rowsafe

module

v0.10.10 Latest Latest Go to latest Published: Oct 11, 2026 License: Apache-2.0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/rowsafe/rowsafe

Links

Open Source Insights

README ¶

Rowsafe

The database admin you never hired. Rowsafe looks after the databases you run on your own servers: backups you can restore to any second, a restore test every week, monitoring with one-click fixes, and a safety net for AI coding agents.

This repository is the open-source part of Rowsafe: the agent, the rowsafe CLI, the installer and the MCP server. Everything that touches your data is here, under Apache-2.0.

Docs: rowsafe.sh/docs

Databases, on Linux servers and in Docker:

PostgreSQL 13–18, MySQL 8.0/8.4, MariaDB 10.6–11.4, MongoDB 6.0–8.0, ClickHouse 24.8–26.8
Redis 7.0+ and Valkey 7.2+ (standalone servers)
SQLite (restore to any second needs WAL mode)
OpenSearch 2.x/3.x (single node; snapshots every 5 minutes: restores go back to a snapshot or a Mark, not to any second)
Qdrant 1.13+ (single servers; snapshots every 15 minutes, only of the collections that changed: restores go back to a snapshot or a Mark, not to any second)
Meilisearch 1.12+, Community Edition, on Linux servers (snapshots every 15 minutes when something changed: restores go back to a snapshot or a Mark, not to any second)

Features per database: protocol.EngineCapabilities.

Get started

rowsafe login
rowsafe hosts enroll-token                       # prints the install command
curl -fsSL https://rowsafe.sh | sudo sh -s rse_… # on the database server

Rewind: continuous backups, restore to any second.

rowsafe mark before-drop                  # a named restore point (a Mark)
rowsafe rewind copy app --at "14:04"      # a copy as of 14:04, next to production
rowsafe rewind compare app                # rows missing or changed in production
rowsafe rewind rows app public.orders     # bring the missing rows back
rowsafe rewind database app --at "14:04"  # rewind in place, with undo

Proof: a weekly automatic restore test (rowsafe proof app).

Pulse: a 0–100 health score with fixes you apply (rowsafe pulse, rowsafe fix app), slow queries (rowsafe top app), insights and tuning.

Guard: rowsafe mcp, the Claude Code and Codex plugins and the GitHub Action save a Mark before migrations, destructive SQL and deploys. AI agents act as the person who connected them, right away, with exactly that person's rights, like a CLI token; what that person can't do, Rowsafe refuses and says why. Owners can set a monthly budget for agents (Settings → AI agents). Every agent action is in the audit log.

Rowsafe Cloud: PostgreSQL servers Rowsafe runs for you, billed by the hour (never more than the monthly price), with all of the above on from the first minute.

rowsafe cloud sizes                         # clouds, regions, sizes, prices, what is sold out
rowsafe cloud create shop-db --wait         # the cheapest size free now; only this computer may connect
rowsafe env --on shop-db                    # the app's database and login, DATABASE_URL in .env
rowsafe connect shop-db                     # psql, as a temporary user removed when you quit
rowsafe cloud allow shop-db 203.0.113.4     # let the app's server connect
rowsafe cloud resize shop-db medium         # a Mark first; asks before the restart
rowsafe cloud clone shop-db shop-test --at "10m ago" --delete-after 1d
rowsafe cloud passphrase shop-db --file shop-db-passphrase.txt
rowsafe cloud delete shop-db                # asks you to type the name

The first server billed by the hour gives you a link to add a card, once. Database passwords never pass through Rowsafe: rowsafe env makes the password on your computer and sends only its SCRAM verifier, and other passwords are made on the database server and encrypted for your terminal. rowsafe help cloud has the details.

The CLI does what the dashboard does, as the person behind the key and with that person's rights: security (rowsafe security fix app restrict_access --allow 10.0.0.0/16), the server's security updates and reboots, alert rules, logs and log forwarding, the maintenance window, standbys, moves, upgrades and more. Every change asks first on a terminal; scripts and AI agents pass --yes, and --json prints JSON. rowsafe help all lists everything.

