Thelastlineof
defensebetween
youragentand
production.
Route agent SQL through a PostgreSQL-aware gateway. Risky writes can require approval, verified recovery points, and auditable restore paths before they touch production.
Your data stays in your infrastructure · Open source core · Self-hosted by default
> agent-gpt4 executing:
Built for teams shipping with AI agents
AI agents don't ask permission.
They have your credentials
You gave the agent DATABASE_URL. It can see everything, change everything, delete everything. Without asking.
They don't understand consequences
An LLM doesn't know the difference between a test database and production. It executes what it plans.
It happens in seconds
PocketOS: 9 seconds. By the time you see the Slack alert, the data is gone.
Install once. Protected forever.
Start
backstop-oss upBrings up the gateway, sync sidecar, PostgreSQL, and MinIO for the local OSS flow.
Intercept
AST parsing classifies the query as CRITICAL and the gateway checks for a latest recoverable snapshot. No regex. No guessing.
Recover
backstop recover \ --db $DATABASE_URL \ --storage s3://prod-snaps \ --table users
The guided recovery flow rebuilds a recovered table, validates it, and prints copyback SQL only after the checks pass.
Two lines. That's it.
import osimport psycopg2import backstopraw_conn = psycopg2.connect(os.environ["DATABASE_URL"])db = backstop.guard( conn=raw_conn, storage="s3://prod-snapshots@http://localhost:9000", actor="gpt-4-agent", mode="protect",)db.execute("DROP TABLE users")db.commit()Every query. Classified. Instantly.
Built for the age of agents.
AI agents — LangChain, LlamaIndex, Cursor, any OpenAI function-calling agent — can be tagged with an actor identity when wrapped with backstop.guard(conn, actor="langchain-agent-v2", storage="s3://...").
Risky actions are attributed and audited. The gateway can require human approval for HIGH and CRITICAL operations, and table-level destructive actions can be bound to verified recovery points before they touch production data.
Query Intercepted
CRITICAL risk detected in real-time
Snapshot Created
Table state preserved before any mutation
Human Notified
Approval required before agent proceeds
Everything you need. Nothing you don't.
Fast Table Restore
Restore preview first, then recover into a separate table. The full flow stays in your infrastructure and timing depends on table size, storage throughput, and validation steps.
Bring Your Own Storage
Snapshots are written to AWS S3 or a compatible endpoint such as MinIO.
Open Source Core
Read the SDK, gateway, sidecar, restore engine, and launch drills.
Agent Identity Tracking
Stable actor names connect SQL events to the agent that ran them.
Immutable Audit Trail
Audit and snapshot records capture the table, operation, actor, row count, and storage references for review.
Parser Benchmark
The CLI includes a local parser benchmark command so you can measure classifier overhead in your own environment.
Fits into your current stack.
Start free. Scale when you're ready.
OSS
available today
Pro
planned
Team
planned
Commercial workflow layer is still being shaped.
The self-hosted OSS core is the product available today. Managed and enterprise workflows are roadmap discussions, not shipped features.
How teams usually make use of it.
Cursor via MCP
Common rollout pattern
Give the AI tool the Backstop MCP server instead of DATABASE_URL. The agent gets SQL tools, but the gateway keeps approval, audit, and recovery decisions in the middle.
Table recovery
Common rollout pattern
Use sidecar snapshots for fast table-level recovery, and keep native PostgreSQL backup plus WAL/PITR for full-database incidents. Backstop is strongest when those two planes are used together.
Bypass detection
Common rollout pattern
If an agent or script connects directly to PostgreSQL, Backstop cannot intercept that query. Bypass detection makes this posture visible so teams do not confuse recovery-only mode with prevention.
Approval workflow
Common rollout pattern
Use agent-scoped tokens for execution and operator-scoped tokens for approve or deny. Autonomous agents should be able to request risky work, but not approve their own destructive queries.
Bring your own storage
Common rollout pattern
Point snapshots and WAL artifacts at your own S3-compatible storage, such as MinIO. The safety and recovery flow stays inside infrastructure you already control.
Dev vs prod policy
Common rollout pattern
Use looser policy in development, stricter policy in production, and explicit pause or quarantine controls for incidents. That balance reduces bypass pressure without giving away protection.
Audit attribution
Common rollout pattern
Stable BACKSTOP_AGENT_ID values make the audit trail readable. They also enable agent quarantine, filtered review, and cleaner incident response when multiple tools touch the same database.
Production readiness
Common rollout pattern
Run the doctor commands, snapshot drills, storage checks, and incident runbooks before rollout. Backstop adds safety value when the operational boundary is understood and rehearsed.
Local-first metadata
Common rollout pattern
SQLite metadata keeps the OSS core easy to run locally while still giving you durable audit, approval, alert, and snapshot records that a future dashboard can read directly.
Read every line. Trust what you deploy.
Backstop's core is Apache-2.0 licensed. When a tool stands between an AI agent and your production data, you deserve to read the gateway, sidecar, MCP server, SDKs, restore path, and drills yourself.
Yournextdeploymentshouldn'tbeyour last.
Add a safer control layer in front of production SQL. Approve risky writes, verify recovery readiness, and restore supported table snapshots without leaving your own infrastructure.
Free forever for self-hosted. No credit card required.