Show HN: Aegis – A Layer-4 Postgres proxy in Go to block destructive AI SQL

A developer released Aegis, an open-source Layer-4 Postgres proxy written in Go that sits between an application and its database on TCP port 5433 (with an admin and metrics API on port 5434) and blocks destructive SQL such as DROP TABLE or unfiltered DELETE statements before they reach the database, terminating the connection instead. Aegis is distributed as the Docker Hub image raymondartin2/aegis-proxy and requires a docker-compose.yml and .env file with four mandatory values — NEON_API_KEY, NEON_PROJECT_ID, AEGIS_ADMIN_TOKEN, and an AEGIS_JWT_SECRET of at least 32 characters — with the proxy exiting at startup if the JWT secret is missing. The proxy parses every query, enforces rate limits, and forwards benign queries to the database over TLS, aimed at limiting damage from AI-generated or other automated SQL.

Aegis sits between your application and your Postgres database and blocks destructive queries before they run, without you changing a line of your database code. 👋 Note: If you are cloning this to test the Wasm AST parser locally, please drop a ⭐ on the repo It helps me know people are actually using the open-source tier. sequenceDiagram participant App as Your Application<br/ psycopg2, or any client participant Proxy as Aegis Proxy<br/ :5433 TCP intercept / :5434 admin+metrics participant DB as Your Database<br/ e.g. Neon Postgres App- Proxy: SELECT ... benign query Proxy- DB: forwarded over TLS DB-- Proxy: rows Proxy-- App: rows App- Proxy: DROP TABLE ... destructive query Note over Proxy: parsed, blocked, connection terminated<br/ the "Guillotine" Proxy-- App: fatal error Note over DB: never reached Your application never talks to the database directly — every query passes through the proxy first. A benign query is forwarded and the rows come straight back. A destructive one DROP TABLE , an unfiltered DELETE , etc. is intercepted and the connection is terminated before it reaches your database. Plain-text diagram terminal-friendly Your Application Aegis Proxy Your Database psycopg2, or any client e.g. Neon Postgres +--------------------+ Postgres wire +-----------------------------+ TLS +--------------------+ | | ------------------ | :5433 TCP intercept | ------- | | | SELECT ... | | - parses every query | | real database | | DROP TABLE ... | <------------------ | - enforces rate limits | <------- | | | | rows, or a | - blocks destructive | | | +--------------------+ fatal error | statements the | +--------------------+ if blocked | "Guillotine" | | :5434 admin + metrics API | +-----------------------------+ Three steps, one command to start the stack, and a running proxy. The primary way to install Aegis is to pull the published image straight from Docker Hub: docker pull raymondartin2/aegis-proxy Expected output tag/digest will vary by release : latest: Pulling from raymondartin2/aegis-proxy Digest: sha256:... Status: Downloaded newer image for raymondartin2/aegis-proxy:latest docker.io/raymondartin2/aegis-proxy:latest You still need this repo's docker-compose.yml and .env.sample to run the stack, so grab those too: git clone https://github.com/raymondhani/aegis-proxy.git cd aegis-proxy cp .env.sample .env <sub Building the image yourself instead of pulling it is also supported — see Dockerfile in this repo — but pulling the published image is the recommended, primary path.</sub Now open .env and replace the four placeholders with your own values: | Placeholder in .env.sample | What to put there | |---|---| | NEON API KEY=your api key here | An API key from your Neon https://neon.tech account | | NEON PROJECT ID=your project id here | The Neon project Aegis should provision ephemeral branches in | | AEGIS ADMIN TOKEN=your custom admin token 12345 | Any string you choose — Aegis's own admin credential, not from Neon | | AEGIS JWT SECRET=your super secret jwt key that is at least 32 bytes long | Any string at least 32 characters long — used to sign session tokens | None of these are optional: the proxy exits immediately at startup if AEGIS JWT SECRET is missing, and every step below assumes all four are set. docker compose up -d Expected output container name may vary slightly depending on your folder name : Container aegis-proxy Started This single command starts the container Aegis needs: the proxy itself, listening on 5433 the database connection and 5434 an admin/metrics API . The OSS proxy runs on in-memory state and has no hard dependency on Redis — Redis is used only by the Enterprise tier for distributed/HA state. curl -s http://localhost:5434/metrics Expected