Alternatives
Products that do what ZenStack – access control at the ORM layer, built for coding agents does
Hi HN, I'm Jiasheng, co-creator of ZenStack. Access control usually ends up scattered across app code instead of living with the data model — and that's riskier when the code is written by an agent, since it's easy to ship a query with a missing or incomplete authorization check. ZenStack enforces policy (RBAC/ABAC/relation-based) directly at the ORM layer, on top of Kysely, so every query gets checked the same way regardless of who wrote it and who is calling it. Postgres RLS is an option too, but it's hard to maintain and scale, and it's Postgres-only — ZenStack's approach is…
- 1
- 2GI
2016 · github.com
- 3
- 4
- 5EA
2022 · github.com
- 6PC
2016 · github.com
- 7
- 8UP
Utilizing Postgres' RLS feature to isolate user data instead of easy-to-forget where-clauses, is such an underrated use case, I really wonder why not more people use it. If you prefer code over the blog post, I've put the full application example on GitHub. Would love to hear your thoughts. https://github.com/simplyblock/example-rls-invoicing
Sep 2025 · simplyblock.io
- 9IB
Hi HN, I’m the creator of Cordum. I’ve been working in DevOps and infrastructure for years (currently in the fintech/security space), and as I started playing with AI agents, I noticed a scary pattern. Most "safety" mechanisms rely on system prompts ("Please don't do X") or flimsy Python logic inside the agent itself. If we treat agents as autonomous employees, giving them root access and hoping they listen to instructions felt insane to me. I wanted a way to enforce hard constraints that the LLM cannot override, no matter how "jailbroken" it gets. So I built Cordum. It’s an open-source…
Jan 2026 · github.com
- 10OS
Hi HN, Matvey, Ildar, Joey, and Dominik here. If you're building LLM agents that use tools, you're probably worried about prompt injection attacks that can hijack those tools. We were too, and found that solutions like prompt-based filtering or secondary "guard" LLMs can be unreliable. Our thesis is that agent security should be handled at the network level between the agent and the LLM, just like a traditional web application firewall. So we built Archestra Platform: an open-source gateway that acts as a secure proxy for your AI agents. It's designed to be a deterministic firewall against…
Oct 2025 · archestra.ai
- 11AN
2017 · cossacklabs.com
- 12BM
Today we released an open, Valkey-native context layer for AI agents as part of our packages at BetterDB (agent memory, semantic + multi-tier caching, typed retrieval) that run on a Valkey instance no matter where it is - no vendor lock-in. We even started provisioning Valkey instances starting today. Packages are shipped on npm and PyPi. Why we made it: BetterDB originally started as a monitoring and observability platform for Valkey, Redis and any RESP compatible db. This is still the core of the product, but in the process of building this, we kept seeing that one of the fastest-growing…
Jun 2026 · github.com
- 13
- 14OS
Hello, my name is Andrei. My friends and I recently built CentralMind Getaway, an open-source tool that automatically generates AI-agent-optimized APIs from your database connection. It’s designed for those who don’t want to expose direct SQL access to their databases and prefer not to spend time building these APIs manually. What it does: - Auto-generates APIs from your database connection, infer schema & sample data using AI - Filters out PII and sensitive data for compliance (GDPR, SOC 2, etc.) - Optimized for AI-Agent with extra meta information and REST and MCP protocol support -…
2025 · github.com
- 15SS
I built https://ask.rivestack.io — a semantic search engine over Hacker News posts. Instead of keyword matching, it finds results by meaning, so you can search things like "best way to handle authentication in microservices" and get relevant threads even if they don't contain those exact words. How it works: Indexed HN posts and comments into PostgreSQL with pgvector (HNSW index) Embeddings generated with OpenAI's embedding model Queries run as nearest-neighbor vector searches — typical response under 50ms The whole thing runs on a single Postgres instance, no separate vector DB I…
Feb 2026 · ask.rivestack.io
- 16SD
We built a Claude Code plugin that adds fine-grained authorization to apps. Works for creating new apps, adding features to existing apps, and migrating legacy authorization layers. The plugin helps design the permission model, write a SpiceDB schema, identify authorization points in the code base, generate SpiceDB client code, and test the authorization model. We designed the plugin around different modes of working with Claude Code: 1. Guided workflow. /spicedb-dev:plan is the single entry point for anyone unsure where to start. It scans your data model, produces an authorization…
Apr 2026 · github.com
- 17WB
We were tired of writing raw Cypher — escaping quotes, zero autocomplete, refactoring nightmares — so we built GraphORM: a type-safe Python ORM for RedisGraph/FalkorDB using pure Python objects. What it does Instead of fragile Cypher: query = """ MATCH (a:User {user_id: 1})-[r1:FRIEND]->(b:User)-[r2:FRIEND]->(c:User) WHERE c.user_id <> 1 AND b.active = true WITH b, count(r2) as friend_count WHERE friend_count > 5 RETURN c, friend_count ORDER BY friend_count DESC LIMIT 10 """ You write type-safe Python: stmt = select().match( (UserA, FRIEND.alias("r1"), UserB), (UserB,…
Jan 2026
- 18IB
I built a Rust binary (~700KB, two dependencies) that snaps onto any Windows application, continuously reads its UI Automation accessibility tree into a SQLite database, and lets external processes control the app via SQL INSERT. The core insight: every GUI application already describes itself as structured text through the accessibility layer (built for screen readers since 1997). Every major AI lab is taking screenshots of this and running vision models on it. DirectShell just reads the text directly. What it does: - Reads every button, field, menu item into a queryable SQLite DB…
Feb 2026 · github.com
- 19RM
I was tired of asking my claude code to reference my codex chats to get references to what decisions it made and why ; so I built Reference MCP It, whenever prompted establishes sessions to get direct access - been using it on my system for a bit and was super helpful so I made a repo :) Would love feedback!
Jun 2026 · github.com
- 20AC
Hi everyone, I've been working on a CLI tool that can help to easily run any model in claude, Codex, Gemini, Pi, and OpenCode. It's also an API keys manager, supports multiple providers or OpenAI/Claude/Gemini accounts. You can add openrouter, poe, Vercel AI gateways etc. It has a built-in provider that is free to all, which is using Deepseek-V4, no login or API key required, add your own when you're ready. After installation you can try claude instantly (No config, no login): aivo claude Hope it's useful to someone.
Apr 2026 · getaivo.dev
- 21AR
Hi HN. I'm the founder of Phoenix Labs (ex TikTok, Applied AI) and we're open sourcing our internal tooling today which is like a toolchain / meta-harness for CLI agents useful for really scaling eng and creative work. We are a very small team who's building a very ambitious product so we had to find ways to squeeze every ounce of efficiency that we could get our hands on. Harness strengths of different models (Claude, GPTs) and CLI-harnesses (Claude Code, Codex), safe/robust browser integration to speed up UX/QA testing, teams cli to speed up security reviews and parallelize…
May 2026 · agents-cli.sh
- 22
Governance Before Execution, Confidence in Production.
13d ago · sqlchangeguard.com
- 23
A lightweight, self-hosted Postgres browser
12d ago · sql-browser-license-service.vercel.app
Ranked by how close each launch is in meaning, then by votes. Refine with a description →