Show HN: Dbward – Approval workflows for production databases

Dbward, an open-core project, has launched approval workflows and audit logs for production databases, featuring multi-step approvals, tamper-evident audit trails, and AI agent guardrails. The core components are Apache-2.0 licensed, with some features under a commercial license. The tool includes standalone Rust binaries with embedded SQLite, MCP-native integration, Slack approvals, and a break-glass emergency bypass, aiming to prevent accidental or unauthorized database operations.

Open-core project— core components are Apache-2.0 . Some features and pre-built binaries include code under the dbward Commercial License . See License for details. Approval workflows and audit logs for your production database. Stop accidents before they hit production. Add approval gates, audit trails, and AI agent guardrails to every database operation — with standalone binaries and embedded SQLite. No external control-plane DB required. - 🔐 Approval workflows — multi-step, conditional auto-approve, TOML policy engine - 📋 Audit logs — tamper-evident hash chain, 24 event types, SQL redaction - 🤖 MCP-native — 12 tools, 6 prompts, elicitation support. AI agents operate safely. Remote HTTP transport for team setups - ⚡ Standalone binaries — CLI, server, and agent ship as self-contained Rust binaries with embedded SQLite. No external control-plane DB - 🔒 Agent isolation — DB credentials never leave the agent. CLI/AI never touch your database directly - 🛡️ SQL safety review — risk classification, DDL detection, DROP blocking. Auto-approve safe queries, require approval for risky ones - 🔍 Preflight — analyze SQL before submitting. Get risk level, EXPLAIN plan, review findings, and fix hints without creating a request. AI agents converge on safe SQL before asking for approval - 🧠 Auto schema context — the agent collects table structures, columns, FKs, and row counts automatically. AI tools access schema via MCP resources — no manual documentation needed - 💬 Slack approvals — approve/reject from Slack with one click. dbward slack init generates the app manifest - 🚨 Break-glass — emergency bypass with mandatory reason and audit. Operator/admin only, not available via MCP - 🆓 Core features free — approval, audit, MCP, Slack, break-glass all included under Apache-2.0 /dbward-dev/dbward/blob/main/LICENSE-APACHE . Team features OIDC, group auth require a commercial license /dbward-dev/dbward/blob/main/LICENSE-COMMERCIAL ┌─────────────────────────────────────────────────────────┐ │ dbward client CLI / MCP │ │ No DB credentials — sends requests, receives results │ └──────────┬───────────────────────────────────────────────┘ │ REST API ▼ ┌─────────────────────────────────────────────────────────┐ │ dbward server │ │ Approval engine │ Policy engine │ Audit log hash chain │ │ Ed25519 token signing │ OIDC/API auth │ Webhooks │ │ In-memory result relay │ NO database credentials │ └─────────────────────────────────────────────────────────┘ ▲ Agent polls outbound HTTPS │ ┌──────────┴───────────────────────────────────────────────┐ │ dbward agent │ │ DB credentials here only │ Executes approved operations │ │ Token verification Ed25519 │ Multiple DB support │ └──────────┬───────────────────────────────────────────────┘ │ ▼ Target Database PostgreSQL / MySQL Key principle : The client requests. The server decides. The agent executes. No component has more access than it needs. Try the approval flow in 2 minutes Docker : git clone https://github.com/dbward-dev/dbward.git && cd dbward/examples/quickstart docker compose up -d docker compose run --rm alice execute "SELECT version " -e development Then submit → approve → execute → audit. Full walkthrough: Quickstart with Docker https://dbward.dev/docs/quickstart-docker/ Quick smoke test local install : curl -fsSL https://dbward.dev/install.sh | sh dbward dev --database-url "postgres://user:pass@localhost:5432/mydb" In another terminal: dbward --config ~/.dbward/dev/client.toml --database app execute "SELECT 1" Dev mode auto-approves everything for fast iteration. See Connect Your Database https://dbward.dev/docs/quickstart-local/ for details. Full reference: docs/reference/mcp.md { "mcpServers": { "dbward": { "command": "dbward", "args": "mcp" } } } MCP Tools 12 : | Tool | Description | |---|---| dbward execute query | Execute SQL SELECT/DML via approval workflow | dbward migrate status | Show migration status | dbward migrate up | Apply pending migrations | dbward migrate down | Rollback migrations | dbward migrate create | Create migration file local | dbward wait request | Wait for request completion and return result | dbward list pending | List pending approval requests | dbward who can approve | Show who can approve a request | dbward find similar requests | Find similar past requests | dbward preflight sql | Analyze SQL safety without creating a request | dbward explain policy failure | Explain why approval is needed | dbward inspect schema | Inspect database schema list tables or describe columns | MCP Prompts 6 : review migration , explain request , draft migration , draft rollback , summarize audit trail , prepare approval comment Elicitation: On production operations, dbward asks the AI client for a reason before proceeding if the client supports MCP elicitation . Remote MCP HTTP : For team setups, the server exposes MCP over HTTP — no local binary needed 9 tools, excludes local-only migration tools : { "mcpServers": { "dbward": { "type": "streamable-http", "url": "https://your-server.example.com/mcp" } } } dbward uses on-demand execution : the agent does not execute on approval. Instead, the client explicitly resumes the request when ready to receive the result. 