// Developer Guide

The Complete Guide to
AdminZero

Everything you need to install, configure, and understand how AdminZero protects your database from AI-generated SQL injection attacks.

01 / Overview

What is AdminZero?

AdminZero is a Cloud API Security Gateway that sits between your AI agents (like ChatGPT plugins, LangChain agents, or custom LLMs) and your database. It intercepts every SQL query before it reaches your DB and validates it against a set of hardened security rules.

AST-Based Firewall

Parses query abstract syntax trees — not just regex patterns. Catches deeply nested injection structures.

Zero-Knowledge Vault

Your DB credentials never leave your machine. Stored in your OS keychain with AES-256 encryption.

Real-Time Dashboard

Every blocked and allowed query logged locally — with severity, timestamp, and query content.

Flexible Feature Flags

Toggle PII scrubbing, Prompt Injection, and AST firewalls on a per-request basis.

// Architecture Flow

Your AI Agent
LLM / LangChain / Plugin
SQL Query →
AdminZero
AST Firewall Layer
✓ Safe Only →
Your Database
Postgres / MySQL / SQLite
02 / Mechanism

How It Works

AdminZero runs as a low-latency Cloud API Gateway. Your AI agent sends SQL queries to AdminZero instead of directly to your database. AdminZero then validates, filters, and only forwards safe queries.

01
Query Received
Your AI agent sends a natural language prompt to AdminZero's API endpoint. The query never directly touches your database at this stage.
02
AST Parsing
AdminZero uses Gemini text-to-SQL to generate queries, then parses them into an Abstract Syntax Tree (AST) of the query — a structural map of every clause, table reference, and operation type.
03
Security Rule Checks
The AST is checked against hardened rules: no DML (DELETE/INSERT/UPDATE/DROP), no stacked statements, no system table access, no recursive CTEs, no UNION-based exfiltration patterns.
04
Decision
BLOCKED: The query is rejected. AdminZero logs the threat and returns a structured error. The DB is never touched. ALLOWED: The query is forwarded to your database and the result is returned to the AI agent.
05
Incident Logged
Every decision — blocked or allowed — is written to your local encrypted threat log with a timestamp, query content (sanitized), threat type, and severity level.
03 / Integration

API Integration

AdminZero is hosted as a Cloud API. Authenticate your requests using standard Bearer Token authorization headers.

// POST https://glitchgo.tech/api/v1/query const response = await fetch('https://glitchgo.tech/api/v1/query', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer az_sk_live_your_secret_key' }, body: JSON.stringify({ prompt: 'Show me the top 5 users by revenue', db_url: 'postgres://user:pass@host:5432/db', // Optional (Option B) db_dialect: 'postgres', features: { use_prompt_firewall: true, use_pii_scrubber: true, use_ast_firewall: true } }) }); const result = await response.json();

Option A — Translation & Security Only

Do not provide a db_url. The API translates your prompt and runs the security scanners, then returns the safe SQL string to you. You execute the SQL yourself locally.

Option B — Full Execution proxy

Connect your database connection string in the client portal (stored encrypted). The API translates, verifies, connects to your database to execute, and returns raw cleaned results to your agent.

04 / Setup Guide

Setup & API Keys

Follow these four simple steps to fully configure your workspace, connect your database, and generate developer credentials.

1
Sign In & Onboard
Navigate to /portal and log in with your email. This automatically registers your unique Cloud Workspace in our backend database, giving you 500 free query credits immediately.
2
Generate API Keys
Under the "Developer API Keys" panel, click "Create Secret Key". Enter a name for the key. A secret token starting with "az_sk_live_" is created. Copy this key immediately; for security, it will not be shown again.
3
Choose Database Mode
Decide who runs queries: For translation-only mode, leave the Database URL input blank. For automated query execution, save your connection string (e.g. postgresql://...) in the panel. It is encrypted on our servers using AES-256.
4
Call the Gateway
Authenticate your AI backend requests using the HTTP header "Authorization: Bearer az_sk_live_...". Your keys can be monitored or revoked instantly from your portal table if compromised.
05 / Security Features

Cloud Security Features

AdminZero isn't just a basic regex filter. It provides three layers of deterministic protection for your database, configured dynamically based on your security needs.

AST SQL Guard (+2 Credits)
Parses the full Abstract Syntax Tree (AST) of the generated SQL to block structural anomalies like DML (DELETE, DROP, INSERT), Stacked Semicolons, and Metadata Table Snooping. Protects against attacks that regex misses.
Prompt Injection Firewall (+1 Credit)
Scans the raw natural language prompt from the end-user *before* it even reaches the SQL generator. Blocks malicious instructions and role hijacks ("Ignore previous instructions...").
PII Scrubber (+1 Credit)
Intercepts the returned JSON data and automatically redacts sensitive Personal Identifiable Information (PII) like emails, phone numbers, and credit cards before it reaches the AI agent.
Base Compute Query (1 Credit)
The baseline cost to route and translate a natural language prompt into a safe, read-only SELECT query.

Want to see these features in action?

Test all edge cases and threat interceptions in our Sandbox Simulator.

Launch Interactive Playground
06 / Threats

Threats We Block

These are the most common attack vectors that AI agents introduce into database-connected applications. AdminZero blocks all of these at the AST level before they execute.

DELETE / DROP / TRUNCATE
DELETE FROM users WHERE 1=1

Wipes entire tables. No AI agent should ever be able to do this.

Stacked Semicolon Attacks
SELECT 1; DROP TABLE users;

Attacker appends a destructive statement after a safe one using a semicolon.

System Table Scans
SELECT * FROM pg_tables

Reveals your entire database schema to an attacker.

Recursive CTE Exploits
WITH RECURSIVE x AS (...) SELECT ...

Used to exfiltrate deeply nested relational data row by row.

UNION-Based Injection
' UNION SELECT username, password FROM admins--

Merges a malicious query with a safe one to leak sensitive rows.

Metadata Exfiltration
SELECT * FROM information_schema.tables

Maps every table and column name — first step of any serious attack.

07 / Dashboard

Threat Dashboard

AdminZero includes a local threat monitoring dashboard — a real-time view of every query that passes through the firewall.

Live Query Log
Every query — blocked and allowed — appears in real-time with timestamp and severity badge.
Threat Types
Each blocked query is tagged with the attack category: DML, Stacked, Metadata, CTE, or UNION.
Query Inspector
Click any entry to view the full original query, the AST structure, and the rule that triggered the block.
Export Logs
Export your threat log as JSON or CSV for audit trails, compliance reports, or security reviews.

// Sample Threat Log Entry

timestamp: "2025-07-15T08:34:12Z" type: "BLOCKED" threat: "STACKED_QUERY" severity: "HIGH" query: "SELECT 1; DROP TABLE users;" source: "langchain-agent-session-4f2a" action: "REJECTED — DB never contacted"
08 / FAQ

Frequently Asked Questions

Common questions about security, performance, and compatibility.

Still have questions?

Reach out and we'll get back to you within 24 hours.

Email Us