Full guide: Quickstart.

What's in this repository

Path	What it is
`cmd/rowsafe-agent`, `internal/agent`	The agent: outbound HTTPS only, a fixed set of tasks, no arbitrary commands or SQL.
`cmd/rowsafe`, `client`	The CLI.
`mcp`, `integrations/`	Guard: the MCP server, Claude Code and Codex plugins, and the GitHub Action (`rowsafe/action`).
`collect`, `tune`	Monitoring, and settings recommendations.
`protocol`	API types shared by the agent, the CLI and the control plane.
`internal/pgbackrest`, `internal/pginspect`	PostgreSQL.
`internal/engine`	MySQL/MariaDB, MongoDB, ClickHouse, Redis/Valkey, SQLite, Qdrant, Meilisearch.
`scripts/install.sh`	The installer served at `https://rowsafe.sh`.
`release`, `cmd/rowsafe-release`	Release signing and verification.

Safety

Never restarts or changes production on its own. Restarts, fixes, rewinds and settings changes run only when a person confirms them, or when an AI agent they connected asks with their rights (audited; Rowsafe saves a Mark first for risky ones).
Fixes come from a fixed list and are re-checked on the server right before they run.
Restore tests and copies are isolated from production and its backups.
Your data and secrets stay on your server. Backups are encrypted before upload; Rowsafe sees table names and counts, not rows.
Signed, reproducible releases with automatic rollback. See verifying releases.
Monitoring is read-only. ROWSAFE_COLLECT_QUERY_TEXT=false keeps query text on your server; ROWSAFE_MONITORING=false turns it off.

Build

make build. Locally built agents never auto-update.

Contributing and security

CONTRIBUTING.md · docs in rowsafe/docs · report vulnerabilities through security advisories (SECURITY.md).

