rowsafe

module

v0.10.26 Latest Latest Go to latest Published: Oct 20, 2026 License: Apache-2.0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/rowsafe/rowsafe

Links

Open Source Insights

README ¶

Rowsafe

The database admin you never hired. Rowsafe looks after the databases you run on your own servers: backups you can restore to any second, a restore test every week, monitoring with one-click fixes, and a safety net for AI coding agents.

This repository is the open-source part of Rowsafe: the agent, the rowsafe CLI, the installer and the MCP server. Everything that touches your data is here, under Apache-2.0.

Docs: rowsafe.sh/docs

Databases, on Linux servers and in Docker:

PostgreSQL 13–18, MySQL 8.0/8.4, MariaDB 10.6–11.4, MongoDB 6.0–8.0, ClickHouse 24.8–26.8
Redis 7.0+ and Valkey 7.2+ (standalone servers)
SQLite (restore to any second needs WAL mode)
OpenSearch 2.x/3.x (single node; snapshots every 5 minutes: restores go back to a snapshot or a Mark, not to any second)
Qdrant 1.13+ (single servers; snapshots every 15 minutes, only of the collections that changed: restores go back to a snapshot or a Mark, not to any second)
Meilisearch 1.12+, Community Edition, on Linux servers (snapshots every 15 minutes when something changed: restores go back to a snapshot or a Mark, not to any second)

Features per database: protocol.EngineCapabilities.

Try it now

On your database server (Linux, or Docker):

curl -fsSL https://rowsafe.sh | sudo sh
sudo rowsafe status shop                  # protected? backups, the change log, the last restore test
sudo rowsafe mark shop before-migration   # a restore point (a Mark)
sudo rowsafe restore shop --to "10m ago"  # a copy as it was then, next to production; rewind rows brings rows back
sudo rowsafe channels add --type slack --name ops --url https://hooks.slack.com/...   # alerts, and the weekly Pulse
sudo rowsafe upgrade shop --to 18         # a new PostgreSQL major: a test on a copy, a Mark, then the upgrade (undo for 7 days)

Every engine above, with nothing sent to Rowsafe: continuous backups to your own bucket (encrypted on the server, with a passphrase only you have), Marks, a weekly restore test, restore to any second (or rewind the whole database, with undo), a second copy, alerts, Pulse with history, logs, security fixes, file backups, standbys and Prometheus metrics. From your laptop or an AI agent, over SSH: rowsafe add shop ssh://root@db1. All of it: Rowsafe on your server.

From anywhere, on a database you can connect to (managed ones too):

curl -fsSL https://rowsafe.sh/cli | sh
rowsafe add shop postgres://user@host:5432/dbname   # once: checks it connects, saves it on this computer
rowsafe pulse shop                                  # a 0–100 health score and what to fix
rowsafe fix shop                                    # apply a fix, after you confirm
rowsafe insights | top | activity | settings | tune shop
rowsafe schema shop [TABLE…]                        # tables, columns, keys, indexes (used or not): compact for an AI agent
rowsafe explain shop "SELECT …"                     # why a query is slow, and the index that would likely help
rowsafe preview shop 0042.sql                       # check a migration first: locks, rewrites, a verdict
rowsafe mcp shop --allow-writes                     # the same as MCP tools for Claude Code, Codex or Cursor
rowsafe use shop                                    # in a project: then just `rowsafe pulse`

Pulse checks cleanup falling behind, bloat, duplicate and unused indexes, stuck sessions, locks, connections, replication slots, transaction ID wraparound and settings. The connection string stays in your config folder, readable only by you; rowsafe pulse postgres://… works once without saving, and rowsafe use shop makes it a project's database. Through a pooler, everything works but the fixes that run inside the database. Nothing is sent to Rowsafe. rowsafe help local has the rest; the demo above is a real recording.

MySQL and MariaDB work the same way (rowsafe add shop mysql://user@host:3306/dbname), and so do MongoDB (mongodb://), Redis and Valkey (redis://). MySQL and MariaDB: stuck sessions and locks, long transactions, InnoDB's old row versions, the buffer pool, free space inside tables, unused and duplicate indexes, tables without a primary key and the slow query log, with fixes to end a session, drop an index, turn on the slow log and rebuild a table. Not yet: schema, explain, preview, replication checks, and MariaDB settings changes (they live in its configuration file).

