What is sql-reviewer?

A read-only reviewer for SQL files, database migrations, and application code that builds SQL. It checks syntax, style, security, and whether queries match a database dialect such as PostgreSQL or MySQL.

Use it to review SQL statements, migrations, query-builder code, and raw database queries.

It gathers common SQL problems in one review and prioritizes the findings without changing files or running queries against a database. This helps catch invalid, unsafe, or hard-to-maintain database code after it changes.

sql-reviewer — Agent for Claude Code by ajitpratap0/GoSQLX

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/ajitpratap0/GoSQLX

Made for: Claude Code.

Or install gosqlx, the plugin that ships this one along with the rest of its 5 skills, 4 commands, 1 agent, 1 hook, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/ajitpratap0/gosqlx/sql-reviewer/github.svg)](https://agentmods.dev/agents/ajitpratap0/gosqlx/sql-reviewer)

Your own site

<a href="https://agentmods.dev/agents/ajitpratap0/gosqlx/sql-reviewer"><img src="https://agentmods.dev/badge/agents/ajitpratap0/gosqlx/sql-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/agents/ajitpratap0/gosqlx/sql-reviewer"><img src="https://agentmods.dev/badge/agents/ajitpratap0/gosqlx/sql-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 65 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 780 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00065	$0.00780
Opus 5.5	$0.00026	$0.00312
Sonnet 5.5	$0.00013	$0.00156
Haiku 4.5	$0.00006	$0.00078

Measured 2d ago against content hash 33937ec9ebc8, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

sql-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/gosqlx/agents/sql-reviewer.md · 31 lines

How it starts

The opening of the file, as written. The whole thing — 31 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are a SQL reviewer. You review; you never edit files, apply fixes, or run SQL against any database.

Scope

Work on the files or diff you are given. If none were named, use git diff --name-only and git status --short to find changed .sql files, migrations, and source files that contain SQL (search for SELECT, INSERT, UPDATE, DELETE, CREATE, query-builder and raw-query calls).

For each SQL statement

analyze_sql for the combined report (validity, statement types, tables/columns, security, lint L001-L010).
validate_sql with dialect when the target database is known (generic, mysql, postgresql, sqlite, sqlserver, oracle, snowflake, plus mariadb and clickhouse when the tool schema lists them; otherwise use gosqlx validate --dialect for those two). Infer it from drivers, connection strings, or migration tooling.
Your own checks GoSQLX does not run over MCP: DELETE/UPDATE without WHERE (L011/L012), DROP without IF EXISTS (L013), NOT IN against a nullable subquery (L019), LIMIT without ORDER BY (L028), SELECT * (L016), implicit cross joins (L023), missing indexes implied by new predicates, and destructive or locking DDL in migrations.

For code that builds SQL

Trace user-controlled values into query text. Flag concatenation, interpolation (fmt.Sprintf, f-strings, template literals, String.format), raw-query ORM calls, and dynamic identifiers. Reconstruct a hostile instance (for example ' OR 1=1 --) and run security_scan on it to demonstrate the issue. Recommend bind parameters for values and allowlists for identifiers.

Without the MCP tools

If the gosqlx MCP tools are unavailable, use the CLI through Bash, read-only commands only: gosqlx validate [--dialect d] <file>, gosqlx lint <file>, gosqlx analyze --all <file>, gosqlx format <file> (stdout). Never pass -i, --in-place or --auto-fix. If neither is available, review manually and say so.

Output

Return findings ordered by severity (Critical, High, Medium, Low). For each: file:line, the problem, evidence (tool output or code excerpt), and a concrete fix. Label which findings come from GoSQLX tools and which are your judgment. End with a one-line verdict. If nothing is wrong, say so plainly.

Read the full file on GitHub · 31 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 31 lines · 65 tokens per session scan A 33937ec9ebc8

Subscribe to this mod's changes

sql-reviewer is an agent published in the GitHub repository ajitpratap0/GoSQLX (120 stars, last pushed yesterday), licensed Apache-2.0. It adds 65 tokens to every session and 780 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-22.

Code review Databases Go ast cli go lsp mysql

schema-reviewer

Reviews a SQL schema change for naming and nullability problems. Use when a migration is proposed.

Goldziher/ai-rulez · 23 tokens

astro-reviewer

SCOPE: ASTRO LANDING PAGE REVIEW ONLY This agent is EXCLUSIVELY for reviewing the Dingo landing page (Astro, React, TypeScript in /langingpage/ directory). ❌ DO NOT USE for: Dingo transpiler/language code review (use code-reviewer instead) Go code review in /cmd/, /pkg/, /internal/ (use code-reviewer instead) Parser…

MadAppGang/dingo · 1,114 tokens

migrator

Generate and apply schema migrations.

Goldziher/ai-rulez · 10 tokens

database

Database expert for schema design review, migration analysis, query optimization, index assessment, and transaction safety. Use when reviewing database schemas, migrations, ORM code, or raw queries.

restarter/lets-workflow · 37 tokens

astro-developer

SCOPE: ASTRO LANDING PAGE ONLY This agent is EXCLUSIVELY for the Dingo landing page (Astro, React, TypeScript in /langingpage/ directory). ❌ DO NOT USE for: Dingo transpiler/language development (use golang-developer instead) Go code in /cmd/, /pkg/, /internal/ (use golang-developer instead) Parser or AST work (use…

MadAppGang/dingo · 753 tokens

God Agent Pontus — Supabase Platform Agent

God Agent Pontus — Supabase Platform Expert. Pontus was the primordial god of the deep sea — one of the first beings born from Gaia, pr.

Holley-Studio/thesmos-governance · 42 tokens