saferow, an AI database workspace for macOS

What saferow promises

• The front door

  Ask anything

  The agent plans, reads, charts, explains and drafts fixes and migrations across MySQL, MariaDB, Postgres and SQLite. The full classic client is one keystroke away, and the agent writes into the same screens.

• The product

  Run nothing blind

  Reads run under a read-only role and never ask. Writes are dry-run, counted, held for one approval — Touch ID on production — and can be rewound. Claude Code, Cursor and Codex get the same rules through saferow mcp.

• The brain

  Your model, your Mac

  Local by default, picked from scores measured on a Mac: Qwen 3.6 35B-A3B as the agent, Granite 4 7B-A1B for fast SQL, Granite 4.2 8B for decisions, Granite 4.1 built in. Claude, GPT or OpenRouter when you choose them. Every turn shows what left the Mac.

1. Scope line

   Above the input: which database, which environment, which role, which model, and where it runs. A wrong connection is caught before you press Return.

   saju · production

   read-only role · Qwen 3.6 35B-A3B

   on this Mac · 0 B out

2. Echo

   In under a second, one line restates what you asked and where, so a misread is caught before anything runs.

   find RUNNING readings from before the restart, then mark them FAILED

3. Plan

   For multi-step work or anything that writes. Each step is R or W, with its tables and an estimated row count. A plan that only reads runs without asking.

   RFind RUNNING readings older than an hour3 rows

   RCheck AuditLogs for the restart1 row

   WSet status FAILED on those rowsheld

4. Tool rows

   Each query is a ruled row, open while it runs and folded after. Open one to read the SQL, edit it and run it; SQL you edit is marked as yours.

   ▸ query Readings3 rows · 12 ms

   ▸ query AuditLogs1 row · 8 ms

5. Result

   A grid or a chart under a header made of numbers. One click opens it in the canvas or a tab of the classic client.

   Readings3 of 140 · counted · 12 ms

   cmf8q9…7c · RUNNING · 04:31

   cmf8r0…d4 · RUNNING · 04:36

6. Proposed change

   The SQL, a dry run inside a transaction that is rolled back, and before and after for the rows. The agent’s reasoning is labelled as agent-written.

   • 3 rows counted
   • 1 table
   • dry run 18 ms · rolled back
   • triggers 0
   • restore point 1.2 KB

7. Held

   The button becomes Approve 3 changes. The approval is bound to the 3 counted rows: if the count differs when it runs, it rolls back. On production, Touch ID repeats the count and the connection.

   Approve 3 changes

   waiting for you

8. Ledger

   Every write — yours, the agent’s, an MCP client’s — lands in one ledger with its count, how it was approved, and a way back.

   #0142 21:41 UPDATE Readings

   3 rowsTouch IDRewind

the moment of consent

One approval, bound to the rows it counted.

The sheet names who is asking, then puts the count, the way back and the transaction rule in a few lines before the fingerprint.

• 3Counted with the same WHERE. If the count differs when it runs, the transaction rolls back and nothing changes.
• Saved first, on this Mac. A restore point before the write, so Rewind can put the rows back.
• Plain Return never approves. Touch ID does, or ⌘⇧A and then Touch ID.

• Reads never ask

  They run under a read-only database role, so the database itself refuses a write, whatever the SQL text looks like.

• One statement at a time

  Several statements in one string, and code hidden in a MySQL /*! … */ comment, are refused before the database sees them.

• Plans, not prompts

  An agent’s write plan is held once, even on dev. People rejected 39% of plans while approving 97% of single prompts: the plan is where attention works.

• Classic client

  free

  Replaces Sequel Ace and TablePro.

  • MySQL, MariaDB, Postgres and SQLite in one native-feeling app.
  • SSH through your own system ssh: ~/.ssh/config, ProxyJump and the 1Password agent just work.
  • A fast grid with staged edits, committed with ⌘S through the same kernel.
  • A SQL editor with completion, formatting and :params.
  • Structure, indexes, relations and DDL for every table.
  • Visual EXPLAIN, and a relationship map in each database’s Tour.
  • Export results as CSV, JSON or SQL.
  • Import your connections from Sequel Ace, TablePlus and TablePro. Passwords are never read from them.