On Windows, download rowsafe-windows-amd64.exe (or -arm64.exe) from the latest release; the commands from anywhere work there, fixes included, except MySQL for now.

Link it to the dashboard

The dashboard adds every server and database in one place, alerts from outside when a server is down, email, charts, teams and Rowsafe Storage. Free for one server.

sudo rowsafe login                    # on a server set up above: keeps its backups, Marks and restore tests
rowsafe login                         # on your computer
rowsafe hosts add root@203.0.113.10   # then add more servers: installs the agent over SSH

Or install on a new server already linked: curl -fsSL https://rowsafe.sh | sudo sh -s -- --account.

Rewind: continuous backups, restore to any second.

rowsafe mark before-drop                  # a named restore point (a Mark)
rowsafe rewind copy app --at "14:04"      # a copy as of 14:04, next to production
rowsafe rewind compare app                # rows missing or changed in production
rowsafe rewind rows app public.orders     # bring the missing rows back
rowsafe rewind database app --at "14:04"  # rewind in place, with undo

Proof: a weekly automatic restore test (rowsafe proof app).

Pulse: a 0–100 health score with fixes you apply (rowsafe pulse, rowsafe fix app), slow queries (rowsafe top app), insights and tuning.

Guard: rowsafe mcp, the Claude Code and Codex plugins and the GitHub Action save a Mark before migrations, destructive SQL and deploys. AI agents act as the person who connected them, right away, with exactly that person's rights, like a CLI token; what that person can't do, Rowsafe refuses and says why. Owners can set a monthly budget for agents (Settings → AI agents). Every agent action is in the audit log.

Rowsafe Cloud: PostgreSQL servers Rowsafe runs for you, billed by the hour (never more than the monthly price), with all of the above on from the first minute.

rowsafe cloud sizes                         # clouds, regions, sizes, prices, what is sold out
rowsafe cloud create shop-db --wait         # the cheapest size free now; only this computer may connect
rowsafe env --on shop-db                    # the app's database and login, DATABASE_URL in .env
rowsafe connect shop-db                     # psql, as a temporary user removed when you quit
rowsafe cloud allow shop-db 203.0.113.4     # let the app's server connect
rowsafe cloud resize shop-db medium         # a Mark first; asks before the restart
rowsafe cloud clone shop-db shop-test --at "10m ago" --delete-after 1d
rowsafe cloud passphrase shop-db --file shop-db-passphrase.txt
rowsafe cloud delete shop-db                # asks you to type the name

The first server billed by the hour gives you a link to add a card, once. Database passwords never pass through Rowsafe: rowsafe env makes the password on your computer and sends only its SCRAM verifier, and other passwords are made on the database server and encrypted for your terminal. rowsafe help cloud has the details.

The CLI does what the dashboard does, as the person behind the key and with that person's rights: security (rowsafe security fix app restrict_access --allow 10.0.0.0/16), the server's security updates and reboots, alert rules, logs and log forwarding, the maintenance window, standbys, moves, upgrades and more. Every change asks first on a terminal; scripts and AI agents pass --yes, and --json prints JSON. rowsafe help all lists everything.

Full guide: Quickstart.

What's in this repository

Path	What it is
`cmd/rowsafe-agent`, `internal/agent`	The agent: outbound HTTPS only, a fixed set of tasks, no arbitrary commands or SQL.
`cmd/rowsafe`, `client`	The CLI.
`mcp`, `integrations/`	Guard: the MCP server, Claude Code and Codex plugins, and the GitHub Action (`rowsafe/action`).
`collect`, `tune`	Monitoring, and settings recommendations.
`pulse`, `local`	The health score and its fixes, and Rowsafe on a connection string (`rowsafe pulse postgres://…`).
`protocol`	API types shared by the agent, the CLI and the control plane.
`internal/pgbackrest`, `internal/pginspect`	PostgreSQL.
`internal/engine`	MySQL/MariaDB, MongoDB, ClickHouse, Redis/Valkey, SQLite, Qdrant, Meilisearch.
`scripts/install.sh`	The installer served at `https://rowsafe.sh`.
`scripts/cli.sh`	The CLI installer served at `https://rowsafe.sh/cli` (macOS and Linux).
`integrations/npm`	The `rowsafe` npm package: downloads the release's CLI for the platform (checked against `SHA256SUMS`) on first run.
`release`, `cmd/rowsafe-release`	Release signing and verification.