output: {"queries processed":0,"queries blocked":0,"active connections":0,"sessions jailed":0,"anomalies detected":0} If you see that, the proxy is up and ready to accept connections. Install the SDK and the Postgres driver, then run this against the stack you just started — nothing here needs modification beyond the credentials you already set in .env . pip install aegis-proxy-sdk psycopg2-binary python import psycopg2 from aegis sdk import safe db run @safe db run def run demo db url: str : conn = psycopg2.connect db url conn.autocommit = True cursor = conn.cursor print "Running an ordinary query..." cursor.execute "SELECT 1;" print f"Result: {cursor.fetchone }" print "Running a destructive query: DROP TABLE users;" cursor.execute "DROP TABLE users;" if name == " main ": try: run demo except psycopg2.OperationalError as e: print f"\n Aegis Connection severed by the proxy: {e}" The @safe db run decorator does the setup for you: it provisions a throwaway Neon database branch, mints a session token, and points db url at the local proxy instead of the real database — then deletes the branch again when the function returns. Your function just receives a working db url and uses it like any other Postgres connection string. Expected output: Running an ordinary query... Result: 1, Running a destructive query: DROP TABLE users; Aegis Connection severed by the proxy: server closed the connection unexpectedly This probably means the server terminated abnormally before or while processing the request. The SELECT 1 succeeds normally. The DROP TABLE never reaches the database — the proxy detects it, terminates the connection, and psycopg2 surfaces that as OperationalError . Catching that exception around the specific call you expect to be blocked is the intended pattern, not a workaround. @safe db run also accepts a few optional keyword arguments for less common setups: | Parameter | Type | Default | Description | |---|---|---|---| | agent id | str | None | A label for this run, included in telemetry — useful when multiple agents share one proxy. | | proxy port | int | 5433 | The TCP port the proxy is listening on, if you changed it from the default. | | validation rules | list | built-in schema checks | Custom functions to run against the database schema before/after execution, replacing the defaults no dropped tables, no dropped columns, every table keeps a primary key . | Because Aegis operates completely transparently at Layer-4 the network layer , developers do not need to write custom application code, install framework-specific plugins, or change their AI logic. To secure an AI agent against hallucinations, simply spin up Aegis and change your standard database connection port from 5432 to 5433. The Old, Dangerous Way Direct to DB : db = SQLDatabase.from uri "postgresql://user:pass@localhost:5432/my db" The Secure, Aegis Way Routed through the Layer-4 Proxy : db = SQLDatabase.from uri "postgresql://user:pass@localhost:5433/my db" Aegis ships as three products built on the same core. Every capability below is enforced by the proxy itself, not just documented — the automated benchmark suite in this workspace asserts each one directly against a running instance of every tier. | Capability | OSS Proxy self-hosted | Hosted SaaS managed | Enterprise Guardrail self-hosted | |---|---|---|---| | Static rate limiting — stops a single client from firing more queries per minute than the account allows | ✅ | ✅ | ✅ | | Wire transparency — works with your existing Postgres client, unmodified, by speaking the same wire protocol | ✅ | ✅ | ✅ | | The Guillotine — instantly kills any connection that tries to run a destructive statement, before it reaches your database | ✅ | ✅ | ✅ | | ML adaptive throttling — learns each agent's normal query pattern and slows down abnormal spikes automatically, instead of one fixed limit for everyone | — | ✅ paid plans | ✅ | | Central fleet telemetry — live query activity across your whole fleet of proxies in one feed, not one proxy at a time | — | ✅ paid plans | ✅ | | eBPF kernel-bypass — drops malicious traffic inside the Linux kernel itself, before user-space code ever sees it, for the lowest possible latency | — | — | ✅ | | Custom AST policies — write your own rules for which query patterns are allowed, beyond the built-in defaults | — | — | ✅ | | Symptom | Cause | Fix | |---|---|---| | Wrong port — your app hangs or times out connecting on 5432 | Aegis is not a Postgres server on the standard port. It listens on 5433 specifically, so it can run alongside a real Postgres instance on the same host without colliding. | Point your connection