1. Client creates request → server evaluates policy → pending / auto approved 2. If pending Human approves via CLI 3. Client resumes dbward request resume <id → server marks as "dispatched" 4. Agent polls, claims, executes on DB → returns result to server 5. Server relays result in-memory to waiting client long poll 6. Client displays result server persists to local FS or S3 Results are persisted on the server by default local filesystem or S3, configurable via result storage . The in-memory relay has a 10-minute TTL for streaming delivery. Use --no-result-store to skip persistence for a single request. Defined in server.toml and hot-reloaded via SIGHUP. See Configuration Reference /dbward-dev/dbward/blob/main/docs/reference/configuration.md . Control whether operations require approval: workflows database = " " environment = "production" operations = "execute select", "migrate up", "migrate down" workflows.steps type = "approval" workflows.steps.approvers role = "admin" min = 1 Auto-approve low-risk queries in staging; risky ones still need approval workflows database = " " environment = "staging" workflows.auto approve mode = "risk based" risk = "low" workflows.steps type = "approval" workflows.steps.approvers role = "admin" min = 1 Control re-execution limits rate limiting : execution policies database = "primary" environment = "production" max executions = 10 execution window secs = 3600 retry on failure = false Control who can access results and storage: result policies database = "primary" environment = "production" delivery mode = "stream" access = "requester", "admin" Route webhooks per database × environment: notification policies database = "primary" environment = "production" notification policies.webhooks url = "https://hooks.slack.com/services/..." format = "slack" Full reference: docs/reference/cli.md dbward OPTIONS <COMMAND Commands: init Interactive setup wizard doctor Diagnose connectivity and configuration login OIDC login browser or --device for headless logout Revoke tokens and delete credentials whoami Show current identity and role migrate Run migrations up/down/status/create execute Execute SQL --emergency --reason for break-glass audit Search audit log --verify for hash chain check mcp Start MCP stdio server server Server management start, token create/revoke, reload agent Start the agent dev Start local dev server + agent self-update Update dbward to the latest version request Manage requests: list List requests --pending-for-me, --status show Show request detail approve Approve a pending request reject Reject a pending request resume Resume and wait for result cancel Cancel a pending request token Manage API tokens create/list/revoke user Manage users list/suspend/activate slack Slack integration: init Generate app manifest and creation URL policy Policy tools: resolve Resolve effective policy for a request Global Options: --version, -v Show version and exit --config <PATH Config file standalone mode; omit for auto-detect --database <NAME Target database env: DBWARD DATABASE --environment <ENV Environment env: DBWARD ENV Full reference: docs/reference/api.md | Method | Path | Description | |---|---|---| | POST | /api/requests | Create request | | POST | /api/requests/:id/approve | Approve | | POST | /api/requests/:id/resume | Resume for on-demand execution | | GET | /api/requests/:id/result/stream | Long-poll for result | | GET | /api/audit/events | Audit events | | GET | /api/audit/verify | Verify hash chain integrity | | POST | /api/tokens | Create API token | | GET | /api/databases | List configured databases | | GET | /api/agents | List connected agents | | POST | /mcp | Remote MCP HTTP | See full API reference /dbward-dev/dbward/blob/main/docs/reference/api.md for all endpoints, parameters, permissions, and response formats. Threat model and hardening guide: docs/security/ Zero-trust client — developer machines never have DB credentials Signed execution tokens — Ed25519. Token includes SHA-256 hash of SQL + target database Token replay prevention — executed/failed requests don't issue new tokens Multi-statement rejection — prevents SQL injection via statement chaining Writable CTE detection — WITH x AS DELETE ... SELECT ... classified as DML RBAC — admin system management , requester SQL operations , operator monitoring + break-glass , approver review Network isolation — server has no DB credentials; agent connects outbound only API token auth — SHA-256 hashed, prefix+hash composite lookup OIDC auth — JWT verification with JWKS caching, RS256/ES256, PKCE for CLI