SQL Risk Checker (Free)

Catch the DELETE FROM orders; that was meant to have a WHERE before anyone runs it. The checker reads .sql files, folders or a pasted snippet. It flags statements that change or delete a lot of data, plus a few query bugs that quietly return wrong results. Runs on your computer, in pre-commit, or as GitHub pull-request annotations. Python standard library only; it never connects to a database.

$ python3 -m sqlrisk examples/cleanup.sql
examples/cleanup.sql: 10 statements (3 block, 4 confirm, 0 write, 3 read)
  BLOCK   line 5    DELETE with no WHERE changes every row: DELETE FROM staging.events
  BLOCK   line 6    UPDATE with no WHERE changes every row: UPDATE crm.accounts SET owner_id = 42 WHERE 1=1
  ERROR   line 9    EQUALS_NULL: = NULL / != NULL is never true; use IS NULL / IS NOT NULL
  BLOCK   line 14   DROP SCHEMA deletes everything in it: DROP SCHEMA scratch CASCADE
  ...
FAIL (fail-on block)

Lint checks: = NULL (never true), NOT IN (SELECT ...) (no rows if the subquery has a NULL), comma joins (accidental cross joins) and SELECT *. Comments, strings and $$ bodies are ignored, so 'DROP TABLE x' inside a string is not flagged. Works with PostgreSQL, MySQL, SQLite, Snowflake, BigQuery, Databricks and similar dialects.

• --fail-on block (default), confirm, error (block plus = NULL) or never. Exit 1 when something at that level is found.
• --format text|json|github. github prints annotations that GitHub shows on the pull request.
• Put -- sqlrisk: ignore on the line above a statement a person has reviewed (for example a one-time backfill). It is still listed, but it doesn't fail.

Copy sqlrisk/ to your repository root, then:

• GitHub Actions: copy ci/.github/workflows/sqlrisk.yml. Pull requests that touch .sql files get annotations, and the check fails on block-level statements.
• pre-commit: merge ci/.pre-commit-config.yaml (a local hook that runs on staged .sql files).

./demo.sh runs both output modes on the examples. ./run_tests.sh runs the tests. It's also a Claude Code plugin with a skill in skills/sql-risk/.

The checker reads text only. It doesn't know your data, row counts or permissions, so a person still decides whether a confirm-level statement is intended.

Working with data in Claude Code? Data & Analytics Subagents adds 10 subagents (SQL review, query tuning, dbt, data quality, metrics, A/B tests). It also has a guard hook that stops Claude from running DELETE without WHERE or DROP SCHEMA through psql, bq, snowsql and other database CLIs: https://youraitools.co/marketplace/data-analytics-subagents

• The checker reads text only.
• It doesn't know your data, row counts or permissions, so a person still decides whether a confirm-level statement is intended.