• Agent

  free to look · Pro to act
  • Ask, explain, chart and search every table.
  • Plans with R and W steps and row estimates.
  • Tool rows with editable SQL.
  • @table mentions; /fix, /migrate, /index, /chart, /watch.
  • Fixes, migrations and bulk changes, each held for approval.
  • Split compare: one question, two models side by side.

• Safety

  always free
  • Read-only roles, single statements, counted writes.
  • Approvals bound to row counts.
  • Dry runs; shadow copies for schema changes on production.
  • Rewind: 7 days free, 30 days with Pro.
  • One ledger of every write, by you, the agent or an MCP client.
  • What left the Mac, shown on every turn.

• Memory & automation

  Pro
  • Per-database memory: definitions, joins, notes.
  • Saved questions you can rerun.
  • Playbooks for repeat work.
  • Watches that report only trouble, under the read-only role.
  • Write proposals from Claude Code, Cursor and Codex.

• Models

  free
  • A built-in runtime: no Ollama needed.
  • Ollama and LM Studio, detected.
  • OpenRouter sign-in, or your own Anthropic or OpenAI key.
  • Roles: agent, careful, fast SQL, decisions, embeddings.
  • Fit checked before a download; speed and a SQL self-check measured on your Mac.

keys

Everything is a keystroke away.

⌘K

Go anywhere, switch connections, approve what is held.

⌘J

Ask the agent, from any screen.

⌘1 ⌘2

The agent, or the classic client.

⌘L

The ledger.

⌘⇧A

Approve the held change, then Touch ID.

⌘S

Commit your staged grid edits, through the same kernel.

• agent

  Qwen 3.6 35B-A3B

  28/32 as an agent

  The top agent score with no malformed tool calls, at mixture-of-experts speed.

  One shot

  30/32

  Writes

  99 tok/s

  Memory

  22.5 GB

  Needs

  32 GB Mac

• fast sql

  Granite 4 7B-A1B

  28/32 in one shot

  Right SQL in under a second, and small enough for an 8 GB Mac.

  As an agent

  20/32

  Writes

  115 tok/s

  Memory

  4.6 GB

• decisions

  Granite 4.2 8B

  97% of 101 decisions

  Routes each question and flags personal data, injection and writes, 160 ms each. It never decides what is safe; the kernel does.

  Memory

  8.3 GB

  Runs via

  its own wrapper or Ollama

• built in

  Granite 4.1 8B

  25/32 as an agent

  Runs inside saferow with no Ollama, with clean tool calls, and fits in 16 GB.

  One shot

  26/32

  Writes

  65 tok/s

  Download

  5.3 GB

A small test: 32 questions on a synthetic database, one run each at temperature 0, so one question moves a score by 3 points. saferow measures each model’s speed on your own Mac after first use.

1. Claude Code starts saferow-mcp, a small signed binary inside the app. The first time, saferow asks you to pair it and which connections it may see.
2. Reads run under the read-only role and appear in the ledger as “MCP · Claude Code”.
3. It calls propose_change. The kernel counts and dry-runs the change, then answers: held.
4. You review it in saferow and approve; on production, with Touch ID.
5. It reads the outcome from ledger_status. The password never left saferow.

~/.claude.jsonCursor and Codex too

"mcpServers": {
  "saferow": {
    "type": "stdio",
    "command": "/Applications/saferow.app/Contents/MacOS/saferow-mcp"
  }
}

Settings › saferow mcp writes this for you after you confirm, with a backup beside the file.

• list_connections
• describe_schema
• run_query
• explain_query
• propose_change
• ledger_status

Free: read-only MCP on one connection. Pro: write proposals on every connection.

• Free

  forever

  $0

  The full classic client, the Safety Kernel, 7-day Rewind, a read-only agent, and read-only MCP on one connection.

• Pro

  once

  $24once · 3 Macs$19 at launch

  Agent writes, 30-day Rewind, memory, watches, playbooks, compare, MCP writes and unlimited connections. Every 1.x update free.