Team Audit hash chain — SHA-256 chain linking all events, tamper-evident | Target | Status | |---|---| | Linux x86 64 glibc | ✅ Supported | | Linux aarch64 glibc | ✅ Supported | | macOS Apple Silicon | ✅ Supported | | macOS Intel | ✅ Supported | | Windows | ❌ Not supported | Pre-built binaries are available on GitHub Releases https://github.com/dbward-dev/dbward/releases . Docker images are published for linux/amd64 and linux/arm64 . Note:Pre-built binaries and Docker images include commercial-licensed components. They are free to use within Free plan limits. See LICENSE for details. | Database | Status | |---|---| | PostgreSQL | ✅ Supported | | MySQL | ✅ Supported | Auto-detected from URL scheme postgres:// or mysql:// . Full guide: docs/guides/authentication.md Initial tokens created automatically on first server start: cat ./data/admin-token admin token cat ./data/agent-token agent token Additional tokens via API: dbward token create --subject alice --role admin dbward login Browser-based PKCE dbward login --device Headless SSH, containers dbward whoami Check identity dbward logout Revoke + delete tokens Approve and reject requests directly from Slack with interactive buttons: dbward slack init --server-url https://your-server.example.com → generates Slack App Manifest, opens creation URL Configure in server.toml : slack bot token = "${SLACK BOT TOKEN}" signing secret = "${SLACK SIGNING SECRET}" channel = "C0123ABC456" See Notifications Guide /dbward-dev/dbward/blob/main/docs/guides/notifications.md for setup details. webhooks url = "https://internal.example.com/dbward" format = "generic" secret = "whsec xxxx" HMAC-SHA256 in X-Dbward-Signature header Events: request.created , request.approved , request.rejected , execution.completed , request.break glass . Free: unlimited webhook destinations. dbward execute "SELECT pg terminate backend 12345 " \ --emergency --reason "connection pool exhausted at 3am" - Skips approval — agent executes immediately when dispatched - Fires request.break glass webhook 🚨 in Slack - Reason recorded in audit log Operator or admin role requires request.break glass query for SELECT, request.break glass dml for writes Not available via MCP AI agents cannot trigger break-glass Full reference: docs/reference/configuration.md Config is resolved in two layers: Global ~/.config/dbward/config.toml : server URL, token/OIDC Project ./dbward.toml : databases, migrations server url = "http://localhost:3000" token = "dbw ..." default database = "app" migrations dir = "db/migrations" databases.app No DB URL here — agent handles connections agent id = "agent-prod" poll interval ms = 1000 max concurrent tasks = 2 server url = "https://dbward.internal:3000" agent token = "${DBWARD AGENT TOKEN}" databases.primary.production url = "${DATABASE URL PRIMARY}" databases.analytics.production url = "${DATABASE URL ANALYTICS}" Start: dbward-server start --config server.toml --listen 0.0.0.0:3000 state dir = "/data" auth OIDC enabled when auth.oidc section is present webhooks url = "https://hooks.slack.com/services/..." format = "slack" workflows database = " " environment = "production" operations = "execute select", "migrate up", "migrate down" workflows.steps type = "approval" workflows.steps.approvers role = "admin" min = 1 execution policies database = " " environment = "production" max executions = 10 execution window secs = 3600 logging output = "stderr" "stderr" default or "file" file path = "/var/log/dbward/server.log" only when output = "file" rotation = "daily" "daily" default , "hourly", "never" Environment variables: DBWARD LOG FORMAT=json → JSON output production RUST LOG=info → log level filter default: info | Free | Team $149/mo | | |---|---|---| | Database connections | 3 | 20 | | Active users | 20 | 50 | | Workflow rules | Unlimited | Unlimited | | Webhooks | Unlimited | Unlimited | | Agents | Unlimited | Unlimited | | Approval + Audit + MCP + Break-glass | ✅ | ✅ | | Slack approval UI | ✅ | ✅ | | Result policies | ✅ | ✅ | | Notification policies | ✅ | ✅ | | OIDC / SSO | — | ✅ | | Group-based authorization | — | ✅ | | Audit export CSV/JSON | — | ✅ | Safety features are always free. You pay for scale and organizational complexity. Team plan is not yet available. Join the waitlist to get notified. Migrations use single-file dbmate-compatible format https://github.com/amacneil/dbmate : migrations/ ├── 20260501120000 create users.sql └── 20260502090000 add email.sql -- migrate:up CREATE TABLE users id SERIAL PRIMARY KEY, name TEXT NOT NULL ; -- migrate:down DROP TABLE users; dbward uses an open-core licensing model. Core crates/ : Apache-2.0 /dbward-dev/dbward/blob/main/LICENSE-APACHE — approval workflows, audit logs, MCP, SQL review, agent execution, break-glass. Use, modify, and redistribute freely. Commercial commercial/ : dbward Commercial License /dbward-dev/dbward/blob/main/LICENSE-COMMERCIAL — OIDC/SSO, group authorization, Team/Enterprise plan enforcement. Requires a paid subscription for production use. No license key = Free plan. All core features work without restriction. See LICENSE /dbward-dev/dbward/blob/main/LICENSE for the full structure.