Interdict
Home GitHub Install
The complete user start guide

Your agent gets useful.
Your database stays guarded.

Configure each database once. After that, ask Claude, Codex, Cursor, or any MCP agent to do normal database work. Interdict starts in the background and checks every query before PostgreSQL sees it.

1pip install interdict-db
2interdict setup
3interdict connect claude

The PyPI package is interdict-db. It installs the short interdict terminal command.

01

Install Interdict

Interdict requires Python 3.11 or newer. Install it once:

pip install interdict-db

Confirm the command is available:

interdict --version
02

Set up your first database

Run the guided wizard. No YAML editing is required.

interdict setup --name production

Just want to test it out? Click here.

The wizard walks you through:

Connection testConfirms PostgreSQL is reachable.
Table discoveryShows real schemas and tables to choose from.
Safety presetProduction, read-only, or development.
Control storageInitializes approvals, undo evidence, and audit records.
Policy generationWrites a safe policy from your choices.
Privilege auditRefuses overpowered production roles.
Where are passwords stored?

Interdict uses the operating-system credential store when available. On headless systems it falls back to an owner-only file. Secrets are not written into Claude or Codex configuration.

03

Connect your AI agent

Choose the profile a human wants this agent to use:

interdict connect claude --profile production
interdict connect codex --profile production interdict connect cursor --profile production interdict connect custom --profile production

Claude and Codex receive a command that launches interdict --profile production. Cursor receives a project MCP configuration. Custom prints portable MCP JSON.

The agent cannot switch profiles through an Interdict tool. A human chooses which database is connected.

Daily workflow

Now, ask your agent normally

“Find every overdue invoice from last month.”
Agent writes SQLYou stay in the conversation.
→
Interdict checks itPolicy, scope, impact, and undoability.
→
Postgres runs itOnly after the decision allows it.

Safe reads and small writes continue automatically. Forbidden SQL is blocked before PostgreSQL. Large writes stop for a human decision.

Human control

Review dangerous work in plain language

interdict approvals --profile production

1 pending approval · profile production

SQL · 98c4…
   SQL: UPDATE public.customers SET status='inactive' …
   Reason: Deactivate accounts inactive for two years
   Requested by: Claude
   Impact: blast radius 4,238 rows

Approve or deny the newest request:

interdict approve latest --profile production interdict deny latest --profile production

Request and approve the newest available undo:

interdict revert latest --profile production

The approval secret never enters the AI conversation. The agent can only execute the exact SQL that the human reviewed, once.

Multiple databases

Configure once, reuse by name

interdict setup --name production interdict setup --name staging interdict setup --name analytics

See every configured database:

interdict profiles

Select the default for human terminal commands:

interdict profile use production

Each connected MCP server still pins an explicit profile, so an agent connected to staging cannot silently redirect itself to production.

Enterprise production

One small DBA handoff remains intentional

Interdict will not silently grant itself production access. If the wizard finds a superuser, database owner, table owner, or role with dangerous DDL privileges, it creates a reviewable SQL file for your DBA. 

interdict doctor --profile production

Production is ready only when doctor reports:

PASS: production privilege boundaries are configured.
Interdict is defense in depth.

Keep raw database credentials and cloud-admin tokens away from the agent. Maintain off-volume backups and point-in-time recovery. Interdict undo evidence is not a disaster-recovery replacement.

Reference

The commands you will actually use

interdict setupGuided database configuration.
interdict profilesList configured databases.
interdict profile use NAMESelect the human terminal default.
interdict connect CLIENTInstall MCP configuration.
interdict doctorVerify production boundaries.
interdict approvalsReview held work.
interdict approve latestApprove the newest request.
interdict deny latestDeny the newest request.
interdict revert latestHuman-initiate the newest undo.
Running FAQs

Common questions while testing Interdict

Just want to test it out? How do I try Interdict locally, without a real database?
  1. Start Docker Desktop and wait for it to finish loading.
  2. From the repo root, start the bundled sample database:
    docker compose up -d postgres
  3. Wait about 10–20 seconds for it to seed, then confirm it's healthy:
    docker compose ps
  4. When interdict setup asks for the PostgreSQL URL, paste:
    postgresql://postgres:postgres@localhost:5433/pagila
  5. For the control database, reuse the same URL — that's fine for local testing only.
  6. Choose the Development preset. Production requires a locked-down, non-superuser role that the default postgres superuser doesn't have.

Install. Configure once. Ask your agent to work.

pip install interdict-db
Read the source