Lomberk: every agent write, reversible

What else the agent tried.

Most attempts never reach the database. The rest wait for a person, who reads the exact SQL first.

DROP TABLE public.usersDenied
DDL is refused by PostgreSQL's own parser before it runs.
DELETE FROM public.usersDenied
A write with no WHERE clause.
SELECT set_config('role', 'postgres', false)Denied
Only an allowlist of pure built-in functions is callable.
UPDATE public.orders SET total = 0 WHERE 1=1Held
It touched more rows than the limit, so it was rolled back and queued.
DELETE FROM public.users WHERE id > 0Held
public.users is protected. This is the one you just undid.

How undo works.

No point-in-time restore, and nobody else's later writes lost.

The database records every change

A trigger inside PostgreSQL captures each changed row, cascades included, and refuses agent writes that don't carry a single-use token.

Undo goes parents first

Deleted rows come back in foreign-key order, then updates revert, then inserts disappear. That's why the users returned before their payments.

It refuses to overwrite

If a row changed after the checkpoint, or the schema drifted, undo stops and names the row. It never guesses.

The ledger can be checked

Checkpoints are append-only and SHA-256 hash-chained. lomberk verify-ledger finds the first altered entry.

One command to set it up.

Give it your database owner's connection string once. It creates two least-privilege roles, installs Lomberk, makes the tables you pick undoable, checks the result and prints the line for Claude Code, Cursor, Claude Desktop, VS Code or Codex.

uvx lomberk setup   # asks for it, hidden

claude mcp add lomberk \
  -e LOMBERK_CONFIG=$PWD/lomberk.yaml \
  -- uvx lomberk serve

A captured, undoable write	18.3 ms
A read through Lomberk	5.4 ms
A plain write, new connection	4.8 ms

Postgres 16, p50 over 200 runs. Agent turns take seconds. Tested on Postgres 14–18.

Terminal recording: DROP and DELETE without WHERE are denied, a DELETE on a protected table is held, a person approves it, the rows disappear, and undo brings back 3 users and 2 payments. — The same data, recorded against a real gateway started with `docker compose up`.

What it doesn't cover.

Your security team will ask, so here it is up front. The full model is in SECURITY.md, and 20 real attacks with the exact refusal for each are in the attack gallery.

Infrastructure tokensLomberk guards the SQL path. An agent holding a cloud or hosting API token can still delete a volume. Keep those tokens away from agents.
Database superusersThey can disable triggers and rewrite the ledger. Ship the ledger's head hash to your SIEM.
Some tables, for nowTables with rules or classic inheritance are refused rather than guessed at, and so are partitioned tables with their own triggers. Writes to other tables with their own triggers wait for a person, unless you register the table with --allow-triggers.
Schema changesDDL is blocked, not reversible. It goes through your normal migrations.

Pricing.

The whole safety path is free and open source. Solo adds a month of undo and the panel for one developer; Pro adds what a team needs to share it.

Free

Apache-2.0 and self-hosted. Hard gate, holds, capture, ledger, approvals from the API or CLI. Undo reaches back 24 hours.

Start free

Solo

$49 / month

For one developer and one database. Undo reaches back 30 days. Web approval panel and audit export.

Details

Pro

$199 / month

Or $1,990 a year. Undo reaches back 30 days. Web approval panel, two-person rule, Slack approvals, approver SSO, audit export. One key covers up to 3 databases.

Buy Pro

Enterprise

Custom

Undo with no time limit, unlimited databases, an annual invoice, priority answers, and help with your security questionnaire.

Talk to us

Self-hosted, so your data never reaches us. Pay by card through Polar and the license key arrives by email. No calls needed: lomberk doctor checks your setup and tells you how to fix each problem.

Every agent write, reversible.