Claix is the controlled data retrieval and security layer for AI agents: it connects to your relational database and lets each agent retrieve only the tables and columns you allow and only execute the actions allowed following your rules and limits, without moving your data. Available via REST API, MCP, and A2A.

How do I get started?

Connect any SQL database with a read-only role (Claix drafts a Data Map for you to review), define routes and agents with your rules (no YAML or code), write Guard rules in plain English for the changes an agent may propose, then call one endpoint so your agent gets live typed answers and a verdict before any change, inside the perimeter you set.

Does Claix copy my data into a vector store?

No. Claix does not copy your data or build a vector index over it. Agents query your database where it lives, within the tables and columns you allow. Every query is validated before it runs and traced afterward.

Does Claix write to my database?

No. Claix never writes to your database. Retrieve connects with a read-only role. When an agent proposes an INSERT, UPDATE, or DELETE, Claix Guard answers allow or deny, with the reason, and your code executes. Loading documents into structured fields is a separate product, Claix Ingest, which you choose to use.

Which databases does Claix support?

Any SQL database, including Postgres, MySQL, and MariaDB, plus Postgres-compatible setups such as Supabase. You connect with a read-only role. Claix never executes writes: Guard only answers whether a proposed change is allowed, and your code runs it.

What are routes and agents?

A route is a retrieval capability: the tables and columns allowed plus a short guide with your rules and vocabulary. An agent is the identity that uses them—its own endpoint, business prompt, attached routes, and response mode (raw results or reasoned typed answers). Create a route once and attach it to as many agents as you need.

How do I call a Retrieve agent?

POST to /retrieve/{agent_name} with a JSON body of questions (each with an optional format such as string, int, boolean, json, or array:string). You get typed answers in order plus a log_id. The same agent is also reachable over MCP (claix.retrieve.ask) and A2A.

What answer formats can I request?

In reasoned mode you can ask for string, int, boolean, timestamp, timestamptz, date, json, array:string, or array:int. Typed values mean your workflow can branch on booleans, use numbers and lists directly, and skip parsing free text.

How does pricing work?

Every account gets 30 successful calls free each month, with no card. After that, Claix Managed AI is €0.10 per question. With your own LLM key (BYOK) from OpenAI, Google, Anthropic, or xAI, the Claix fee drops to €0.02 per question and you pay your provider’s tokens directly. Results with your own key depend on the model you choose—test in the Sandbox before going live. Claix Guard is €0.01 per call: each check of an INSERT, UPDATE, or DELETE. There is no model and no managed AI on that check.

Is agentic RAG the same as vector RAG?

No. They sit on different axes. “Agentic” is about who triggers retrieval (a fixed pipeline vs an agent calling a tool). “Vector” is about how results are matched (embeddings). An agent can call SQL, BM25, or embeddings; a fixed pipeline can use hybrid search. For relational business data, embeddings are often the wrong default.

Is SQL retrieval RAG?

Yes. RAG means retrieved information feeds the model. It does not require embeddings, and the retrieved information does not have to be text chunks. A SQL query that returns live records for the model is still retrieval.

When should I still use a vector database?

When you need semantic discovery over a large permanent text collection, heavy repeated search traffic, or a product where search is the product. For exact values, counts, dates, and live rows already in your SQL database, query the database where it lives with scoped access instead of copying it into an index.

Can I use Claix from LangChain, Cursor, or n8n?

Yes. Claix is not an agent framework—it is a retrieval layer you call from the stack you already use. Call REST from any HTTP client (including n8n), expose the agent as an MCP tool for Cursor and compatible clients, or connect over A2A so other agents can delegate data questions.

What happens when the answer is not in the allowed tables?

The field comes back empty instead of a guess. Queries only run inside the routes you attached to the agent; everything outside that perimeter does not exist for them. Traces show what was asked, which route answered, and what came back.

How is Claix different from giving an agent a database MCP server?

A generic database MCP connection is quick to wire up, but the access model depends on the server and the role you attach. Claix adds routes, per-agent allowlists, validation before queries run, typed multi-question answers, Claix Guard — which checks every proposed change against exact rules before your code runs — and a reviewable trace, so you define the boundary once and enforce it on every call.

Does Claix Guard run my INSERT, UPDATE or DELETE?

No. Guard returns a decision. Your code executes the statement with its own credentials.

Does it need my database write credentials?

It does not need write credentials to execute changes, because it does not execute them. The API does need an active connection whose rules it checks.

Can I write rules in plain English?

Yes. Claix proposes exact conditions from your description. You review, edit or approve them before they apply.

Does a model decide whether my SQL is allowed?

Not at check time. The decision uses approved rules. A model is used when the rule is first proposed.

What if I have not activated any rules yet?

The docs say that with no active guards on the connection, the write is allowed. Confirm that active rules cover the tables and operations you want to limit.

Does Guard include human approval?

Guard returns allow or deny. If a person should see a case, deny it with a rule and route that denial in your own workflow.

How is Guard different from Retrieve?

Retrieve controls reads and returns data. Guard checks proposed INSERT, UPDATE and DELETE statements before your application runs them.

Can I protect an agent that still has direct write credentials?

Not by adding Guard as an optional tool. If the agent can reach the database without the executor that requires the check, it can skip it.