Safety

Never restarts or changes production on its own. Restarts, fixes, rewinds and settings changes run only when a person confirms them, or when an AI agent they connected asks with their rights (audited; Rowsafe saves a Mark first for risky ones).
Fixes come from a fixed list and are re-checked on the server right before they run.
Restore tests and copies are isolated from production and its backups.
Your data and secrets stay on your server. Backups are encrypted before upload; Rowsafe sees table names and counts, not rows.
Signed, reproducible releases with automatic rollback. See verifying releases.
Monitoring is read-only. ROWSAFE_COLLECT_QUERY_TEXT=false keeps query text on your server; ROWSAFE_MONITORING=false turns it off.
No usage tracking unless you turn it on. The CLI sends nothing about how you use it by default. rowsafe telemetry on sends, after each command, its name (cloud create, never its arguments), the CLI version, OS, exit code, a duration range, whether a terminal or an AI agent ran it, whether you're logged in, and a random ID made on this computer. rowsafe telemetry status shows exactly what goes out; rowsafe telemetry off, ROWSAFE_TELEMETRY=0 or DO_NOT_TRACK=1 stop it. The schema is protocol/telemetry.go.

Build

make build. Locally built agents never auto-update.

Contributing and security

CONTRIBUTING.md · docs in rowsafe/docs · report vulnerabilities through security advisories (SECURITY.md).