string at 5433 — the docker-compose.yml in this repo already maps it. | | Missing credentials — the container exits right after starting docker compose ps shows Exited , or your script raises ValueError: AEGIS JWT SECRET environment variable is missing. | .env was never created, or one of the four values is still the placeholder from .env.sample . | cp .env.sample .env , fill in real values AEGIS JWT SECRET needs to be 32+ characters , then docker compose up -d again. | | Container not started — docker ps shows nothing for aegis-proxy | docker compose up -d was never run in this directory, or it failed earlier without you noticing. | Run docker compose up -d from the repo root and read its output — each container should say Started . | | Connection refused — docker compose ps shows aegis-proxy as Up , but your client still can't connect | Almost always a host mismatch. A client running inside its own Docker container can't reach the proxy via localhost — it needs the Docker-internal address. | From another container, connect to host.docker.internal:5433 Mac/Windows or join the aegis-net network and use the service name aegis-proxy . Running your script directly on the host, as in the quickstart above, needs no special host. | | Unexpectedly severed query — psycopg2.OperationalError: server closed the connection unexpectedly right after running a query | This is almost always the Guillotine working as intended — the proxy detected a destructive statement and terminated the connection to block it. It is not a network problem. | Catch psycopg2.OperationalError around the specific call, exactly as the example above does. If a query you didn't expect to be destructive gets blocked, that's a policy question, not a connectivity bug. | Aegis is designed to support a Multi-Agent Workflow where several autonomous AI agents can operate simultaneously without cross-contamination. - Sandboxed Execution: Every agent interaction is securely sandboxed in a dedicated Copy-on-Write CoW ephemeral branch provisioned via the Neon API. - Z-Score Anomaly Detection: Agents' queries are mathematically analyzed in real-time using native PostgreSQL AST parsing via wasilibs/go-pgquery . - Cryptographic Agent Identity: Agents are identified using signed JWTs for secure, tamper-proof authentication. - Advanced Threat Telemetry: Zero-latency monitoring is powered by OpenTelemetry. Aegis seamlessly bridges high-performance systems-level intercept logic with accessible data-science workflows. 1. The Go Proxy Engine Layer 4 : Written in Go using Clean Architecture. It binds to local ports 5433 for TCP, 5434 for the HTTP admin/metrics API and intercepts PostgreSQL wire-protocol traffic. 2. The Python SDK Application Layer : Using the @safe db run decorator, the SDK automatically provisions an ephemeral branch, configures the agent's connection string to point to the local Go proxy instead of directly to the database, and manages the lifecycle of the run. Aegis uses a hardened CI/CD pipeline for distribution: - Continuous Integration: Every commit to main and every pull request triggers a suite of unit tests. - Docker Publishing: The pipeline builds multi-architecture Docker images ARM64 & AMD64 and pushes them to Docker Hub. While @safe db run provides a seamless, zero-friction wrapper, aegis sdk also exposes its underlying classes for developers who need custom integrations or manual state management: - NeonProvisioner : Programmatically create, monitor, and tear down Neon ephemeral branches outside of the standard decorator flow. - AnomalyDetector : Interface directly with the Z-Score engine to evaluate query payloads or agent behaviors before they hit the execution pipeline. The open-source proxy is built for local development and single-node sandboxing. For production-scale teams, Aegis Enterprise is commercially backed by Languaza Software and adds, on top of everything above: - eBPF Kernel Acceleration: Drops malicious packets at the Linux XDP layer for the lowest possible latency. - Cryptographic Identity Validation: Verifies JWTs against cached JWKS to prevent API key sharing. - Distributed State: Redis-backed rate limiting for High Availability HA clusters. - SIEM Exporters: Batches and streams anomaly events directly to Datadog and Splunk. - Local Management Console: A self-hosted control plane is available at port 3000 . Need production-grade guardrails for your AI agents? Contact our enterprise team at aegis@languaza.net mailto:aegis@languaza.net to schedule a technical architecture review. - AGENTS.md : Machine-readable specifications and boundaries for AI coding assistants.