Three young open-source SQL agents show why “read-only” is a stack, not a checkbox

A cluster of small open-source projects is making an old text-to-SQL lesson unusually visible: “read-only” can describe several different controls, and they are not interchangeable.

A retrieval-first entrant

Text-to-SQL RAG Studio, an MIT-licensed repository created October 20, focuses first on generation quality. Its pipeline retrieves relevant schema, uses the foreign-key graph to add bridge tables, injects similar gold queries, and gives failed SQL up to three repair attempts. It supports several bring-your-own-key model providers and ships sample SQLite databases for local testing. Source

Its current safety gate is much simpler than that retrieval machinery. The implementation strips comments, checks that the first word is SELECT, WITH, or EXPLAIN, and rejects a fixed list of mutation keywords with regular expressions. Results are truncated after execution, while the inspected code does not establish a separate database read-only role. That makes the repository useful to study, but not evidence of a hardened execution boundary. Source

Parser plus database permissions

A second repository created the same day takes a different route. The local PostgreSQL Text-to-SQL Agent uses sqlglot to parse one statement, restrict tables and dangerous functions, add a row limit, and reject write-bearing constructs. It then connects through a role granted only SELECT, executes inside a read-only transaction with a five-second timeout, and rolls the transaction back. Source

That project also publishes a small, author-run evaluation: 20 of 24 hand-labelled English and Indonesian questions returned the expected result, while six hostile or out-of-scope requests made no data changes. The author explicitly warns that the same 24 questions informed development, so the 83% figure is not a held-out benchmark. Source

Gate every database read

SchemaFence, an MIT-licensed PostgreSQL DBA agent created October 9, is moving the boundary further outward. Its October 17 commits route catalog reads through the same gate, refuse a read that fills its cap, and review a statement before execution. The repository still has no tagged release or independent adoption signal, but its direction is notable: metadata inspection itself is treated as an operation that needs limits. Source

What buyers should ask

These repositories are too young to rank by adoption. They are already useful as an evaluation checklist. Ask whether a tool parses SQL or scans strings; whether the database account can write even if application checks fail; whether time, rows and catalog reads are bounded before work begins; and whether safety tests cover hostile prompts separately from answer accuracy.

The practical standard is defense in depth: generation constraints, structural SQL validation, least-privilege credentials and database-enforced runtime limits. A “read-only” badge that names only one layer is not enough.