License

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
client Package client is a Go client for the Rowsafe user API.	Package client is a Go client for the Rowsafe user API.
cmd
rowsafe command Command rowsafe is the Rowsafe CLI.	Command rowsafe is the Rowsafe CLI.
rowsafe-agent command Command rowsafe-agent runs on each database host as the postgres user.	Command rowsafe-agent runs on each database host as the postgres user.
rowsafe-docker-control command Command rowsafe-docker-control lets the Rowsafe agent (a Docker sidecar) stop, start and restart exactly one container, the PostgreSQL container next to it, and, if its operator allows it, replace the agent's own container with the signed image of a newer release (or only that: ROWSAFE_CONTROL_UPDATE_ONLY=1), without ever giving the agent the Docker socket.	Command rowsafe-docker-control lets the Rowsafe agent (a Docker sidecar) stop, start and restart exactly one container, the PostgreSQL container next to it, and, if its operator allows it, replace the agent's own container with the signed image of a newer release (or only that: ROWSAFE_CONTROL_UPDATE_ONLY=1), without ever giving the agent the Docker socket.
rowsafe-release command Command rowsafe-release builds, signs and verifies agent release manifests.	Command rowsafe-release builds, signs and verifies agent release manifests.
collect Package collect gathers PostgreSQL and host metrics on the database host for Rowsafe's built-in monitoring.	Package collect gathers PostgreSQL and host metrics on the database host for Rowsafe's built-in monitoring.
integrations
github-action/test/mockapi command Command mockapi is a stand-in for the Rowsafe API, just enough for the GitHub Action's tests (rowsafe show, status, mark, marks).	Command mockapi is a stand-in for the Rowsafe API, just enough for the GitHub Action's tests (rowsafe show, status, mark, marks).
internal
agent Package agent runs on each database host.	Package agent runs on each database host.
chproxyroot Package chproxyroot is the root side of connection pooling for ClickHouse: root's copy of the agent (rowsafe-permissions chproxy-apply, started by rowsafe-chproxy-apply.path) installs chproxy and runs it in front of a ClickHouse HTTP port root allowed (/etc/rowsafe/pooler-allowed, `rowsafe-allow pooler`), the way the ProxySQL helper does for MySQL.	Package chproxyroot is the root side of connection pooling for ClickHouse: root's copy of the agent (rowsafe-permissions chproxy-apply, started by rowsafe-chproxy-apply.path) installs chproxy and runs it in front of a ClickHouse HTTP port root allowed (/etc/rowsafe/pooler-allowed, `rowsafe-allow pooler`), the way the ProxySQL helper does for MySQL.
dockerctl Package dockerctl is Rowsafe's container control for Docker: a tiny service (cmd/rowsafe-docker-control) that holds the Docker socket and stops, starts, restarts or inspects exactly one container, the PostgreSQL container next to it, when the Rowsafe agent asks over a Unix socket on a volume only the two of them share; and, only if its operator allows it (ROWSAFE_CONTROL_ALLOW_AGENT_UPDATE=1), replaces the agent's own container with the signed image of a newer release.	Package dockerctl is Rowsafe's container control for Docker: a tiny service (cmd/rowsafe-docker-control) that holds the Docker socket and stops, starts, restarts or inspects exactly one container, the PostgreSQL container next to it, when the Rowsafe agent asks over a Unix socket on a volume only the two of them share; and, only if its operator allows it (ROWSAFE_CONTROL_ALLOW_AGENT_UPDATE=1), replaces the agent's own container with the signed image of a newer release.
engine/clickhouse Package clickhouse is Rowsafe's ClickHouse engine: backups (ClickHouse's own BACKUP, full and differential, through an encrypting gateway inside the agent, into the customer's bucket), Proof (restore tests in a temporary server), Rewind (a copy at a backup or a Mark, compare, bring rows back), Marks, monitoring (Pulse) with two fixes (stop a query, cancel a stuck mutation) and discovery for the installer; restores to any second from the parts it copies as they appear (pitr_*.go).	Package clickhouse is Rowsafe's ClickHouse engine: backups (ClickHouse's own BACKUP, full and differential, through an encrypting gateway inside the agent, into the customer's bucket), Proof (restore tests in a temporary server), Rewind (a copy at a backup or a Mark, compare, bring rows back), Marks, monitoring (Pulse) with two fixes (stop a query, cancel a stuck mutation) and discovery for the installer; restores to any second from the parts it copies as they appear (pitr_*.go).
