Surus: Safe Agentic Postgres Companion
An open-source Postgres IDE with a read-only AI agent that never sees your rows.
I’ve spent a good chunk of my working life in SQL editors, and for years the tooling has been stuck between two bad options.
On one side, the classic database IDEs — pgAdmin, Postico, DBeaver, DataGrip. All mature, powerful, but also completely indifferent to what you’re trying to do. They’ll autocomplete a column name, but they don’t know your intent, your schema’s quirks, or that the query they just autocompleted will do a sequential-scan on a 200-million-row table.
On the other side, the new wave of “chat with your database” tools with “AI” bolted onto the core of every single feature and in every panel (Chat2DB, Beekeeper Studio). And most of these are straight unsettling. These tools will cheerfully generate a query and run it straight against your production DB ship your rows with sensitive data off to OpenAI and Anthropic so it can eyeball a query. Pointing these tools to prod DB feels like handing your car keys to your drunk friend and joining him for the ride. LLMs hallucinate at non-trivial rates. That is the main reason why narrow vertical agents became popular.
Both options failed me for the same reason, from opposite directions. The first gives you help without knowing your context. The second has context but gives you help you can’t trust with your prod data.
Surus is my attempt at the thing in the middle. It is designed around three principles, that are wired into how the thing connects to your database.
-
A tight text-to-SQL loop. The agent doesn’t autocomplete a guess. Surus fetches your DB schema on connection and stores the data as context. Upon the request the agent accesses the context and generates the initial SQL. It then runs the query with EXPLAIN, reads the plan, and iterates until the plan looks efficient. What lands in your editor has already been fitted to your actual schema and your actual query planner, not to a plausible-looking average from a Reddit post posted 8 years ago.
-
Read-only by design. The agent runs on a read-only connection pool. Writes don’t fail because a system prompt politely asked it not to — they fail at the database level, because the connection physically cannot issue them. Prompt injection, a jailbroken model, a bad day: none of it matters, because the capability isn’t there. When you want to write, there’s an explicit write-mode toggle in the editor, it turns the UI red so you’re never surprised, and the agent never touches that pool. Writes are something you opt into, deliberately, as a human.
-
Your data stays private by default. The agent reasons over your schema, table statistics, and EXPLAIN plans — the shape of your data, not the rows. It can design a query about your customers without your customers’ data ever leaving the database to answer it.
What it actually feels like
Underneath the agent, Surus is a real SQL IDE with a database attached. A proper editor, a results grid, one-click charts, CSV export, saved queries laid out as plain files in a git-friendly folder. You can ignore the AI entirely and just use the IDE.
When you do want the agent, it has three modes:
- SQL — Turn a plain-English request into a performant query fitted to your use case.
- Question — get a plain-text answer about your data. The agent will actually look into your data and summarize a response.
- Teach — build the query, then walk through every clause and why it’s written that way. This one’s quietly my favorite; it’s how you actually get better at SQL instead of just outsourcing it.
There’s an auto-generated ERD so you can see how your schema fits together without reading migrations, and a query log that tags every statement by who ran it — you, the agent, or the app itself. You always know exactly what the agent did on your behalf.
Surus runs as a local web app or a native macOS app. Your connections, saved queries, and history live in a local SQLite file; passwords and API keys go in your OS keychain. Nothing phones home.
Surus is Open Source. Read it, run it, self-host it, hack on it, learn from it:
GitHub - Geometrein/surus: Agentic Postgres companion - with the right guardrails to safely point…
About the name
Surus is named after Hannibal’s last surviving war elephant — the one that carried him through the rough Alpine passes as he crossed into Italy during the Second Punic War. It felt like the right namesake for a steady companion: something built to carry you across rocky database terrain without walking you off a cliff.
Surus Logo