License

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
client Package client is a Go client for the Rowsafe user API.	Package client is a Go client for the Rowsafe user API.
cmd
rowsafe command Command rowsafe is the Rowsafe CLI.	Command rowsafe is the Rowsafe CLI.
rowsafe-agent command Command rowsafe-agent runs on each database host as the postgres user.	Command rowsafe-agent runs on each database host as the postgres user.
rowsafe-docker-control command Command rowsafe-docker-control lets the Rowsafe agent (a Docker sidecar) stop, start and restart exactly one container, the PostgreSQL container next to it, and, if its operator allows it, replace the agent's own container with the signed image of a newer release (or only that: ROWSAFE_CONTROL_UPDATE_ONLY=1), without ever giving the agent the Docker socket.	Command rowsafe-docker-control lets the Rowsafe agent (a Docker sidecar) stop, start and restart exactly one container, the PostgreSQL container next to it, and, if its operator allows it, replace the agent's own container with the signed image of a newer release (or only that: ROWSAFE_CONTROL_UPDATE_ONLY=1), without ever giving the agent the Docker socket.
rowsafe-release command Command rowsafe-release builds, signs and verifies agent release manifests.	Command rowsafe-release builds, signs and verifies agent release manifests.
collect Package collect gathers PostgreSQL and host metrics on the database host for Rowsafe's built-in monitoring.	Package collect gathers PostgreSQL and host metrics on the database host for Rowsafe's built-in monitoring.
integrations
github-action/test/mockapi command Command mockapi is a stand-in for the Rowsafe API, just enough for the GitHub Action's tests (rowsafe show, status, mark, marks).	Command mockapi is a stand-in for the Rowsafe API, just enough for the GitHub Action's tests (rowsafe show, status, mark, marks).
internal
agent Package agent runs on each database host.	Package agent runs on each database host.
chproxyroot Package chproxyroot is the root side of connection pooling for ClickHouse: root's copy of the agent (rowsafe-permissions chproxy-apply, started by rowsafe-chproxy-apply.path) installs chproxy and runs it in front of a ClickHouse HTTP port root allowed (/etc/rowsafe/pooler-allowed, `rowsafe-allow pooler`), the way the ProxySQL helper does for MySQL.	Package chproxyroot is the root side of connection pooling for ClickHouse: root's copy of the agent (rowsafe-permissions chproxy-apply, started by rowsafe-chproxy-apply.path) installs chproxy and runs it in front of a ClickHouse HTTP port root allowed (/etc/rowsafe/pooler-allowed, `rowsafe-allow pooler`), the way the ProxySQL helper does for MySQL.
dockerctl Package dockerctl is Rowsafe's container control for Docker: a tiny service (cmd/rowsafe-docker-control) that holds the Docker socket and stops, starts, restarts or inspects exactly one container, the PostgreSQL container next to it, when the Rowsafe agent asks over a Unix socket on a volume only the two of them share; and, only if its operator allows it (ROWSAFE_CONTROL_ALLOW_AGENT_UPDATE=1), replaces the agent's own container with the signed image of a newer release.	Package dockerctl is Rowsafe's container control for Docker: a tiny service (cmd/rowsafe-docker-control) that holds the Docker socket and stops, starts, restarts or inspects exactly one container, the PostgreSQL container next to it, when the Rowsafe agent asks over a Unix socket on a volume only the two of them share; and, only if its operator allows it (ROWSAFE_CONTROL_ALLOW_AGENT_UPDATE=1), replaces the agent's own container with the signed image of a newer release.
engine/clickhouse Package clickhouse is Rowsafe's ClickHouse engine: backups (ClickHouse's own BACKUP, full and differential, through an encrypting gateway inside the agent, into the customer's bucket), Proof (restore tests in a temporary server), Rewind (a copy at a backup or a Mark, compare, bring rows back), Marks, monitoring (Pulse) with two fixes (stop a query, cancel a stuck mutation) and discovery for the installer; restores to any second from the parts it copies as they appear (pitr_*.go).	Package clickhouse is Rowsafe's ClickHouse engine: backups (ClickHouse's own BACKUP, full and differential, through an encrypting gateway inside the agent, into the customer's bucket), Proof (restore tests in a temporary server), Rewind (a copy at a backup or a Mark, compare, bring rows back), Marks, monitoring (Pulse) with two fixes (stop a query, cancel a stuck mutation) and discovery for the installer; restores to any second from the parts it copies as they appear (pitr_*.go).
