Features
One policy. Every guardrail your agent needs.
OrmAI wraps the ORM you already use and turns database access into a small, typed, policy-checked tool surface. Here is everything it gives your agents.
Field-level redaction
Mask, hash, or deny sensitive columns declaratively. Deny by glob (*password*, *secret*, *token*), mask emails and phones, and agents only ever see what policy allows — never raw PII.
Automatic tenant scoping
Every read and write is filtered by tenant_id, injected from the RunContext rather than the prompt. Cross-tenant access is structurally impossible, not a review checklist.
Query budgets & timeouts
Row caps, statement timeouts, and join-depth limits are checked at compile time. Expensive queries are rejected before they touch the database, keeping runaway agents in check.
Immutable audit log
Every operation is logged with principal, tenant, trace ID, sanitized inputs, and the policy decision — written before the result returns, so isolation and access are provable.
Gated writes
Approve which models can be mutated, require a reason on writes, and cap rows-per-statement. Agents can take action without corrupting data at scale.
Typed tool surface
db.query, db.get, db.aggregate, db.create, db.update, db.delete compile to parameterized ORM operations. SQL injection is structurally impossible — no raw SQL ever leaves the boundary.
And the essentials
Built to run in production.
Python & TypeScript
SQLAlchemy, Tortoise, Peewee, Django, SQLModel on Python; Prisma, Drizzle, TypeORM on TypeScript — one shared policy model.
Framework-native
Drop into FastAPI, LangGraph, the Vercel AI SDK, the Anthropic SDK, or an MCP server without rewriting your data layer.
Runs in your process
No SaaS, no telemetry, no external calls. OrmAI runs entirely inside your application — your data never leaves.
Sub-millisecond policy
Policy evaluation is in-process and adds well under a millisecond per call. Compile-time budgets often make agents faster.
v0.2 operations
Rate limiting, health checks, structured logging, and audit retention landed in v0.2.0 (beta).
MIT licensed
Open source under MIT. Read the code, fork it, run it — no lock-in, no gated features.
See it in context
Each feature maps to a real pattern. Explore how they combine in the field.