engine/meilisearch Package meilisearch is Rowsafe's Meilisearch engine (Community Edition): Meilisearch's own snapshots, encrypted on the server into the customer's bucket every hour; Proof; Rewind (a copy from a snapshot, compare and bring documents back, rewind in place through an atomic swap of indexes, with Undo); Marks; Pulse with fixes; Databases & users (indexes and API keys); certificates for Rowsafe Cloud names through Rowsafe's TLS front (tlsfront.go); restarts through root's helper.	Package meilisearch is Rowsafe's Meilisearch engine (Community Edition): Meilisearch's own snapshots, encrypted on the server into the customer's bucket every hour; Proof; Rewind (a copy from a snapshot, compare and bring documents back, rewind in place through an atomic swap of indexes, with Undo); Marks; Pulse with fixes; Databases & users (indexes and API keys); certificates for Rowsafe Cloud names through Rowsafe's TLS front (tlsfront.go); restarts through root's helper.
engine/mongodb Package mongodb is Rowsafe's MongoDB engine: backups (mongodump) and continuous oplog copying into the customer's bucket, encrypted on the server; Proof (restore tests), Rewind (a copy at any second, compare, bring documents back), Marks, monitoring (Pulse) and discovery for the installer.	Package mongodb is Rowsafe's MongoDB engine: backups (mongodump) and continuous oplog copying into the customer's bucket, encrypted on the server; Proof (restore tests), Rewind (a copy at any second, compare, bring documents back), Marks, monitoring (Pulse) and discovery for the installer.
engine/mysql Package mysql is the agent's MySQL and MariaDB engine: backups with Percona XtraBackup (MySQL) or mariadb-backup (MariaDB), streamed, compressed and encrypted on this server into the customer's bucket; continuous shipping of the binary logs for restores to any second; restore tests (Proof), copies to compare and bring rows back (Rewind), named points (Marks), monitoring (Pulse) and safe fixes.	Package mysql is the agent's MySQL and MariaDB engine: backups with Percona XtraBackup (MySQL) or mariadb-backup (MariaDB), streamed, compressed and encrypted on this server into the customer's bucket; continuous shipping of the binary logs for restores to any second; restore tests (Proof), copies to compare and bring rows back (Rewind), named points (Marks), monitoring (Pulse) and safe fixes.
engine/opensearch Package opensearch is Rowsafe's OpenSearch engine: OpenSearch's own snapshots into a repository on the server's disk, copied to the customer's bucket encrypted on the server; Proof (restore tests in a temporary OpenSearch), Rewind (a copy at a snapshot, compare, bring documents back, rewind in place with Undo), Marks (snapshots on the spot), Pulse with fixes, Databases & users (the security plugin's users and roles), certificates for Rowsafe Cloud names, restarts and discovery for the installer.	Package opensearch is Rowsafe's OpenSearch engine: OpenSearch's own snapshots into a repository on the server's disk, copied to the customer's bucket encrypted on the server; Proof (restore tests in a temporary OpenSearch), Rewind (a copy at a snapshot, compare, bring documents back, rewind in place with Undo), Marks (snapshots on the spot), Pulse with fixes, Databases & users (the security plugin's users and roles), certificates for Rowsafe Cloud names, restarts and discovery for the installer.
engine/qdrant Package qdrant is Rowsafe's Qdrant engine: Qdrant's own snapshots of each collection that changed, taken over its API and encrypted on the server into the customer's bucket; Proof and Rewind (a copy, rewind in place with Undo) on a private temporary Qdrant; Marks; Pulse with fixes; the security check; API keys in Databases & users; certificates for Rowsafe Cloud names; restarts and discovery for the installer (protocol/qdrant.go).	Package qdrant is Rowsafe's Qdrant engine: Qdrant's own snapshots of each collection that changed, taken over its API and encrypted on the server into the customer's bucket; Proof and Rewind (a copy, rewind in place with Undo) on a private temporary Qdrant; Marks; Pulse with fixes; the security check; API keys in Databases & users; certificates for Rowsafe Cloud names; restarts and discovery for the installer (protocol/qdrant.go).
engine/redis Package redis is Rowsafe's Redis and Valkey engine: snapshots taken over the replication handshake and the replication stream followed by a hidden replica, both encrypted on the server into the customer's bucket; Proof, Rewind (a copy at any second, compare, bring keys back, rewind in place with Undo), Marks, Pulse with fixes, restarts and discovery for the installer.	Package redis is Rowsafe's Redis and Valkey engine: snapshots taken over the replication handshake and the replication stream followed by a hidden replica, both encrypted on the server into the customer's bucket; Proof, Rewind (a copy at any second, compare, bring keys back, rewind in place with Undo), Marks, Pulse with fixes, restarts and discovery for the installer.
engine/sqlite Package sqlite is Rowsafe's SQLite engine.	Package sqlite is Rowsafe's SQLite engine.
handoff Package handoff seals secrets from one Rowsafe agent to another, so the control plane that relays them never sees them in the clear.	Package handoff seals secrets from one Rowsafe agent to another, so the control plane that relays them never sees them in the clear.