engine/meilisearch Package meilisearch is Rowsafe's Meilisearch engine (Community Edition): Meilisearch's own snapshots, encrypted on the server into the customer's bucket every hour; Proof; Rewind (a copy from a snapshot, compare and bring documents back, rewind in place through an atomic swap of indexes, with Undo); Marks; Pulse with fixes; Databases & users (indexes and API keys); certificates for Rowsafe Cloud names through Rowsafe's TLS front (tlsfront.go); restarts through root's helper.	Package meilisearch is Rowsafe's Meilisearch engine (Community Edition): Meilisearch's own snapshots, encrypted on the server into the customer's bucket every hour; Proof; Rewind (a copy from a snapshot, compare and bring documents back, rewind in place through an atomic swap of indexes, with Undo); Marks; Pulse with fixes; Databases & users (indexes and API keys); certificates for Rowsafe Cloud names through Rowsafe's TLS front (tlsfront.go); restarts through root's helper.
engine/mongodb Package mongodb is Rowsafe's MongoDB engine: backups (mongodump) and continuous oplog copying into the customer's bucket, encrypted on the server; Proof (restore tests), Rewind (a copy at any second, compare, bring documents back), Marks, monitoring (Pulse) and discovery for the installer.	Package mongodb is Rowsafe's MongoDB engine: backups (mongodump) and continuous oplog copying into the customer's bucket, encrypted on the server; Proof (restore tests), Rewind (a copy at any second, compare, bring documents back), Marks, monitoring (Pulse) and discovery for the installer.
engine/mysql Package mysql is the agent's MySQL and MariaDB engine: backups with Percona XtraBackup (MySQL) or mariadb-backup (MariaDB), streamed, compressed and encrypted on this server into the customer's bucket; continuous shipping of the binary logs for restores to any second; restore tests (Proof), copies to compare and bring rows back (Rewind), named points (Marks), monitoring (Pulse) and safe fixes.	Package mysql is the agent's MySQL and MariaDB engine: backups with Percona XtraBackup (MySQL) or mariadb-backup (MariaDB), streamed, compressed and encrypted on this server into the customer's bucket; continuous shipping of the binary logs for restores to any second; restore tests (Proof), copies to compare and bring rows back (Rewind), named points (Marks), monitoring (Pulse) and safe fixes.
engine/opensearch Package opensearch is Rowsafe's OpenSearch engine: OpenSearch's own snapshots into a repository on the server's disk, copied to the customer's bucket encrypted on the server; Proof (restore tests in a temporary OpenSearch), Rewind (a copy at a snapshot, compare, bring documents back, rewind in place with Undo), Marks (snapshots on the spot), Pulse with fixes, Databases & users (the security plugin's users and roles), certificates for Rowsafe Cloud names, restarts and discovery for the installer.	Package opensearch is Rowsafe's OpenSearch engine: OpenSearch's own snapshots into a repository on the server's disk, copied to the customer's bucket encrypted on the server; Proof (restore tests in a temporary OpenSearch), Rewind (a copy at a snapshot, compare, bring documents back, rewind in place with Undo), Marks (snapshots on the spot), Pulse with fixes, Databases & users (the security plugin's users and roles), certificates for Rowsafe Cloud names, restarts and discovery for the installer.
engine/qdrant Package qdrant is Rowsafe's Qdrant engine: Qdrant's own snapshots of each collection that changed, taken over its API and encrypted on the server into the customer's bucket; Proof and Rewind (a copy, rewind in place with Undo) on a private temporary Qdrant; Marks; Pulse with fixes; the security check; API keys in Databases & users; certificates for Rowsafe Cloud names; restarts and discovery for the installer (protocol/qdrant.go).	Package qdrant is Rowsafe's Qdrant engine: Qdrant's own snapshots of each collection that changed, taken over its API and encrypted on the server into the customer's bucket; Proof and Rewind (a copy, rewind in place with Undo) on a private temporary Qdrant; Marks; Pulse with fixes; the security check; API keys in Databases & users; certificates for Rowsafe Cloud names; restarts and discovery for the installer (protocol/qdrant.go).
