database.
Quell sits between whoever's talking to your database — a person, an app, or an AI agent — and the database itself. It reads every statement first and estimates the real blast radius, how many rows it would actually touch, instead of just pattern-matching the SQL text.
Two teams that shouldn't touch prod directly
Both already have valid credentials. That's exactly the problem: a valid credential isn't the same thing as a safe statement.
AI agents
Give an agent a raw connection string and it has exactly as much access as anyone who has the password, with none of a human's hesitation before running something destructive. Point it at Quell over MCP instead, and every tool call goes through the same analyzer, policy engine, and blast-radius estimator a wire-protocol client does. No separate, weaker ruleset for automation, and freeze mode overrides an agent's own instructions, not just its intentions.
Production support & on-call
A support engineer running a one-off fix at 2am under incident pressure makes the same category of mistake an agent does: a missing WHERE, the wrong environment, a row count nobody had time to check first. Quell estimates the real blast radius and blocks the ones that matter before they run, and leaves a hash-chained record of exactly what happened for the incident review afterward either way.
Free to run. Access is by invitation while this is pre-1.0.
Everything on this page, and every doc linked from it, is public. Running the software itself isn't: nothing at runtime checks a license or calls home, access is controlled entirely by who can reach the private repo the binaries and container image are published to.
"Don't touch prod" is a sentence.
It isn't enforcement.
In July 2025, an AI coding agent at Replit ran destructive commands against a live production database during an active, human-declared code freeze. It had been told, in plain English, not to. It then told the operator the deletion couldn't be rolled back. That wasn't true.
A natural-language instruction is not an enforcement boundary, and an agent's own account of what it did is not a reliable record. Quell closes the part of that gap a database proxy actually can: freeze mode is a hard write lockdown that sits outside the policy engine entirely — no rule, scope, or in-SQL override can get around it — and every decision is written to a tamper-evident, hash-chained audit log, so nobody has to take an agent's word for what happened.
Replit, July 2025. An AI coding agent ran destructive SQL against a production database mid-freeze, then misreported that the deletion was unrecoverable.
incidentdatabase.ai/cite/1152 ↗Every statement passes through the same pipeline
Whether it comes from psql, an app's connection pool, or an AI agent
over MCP — nobody gets a separate, weaker set of guardrails.
Listener
Speaks real Postgres or MySQL wire protocol. TLS optional, mixed mode.
Analyzer
Parses the statement into a real AST. Spots missing or tautological WHERE clauses.
Policy engine
Matches your rules — hot-reloaded, no dropped connections.
Estimator
A side connection asks how many rows this would really touch.
Audit
Every decision hash-chained to disk, whether or not it was blocked.
Guardrails that hold up under an incident, not just a demo
Blast-radius estimation
A perfectly valid DELETE can still wipe 40% of a table. Quell estimates the real row count via EXPLAIN or an exact COUNT, on a dedicated side connection, before deciding.
Policy engine
A YAML file that hot-reloads without dropping connections. Match on statement kind, table, schema, or a scheduled time window. Scopes and overrides, both fully audited.
Freeze mode
One command locks down every write across your entire fleet, instantly, independent of any policy rule, scope, or override. Reads keep working.
Tamper-evident audit log
Every record's hash covers the one before it. Editing, deleting, or reordering a past entry becomes detectable, not something you have to hope didn't happen.
Hold & approve
A risky statement waits, pings Slack or Teams, and resolves through the admin API — approve, deny, or time out to denied. Nobody babysits a queue for this to be safe by default.
MCP mode for AI agents
run_query, explain_query, list_tables over stdio, through the exact same analyzer, policy, and estimator pipeline the wire proxy uses. No separate, weaker ruleset for agents.
Runs as a fleet
Add [cluster] and freeze status, pending approvals, and open sessions become shared across every instance — coordinated through the database itself, no new infrastructure.
Client TLS & credential substitution
Terminate client TLS on either protocol. ${VAR_NAME} anywhere in the config file keeps every password and token out of plaintext.
Speaks the real wire protocol, not a vendor SDK
Works with any managed or self-hosted Postgres/MySQL, since Quell proxies the actual protocol traffic, not one hosting provider's API.
| Engine | Versions tested in CI | Auth methods | Blast-radius estimation |
|---|---|---|---|
| PostgreSQL | 16, 17 | Any pg_hba.conf-permitted method | EXPLAIN or an exact COUNT |
| MySQL | 8.4 | mysql_native_password, caching_sha2_password | EXPLAIN only |
| MariaDB | 11 | Same MySQL wire protocol | EXPLAIN only |
Not supported yet: SQL Server / TDS (tracked as an optional milestone, not started, not a gap), Oracle, and other wire protocols. Amazon RDS/Aurora, Google Cloud SQL, Azure Database, and self-hosted instances all work the same way.
Stated plainly, not left for you to discover later
What it defends against
Data integrity and availability, from a runaway or malicious statement — human or AI-issued. Not a network security boundary or an access-control system.
Read the threat model ↗Where it stops
A leaked cloud API token used directly against infrastructure never crosses Quell's listener as SQL. That's a secrets-management problem, not a query-guarding one.
Read the limitations ↗Every release, tracked
What changed in each version, kept as a running record rather than a one-line tag description.
Read the changelog ↗Report a bypass privately
Found a way around a block, freeze mode, or the admin API's auth? Report it before it's public.
Security policy ↗Running in five minutes, against a real test database
Once you have access: docker compose up, point Quell at it, connect
with psql instead of the database directly. Nothing to configure
beyond one quell.toml.