indexadvisor Package indexadvisor finds indexes that would make a database's slowest statements faster.	Package indexadvisor finds indexes that would make a database's slowest statements faster.
indexadvisor/sqlshape Package sqlshape extracts what a statement asks of its tables (indexadvisor.Shape) with PostgreSQL's own parser: libpg_query compiled to WebAssembly and run by wazero (github.com/wasilibs/go-pgquery), so the agent stays a pure Go, CGO-free binary.	Package sqlshape extracts what a statement asks of its tables (indexadvisor.Shape) with PostgreSQL's own parser: libpg_query compiled to WebAssembly and run by wazero (github.com/wasilibs/go-pgquery), so the agent stays a pure Go, CGO-free binary.
localcp Package localcp is the control plane of a server without an account: it runs inside the agent (rowsafe-agent with ROWSAFE_URL=unix://PATH) and serves, on that Unix socket, the agent API the agent already speaks and the part of the user API the rowsafe CLI needs on the server.	Package localcp is the control plane of a server without an account: it runs inside the agent (rowsafe-agent with ROWSAFE_URL=unix://PATH) and serves, on that Unix socket, the agent API the agent already speaks and the part of the user API the rowsafe CLI needs on the server.
maintenance Package maintenance runs Pulse fixes (maintenance actions) and settings changes on a PostgreSQL: plain SQL, so it builds wherever the CLI does (Windows too).	Package maintenance runs Pulse fixes (maintenance actions) and settings changes on a PostgreSQL: plain SQL, so it builds wherever the CLI does (Windows too).
objstore Package objstore is a small S3 client (AWS Signature Version 4, path or virtual-host style, multipart uploads) for engines whose backups Rowsafe writes itself rather than through pgBackRest.	Package objstore is a small S3 client (AWS Signature Version 4, path or virtual-host style, multipart uploads) for engines whose backups Rowsafe writes itself rather than through pgBackRest.
objstore/fakes3 Package fakes3 is an in-memory S3 server for tests: PUT, GET (with a Range), HEAD, DELETE, ListObjectsV2 and multipart uploads, path-style, without signature checks (it only requires an Authorization header).	Package fakes3 is an in-memory S3 server for tests: PUT, GET (with a Range), HEAD, DELETE, ListObjectsV2 and multipart uploads, path-style, without signature checks (it only requires an Authorization header).
objstore/s3gw Package s3gw is the encrypting S3 gateway behind ClickHouse backups.	Package s3gw is the encrypting S3 gateway behind ClickHouse backups.
permissions Package permissions verifies one-click permission changes on the server itself: WebAuthn (passkey) signatures made in the Rowsafe dashboard, checked against the keys root paired at the terminal, with no network and no trust in the control plane that relays them (protocol/permissions.go).	Package permissions verifies one-click permission changes on the server itself: WebAuthn (passkey) signatures made in the Rowsafe dashboard, checked against the keys root paired at the terminal, with no network and no trust in the control plane that relays them (protocol/permissions.go).
pgbackrest Package pgbackrest renders pgBackRest configuration and wraps its CLI.	Package pgbackrest renders pgBackRest configuration and wraps its CLI.
pgbouncer Package pgbouncer talks to PgBouncer's admin console (the virtual "pgbouncer" database): SHOW commands for monitoring, and PAUSE, RELOAD and RESUME to switch servers without failing clients.	Package pgbouncer talks to PgBouncer's admin console (the virtual "pgbouncer" database): SHOW commands for monitoring, and PAUSE, RELOAD and RESUME to switch servers without failing clients.
pginspect Package pginspect reads state from a local Postgres over its Unix socket.	Package pginspect reads state from a local Postgres over its Unix socket.
pgscratch Package pgscratch starts a throwaway PostgreSQL cluster for integration tests (initdb and pg_ctl from PATH).	Package pgscratch starts a throwaway PostgreSQL cluster for integration tests (initdb and pg_ctl from PATH).
proxysqlroot Package proxysqlroot is the root side of connection pooling for MySQL and MariaDB: root's copy of the agent (rowsafe-permissions proxysql-apply, started by rowsafe-proxysql.path) installs and configures ProxySQL in front of a MySQL or MariaDB port root allowed (/etc/rowsafe/ pooler-allowed, `rowsafe-allow pooler`), the way the PgBouncer helper does for PostgreSQL.	Package proxysqlroot is the root side of connection pooling for MySQL and MariaDB: root's copy of the agent (rowsafe-permissions proxysql-apply, started by rowsafe-proxysql.path) installs and configures ProxySQL in front of a MySQL or MariaDB port root allowed (/etc/rowsafe/ pooler-allowed, `rowsafe-allow pooler`), the way the PgBouncer helper does for PostgreSQL.
sqliteroot Package sqliteroot removes other users' access to SQLite files: the security check's one fix for SQLite (protocol.SecSQLiteModes).	Package sqliteroot removes other users' access to SQLite files: the security check's one fix for SQLite (protocol.SecSQLiteModes).