engine/redis Package redis is Rowsafe's Redis and Valkey engine: snapshots taken over the replication handshake and the replication stream followed by a hidden replica, both encrypted on the server into the customer's bucket; Proof, Rewind (a copy at any second, compare, bring keys back, rewind in place with Undo), Marks, Pulse with fixes, restarts and discovery for the installer.	Package redis is Rowsafe's Redis and Valkey engine: snapshots taken over the replication handshake and the replication stream followed by a hidden replica, both encrypted on the server into the customer's bucket; Proof, Rewind (a copy at any second, compare, bring keys back, rewind in place with Undo), Marks, Pulse with fixes, restarts and discovery for the installer.
engine/sqlite Package sqlite is Rowsafe's SQLite engine.	Package sqlite is Rowsafe's SQLite engine.
handoff Package handoff seals secrets from one Rowsafe agent to another, so the control plane that relays them never sees them in the clear.	Package handoff seals secrets from one Rowsafe agent to another, so the control plane that relays them never sees them in the clear.
indexadvisor Package indexadvisor finds indexes that would make a database's slowest statements faster.	Package indexadvisor finds indexes that would make a database's slowest statements faster.
indexadvisor/sqlshape Package sqlshape extracts what a statement asks of its tables (indexadvisor.Shape) with PostgreSQL's own parser: libpg_query compiled to WebAssembly and run by wazero (github.com/wasilibs/go-pgquery), so the agent stays a pure Go, CGO-free binary.	Package sqlshape extracts what a statement asks of its tables (indexadvisor.Shape) with PostgreSQL's own parser: libpg_query compiled to WebAssembly and run by wazero (github.com/wasilibs/go-pgquery), so the agent stays a pure Go, CGO-free binary.
objstore Package objstore is a small S3 client (AWS Signature Version 4, path or virtual-host style, multipart uploads) for engines whose backups Rowsafe writes itself rather than through pgBackRest.	Package objstore is a small S3 client (AWS Signature Version 4, path or virtual-host style, multipart uploads) for engines whose backups Rowsafe writes itself rather than through pgBackRest.
objstore/fakes3 Package fakes3 is an in-memory S3 server for tests: PUT, GET (with a Range), HEAD, DELETE, ListObjectsV2 and multipart uploads, path-style, without signature checks (it only requires an Authorization header).	Package fakes3 is an in-memory S3 server for tests: PUT, GET (with a Range), HEAD, DELETE, ListObjectsV2 and multipart uploads, path-style, without signature checks (it only requires an Authorization header).
objstore/s3gw Package s3gw is the encrypting S3 gateway behind ClickHouse backups.	Package s3gw is the encrypting S3 gateway behind ClickHouse backups.
permissions Package permissions verifies one-click permission changes on the server itself: WebAuthn (passkey) signatures made in the Rowsafe dashboard, checked against the keys root paired at the terminal, with no network and no trust in the control plane that relays them (protocol/permissions.go).	Package permissions verifies one-click permission changes on the server itself: WebAuthn (passkey) signatures made in the Rowsafe dashboard, checked against the keys root paired at the terminal, with no network and no trust in the control plane that relays them (protocol/permissions.go).
pgbackrest Package pgbackrest renders pgBackRest configuration and wraps its CLI.	Package pgbackrest renders pgBackRest configuration and wraps its CLI.
pgbouncer Package pgbouncer talks to PgBouncer's admin console (the virtual "pgbouncer" database): SHOW commands for monitoring, and PAUSE, RELOAD and RESUME to switch servers without failing clients.	Package pgbouncer talks to PgBouncer's admin console (the virtual "pgbouncer" database): SHOW commands for monitoring, and PAUSE, RELOAD and RESUME to switch servers without failing clients.
pginspect Package pginspect reads state from a local Postgres over its Unix socket.	Package pginspect reads state from a local Postgres over its Unix socket.
pgscratch Package pgscratch starts a throwaway PostgreSQL cluster for integration tests (initdb and pg_ctl from PATH).	Package pgscratch starts a throwaway PostgreSQL cluster for integration tests (initdb and pg_ctl from PATH).
proxysqlroot Package proxysqlroot is the root side of connection pooling for MySQL and MariaDB: root's copy of the agent (rowsafe-permissions proxysql-apply, started by rowsafe-proxysql.path) installs and configures ProxySQL in front of a MySQL or MariaDB port root allowed (/etc/rowsafe/ pooler-allowed, `rowsafe-allow pooler`), the way the PgBouncer helper does for PostgreSQL.	Package proxysqlroot is the root side of connection pooling for MySQL and MariaDB: root's copy of the agent (rowsafe-permissions proxysql-apply, started by rowsafe-proxysql.path) installs and configures ProxySQL in front of a MySQL or MariaDB port root allowed (/etc/rowsafe/ pooler-allowed, `rowsafe-allow pooler`), the way the PgBouncer helper does for PostgreSQL.