Start with Claix Guard

Back to blog

Guide · GuardNovember 12, 2026ByGael Anaya

Set up your agent's first SQL guardrails in 5 minutes

A prompt cannot enforce database permissions. Claix Guard checks the changes your agent proposes against approved rules and returns allow or deny before your code runs them.

Claix · Updated November 2026. Product: Claix Guard (https://www.claix.dev/guard). Check SQL: https://www.claix.dev/documentation/check-sql.

Reading a database and changing it are different jobs. An agent can understand a request and still propose a discount that is too high, an update on the wrong column, or a delete nobody authorized. Writing “do not make dangerous changes” in the prompt does not make that instruction a mandatory check. You set the policy; Guard returns a decision; your application controls execution.

Aspect	How Claix Guard works
Main operations	INSERT, UPDATE and DELETE
Setup	Plain-English rules turned into exact proposals
Activation	You review and approve the rules
Decision	Deterministic check; no model decides on each call
Result	Allow or deny, with the reason
SQL execution	Your application
Oversight	Decisions stored in Guard Traces
Documented databases	PostgreSQL, MySQL and MariaDB

What Claix Guard checks

Guard does not judge whether a conversation “looks safe”. It checks a SQL statement and its parameters against the active rules of a connection. “Discounts cannot exceed 20%” can become a testable condition. A proposed 35% can be denied with the broken rule. Guard does not replace database permissions, schema constraints or your app's access control.

Business rule	What you control
Agents can never delete orders	An operation on a table
A discount cannot exceed 20%	A limit on a value
The agent may change status, never price	Which columns can change
An update must name the order by id	What the WHERE must contain
Refunds above a threshold go to a person	A denial your workflow routes for review
Only certain statuses are allowed	A fixed set of values

Separate the proposal from the execution

The agent should not be able to write to the database itself. It proposes the operation. An executor you control holds the credentials, asks Guard, and decides whether to run it. If the agent has another write path, it can skip the check. You also need active rules. The docs state that if no guards are active, the write is allowed.

Steps

Write one rule you can test, such as “an order discount cannot exceed 20%”. A model helps turn the sentence into exact proposals. Later checks do not ask a model again.
Review the table, column and unit. 20% might be stored as 20 or as 0.20. A person should approve rules. An agent should not be able to loosen the limits that apply to it.
Try allowed and denied cases in the Guard Sandbox before you wire the executor.
Call POST https://claix.dev/check-sql with sql and params. Use $1, $2 for Postgres and ? for MySQL and MariaDB. Send connection_id when you have more than one active connection.
Read allowed, not only the HTTP status. A denial is still HTTP 200. Execute the same statement and parameters you checked.

curl -X POST "https://claix.dev/check-sql" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sql":"UPDATE shop.orders SET discount_percent = $1 WHERE id = $2","params":[35,4821]}'

Response	What your app should do
HTTP 200 and allowed: true	Guard allows the checked operation
HTTP 200 and allowed: false	Guard denies the operation
HTTP 401	Authentication problem
HTTP 400	The request is invalid
Network error, timeout or invalid body	You do not have a valid authorization

What deterministic means

A model may help when the rule is created. It does not decide, on each check, whether a write is allowed. The check uses the approved rules. Deterministic does not promise a fixed latency. It means the allow or deny answer does not depend on talking another model into calling the change reasonable.

Where to place the check

Environment	Where the check belongs
Your backend	In the function that executes changes
An agent tool	Inside the controlled implementation of that tool
n8n or Make	Before the write step, branching on allowed
MCP client	In a flow the agent cannot bypass
Several agents	At the shared executor, or at every authorized executor

Each check returns a decision_id you can open in Guard Traces, along with the operation, table, checked SQL, rules, violations and latency. A stored decision does not prove the write ran. Log the real execution in your app.

What Guard does not do

It does not execute statements.
It does not replace SQL privileges or schema constraints.
It does not see triggers inside the database.
It does not protect a database the agent can reach directly.
It does not handle reads. Use Claix Retrieve for those.

Frequently asked questions

Does Claix Guard run my INSERT, UPDATE or DELETE?: No. Guard returns a decision. Your code executes the statement with its own credentials.
Does it need my database write credentials?: It does not need write credentials to execute changes, because it does not execute them. The API does need an active connection whose rules it checks.
Can I write rules in plain English?: Yes. Claix proposes exact conditions from your description. You review, edit or approve them before they apply.
Does a model decide whether my SQL is allowed?: Not at check time. The decision uses approved rules. A model is used when the rule is first proposed.
What if I have not activated any rules yet?: The docs say that with no active guards on the connection, the write is allowed. Confirm that active rules cover the tables and operations you want to limit.
Does Guard include human approval?: Guard returns allow or deny. If a person should see a case, deny it with a rule and route that denial in your own workflow.
How is Guard different from Retrieve?: Retrieve controls reads and returns data. Guard checks proposed INSERT, UPDATE and DELETE statements before your application runs them.
Can I protect an agent that still has direct write credentials?: Not by adding Guard as an optional tool. If the agent can reach the database without the executor that requires the check, it can skip it.

Start with one rule you can verify

Pick one change the agent needs and one limit the business cannot break. Configure the rule, test an allowed case and a denied case, and connect the check to the component that writes. Start at https://www.claix.dev/guard and use the Check-SQL docs at https://www.claix.dev/documentation/check-sql.