tuneroot Package tuneroot is the root side of Tuning for MongoDB, ClickHouse, Redis and Valkey: root's copy of the agent (rowsafe-permissions tuning-apply, started by rowsafe-tuning.path) writes the settings a person changed into files of Rowsafe's own, and nowhere else, only where root allowed it at install (/etc/rowsafe/tuning-allowed, `rowsafe-allow tuning`):	Package tuneroot is the root side of Tuning for MongoDB, ClickHouse, Redis and Valkey: root's copy of the agent (rowsafe-permissions tuning-apply, started by rowsafe-tuning.path) writes the settings a person changed into files of Rowsafe's own, and nowhere else, only where root allowed it at install (/etc/rowsafe/tuning-allowed, `rowsafe-allow tuning`):
local Package local is Rowsafe on a database it reaches directly, with a connection string: no agent, no account, no control plane.	Package local is Rowsafe on a database it reaches directly, with a connection string: no agent, no account, no control plane.
masking Package masking turns real values into realistic fake ones for Guard's safe copies.	Package masking turns real values into realistic fake ones for Guard's safe copies.
mcp Package mcp exposes a Rowsafe organization to AI assistants over the Model Context Protocol.	Package mcp exposes a Rowsafe organization to AI assistants over the Model Context Protocol.
pglog Package pglog reads PostgreSQL's server log: it parses the stderr (log_line_prefix), csvlog and jsonlog formats, classifies each message, removes literal values before anything leaves the server, and tails log files and journald for the agent (Run).	Package pglog reads PostgreSQL's server log: it parses the stderr (log_line_prefix), csvlog and jsonlog formats, classifies each message, removes literal values before anything leaves the server, and tails log files and journald for the agent (Run).
pgprobe Package pgprobe looks at a PostgreSQL port the way a stranger would: it connects, asks for TLS, and starts a login with a made-up user name ("rowsafe_outside_check") to see how far PostgreSQL lets it get.	Package pgprobe looks at a PostgreSQL port the way a stranger would: it connects, asks for TLS, and starts a login with a made-up user name ("rowsafe_outside_check") to see how far PostgreSQL lets it get.
preview Package preview is Guard's migration preview logic that doesn't need a database: splitting SQL into statements, recognising risky DDL, and turning what a migration did on a copy into a verdict with plain-words impact and suggestions.	Package preview is Guard's migration preview logic that doesn't need a database: splitting SQL into statements, recognising risky DDL, and turning what a migration did on a copy into a verdict with plain-words impact and suggestions.
protocol Package protocol defines the JSON contract between the Rowsafe control plane (rowsafed), the agent (rowsafe-agent) and the CLI (rowsafe).	Package protocol defines the JSON contract between the Rowsafe control plane (rowsafed), the agent (rowsafe-agent) and the CLI (rowsafe).
e2e Package e2e seals small secrets end to end between a person's browser (or the rowsafe CLI) and a Rowsafe agent, so the control plane that relays them only ever sees ciphertext.	Package e2e seals small secrets end to end between a person's browser (or the rowsafe CLI) and a Rowsafe agent, so the control plane that relays them only ever sees ciphertext.
pulse Package pulse turns one reading of a PostgreSQL, MySQL, MariaDB, MongoDB, Redis or Valkey database into a health score from 0 to 100 and a short list of findings in plain language, each with the fixes Rowsafe can apply.	Package pulse turns one reading of a PostgreSQL, MySQL, MariaDB, MongoDB, Redis or Valkey database into a health score from 0 to 100 and a short list of findings in plain language, each with the fixes Rowsafe can apply.
release Package release signs and verifies agent release manifests.	Package release signs and verifies agent release manifests.
agentimages Package agentimages is the signed list of a release's Docker agent images: for each image variant ("pg17", "pg17-alpine", "clickhouse26.8"), the digest of ghcr.io/rowsafe/agent built for that release.	Package agentimages is the signed list of a release's Docker agent images: for each image variant ("pg17", "pg17-alpine", "clickhouse26.8"), the digest of ghcr.io/rowsafe/agent built for that release.
tune Package tune knows the PostgreSQL settings that matter: what each one does in plain words, which ones Rowsafe never changes, the values that suit a server (recommendations in the spirit of PGTune) and the values that must be refused because PostgreSQL might not start with them.	Package tune knows the PostgreSQL settings that matter: what each one does in plain words, which ones Rowsafe never changes, the values that suit a server (recommendations in the spirit of PGTune) and the values that must be refused because PostgreSQL might not start with them.