sqliteroot Package sqliteroot removes other users' access to SQLite files: the security check's one fix for SQLite (protocol.SecSQLiteModes).	Package sqliteroot removes other users' access to SQLite files: the security check's one fix for SQLite (protocol.SecSQLiteModes).
tuneroot Package tuneroot is the root side of Tuning for MongoDB, ClickHouse, Redis and Valkey: root's copy of the agent (rowsafe-permissions tuning-apply, started by rowsafe-tuning.path) writes the settings a person changed into files of Rowsafe's own, and nowhere else, only where root allowed it at install (/etc/rowsafe/tuning-allowed, `rowsafe-allow tuning`):	Package tuneroot is the root side of Tuning for MongoDB, ClickHouse, Redis and Valkey: root's copy of the agent (rowsafe-permissions tuning-apply, started by rowsafe-tuning.path) writes the settings a person changed into files of Rowsafe's own, and nowhere else, only where root allowed it at install (/etc/rowsafe/tuning-allowed, `rowsafe-allow tuning`):
masking Package masking turns real values into realistic fake ones for Guard's safe copies.	Package masking turns real values into realistic fake ones for Guard's safe copies.
mcp Package mcp exposes a Rowsafe organization to AI assistants over the Model Context Protocol.	Package mcp exposes a Rowsafe organization to AI assistants over the Model Context Protocol.
pglog Package pglog reads PostgreSQL's server log: it parses the stderr (log_line_prefix), csvlog and jsonlog formats, classifies each message, removes literal values before anything leaves the server, and tails log files and journald for the agent (Run).	Package pglog reads PostgreSQL's server log: it parses the stderr (log_line_prefix), csvlog and jsonlog formats, classifies each message, removes literal values before anything leaves the server, and tails log files and journald for the agent (Run).
pgprobe Package pgprobe looks at a PostgreSQL port the way a stranger would: it connects, asks for TLS, and starts a login with a made-up user name ("rowsafe_outside_check") to see how far PostgreSQL lets it get.	Package pgprobe looks at a PostgreSQL port the way a stranger would: it connects, asks for TLS, and starts a login with a made-up user name ("rowsafe_outside_check") to see how far PostgreSQL lets it get.
preview Package preview is Guard's migration preview logic that doesn't need a database: splitting SQL into statements, recognising risky DDL, and turning what a migration did on a copy into a verdict with plain-words impact and suggestions.	Package preview is Guard's migration preview logic that doesn't need a database: splitting SQL into statements, recognising risky DDL, and turning what a migration did on a copy into a verdict with plain-words impact and suggestions.
protocol Package protocol defines the JSON contract between the Rowsafe control plane (rowsafed), the agent (rowsafe-agent) and the CLI (rowsafe).	Package protocol defines the JSON contract between the Rowsafe control plane (rowsafed), the agent (rowsafe-agent) and the CLI (rowsafe).
e2e Package e2e seals small secrets end to end between a person's browser (or the rowsafe CLI) and a Rowsafe agent, so the control plane that relays them only ever sees ciphertext.	Package e2e seals small secrets end to end between a person's browser (or the rowsafe CLI) and a Rowsafe agent, so the control plane that relays them only ever sees ciphertext.
release Package release signs and verifies agent release manifests.	Package release signs and verifies agent release manifests.
agentimages Package agentimages is the signed list of a release's Docker agent images: for each image variant ("pg17", "pg17-alpine", "clickhouse26.8"), the digest of ghcr.io/rowsafe/agent built for that release.	Package agentimages is the signed list of a release's Docker agent images: for each image variant ("pg17", "pg17-alpine", "clickhouse26.8"), the digest of ghcr.io/rowsafe/agent built for that release.
tune Package tune knows the PostgreSQL settings that matter: what each one does in plain words, which ones Rowsafe never changes, the values that suit a server (recommendations in the spirit of PGTune) and the values that must be refused because PostgreSQL might not start with them.	Package tune knows the PostgreSQL settings that matter: what each one does in plain words, which ones Rowsafe never changes, the values that suit a server (recommendations in the spirit of PGTune) and the values that must be refused because PostgreSQL might not start with them.