Skip to content

[claude-hackernews] Reply draft: Faz Show HN, MCP-surface gate vs PreToolUse seam (id=48008603) #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
NiveditJain wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[claude-hackernews] Reply draft: Faz Show HN, MCP-surface gate vs PreToolUse seam (id=48008603) #57

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions drafts/2026-05-04T142954Z.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
# Reply to "Show HN: Safety layer between AI agents and databases" (Faz)

- **HN:** https://news.ycombinator.com/item?id=48008603
- **Story:** Show HN: Safety layer between AI agents and databases (id=48008603, 3 points, 5 comments at draft time, 50 minutes old, links to https://github.com/fazhq/faz)
- **OP:** `burhanultayyab`

**Status:** draft (pending manual post)

## The post

OP submitted a Show HN with no top text on HN, just the title and a link to the `fazhq/faz` GitHub repo. From the OP's own follow-up comments in-thread, Faz is "a middleware that sits between AI agents and databases and ensures all query passes through safety pipelines, so that your agents can't nuke your databases or access data that they are not supposed to." A commenter (`linggen`, id=48008847) asked why Faz is exposed as an MCP server instead of a Claude skill; OP responded that MCP wins on determinism because the agent can hallucinate or misbehave around a skill, but a separate-process MCP forces the safety pipeline to fire.

This is a top-level reply to the story (not a reply to a specific subthread); engages with OP's MCP-vs-skill design tradeoff and the implicit coverage boundary.

## My reply

```
(disclosure: I work on FailProof AI: https://github.com/exospherehost/failproofai)

The MCP-server placement buys real determinism: the agent can't paraphrase its way around a separate process the way it can a skill, and the DB owner owns the boundary regardless of which agent connects. The tradeoff is coverage. Faz catches DB calls that route through the MCP. If the agent has Bash and runs psql -c "DROP TABLE...", or writes a migration file CI applies later, the safety net never sees it.

That bypass is the seam PreToolUse hooks work at. A small companion policy for the bash route:

import { customPolicies, deny, allow } from "failproofai";
customPolicies.add({
name: "block-bash-drop",
match: { events: ["PreToolUse"] },
fn: ({ toolName, toolInput }) => {
if (toolName !== "Bash") return allow();
return /\bDROP\s+(TABLE|DATABASE)\b/i.test(toolInput?.command ?? "")
? deny("DROP blocked outside the Faz MCP path")
: allow();
},
});

The two compose: Faz inside the MCP path, hooks on everything that bypasses it.
```
Comment on lines +15 to +37
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

HN formatting: remove the outer fenced code block and render only the policy snippet as preformatted text.

Right now the entire reply (prose + policy snippet) is wrapped in a triple-backtick fence (Line 17-37). That will cause the whole comment to render as code on HN, and HN does not support CommonMark triple-backtick fenced code blocks. (news.ycombinator.com)

Also, this is exactly what triggers the markdownlint MD040 warning about missing fenced-code language at Line 17.

Suggested shape:

  • Make the prose outside of any triple-backtick fences.
  • For the block-bash-drop snippet, use HN-friendly indented code (4 spaces per line) instead of ``` fences (so markdownlint also won’t complain).
Proposed edit (formatting only) 
 ## My reply
 
-```
-(disclosure: I work on FailProof AI: https://github.com/exospherehost/failproofai)
+ (disclosure: I work on FailProof AI: https://github.com/exospherehost/failproofai)
 
 The MCP-server placement buys real determinism: the agent can't paraphrase its way around a separate process the way it can a skill, and the DB owner owns the boundary regardless of which agent connects. The tradeoff is coverage. Faz catches DB calls that route through the MCP. If the agent has Bash and runs psql -c "DROP TABLE...", or writes a migration file CI applies later, the safety net never sees it.
 
 That bypass is the seam PreToolUse hooks work at. A small companion policy for the bash route:
 
-  import { customPolicies, deny, allow } from "failproofai";
-  customPolicies.add({
-    name: "block-bash-drop",
-    match: { events: ["PreToolUse"] },
-    fn: ({ toolName, toolInput }) => {
-      if (toolName !== "Bash") return allow();
-      return /\bDROP\s+(TABLE|DATABASE)\b/i.test(toolInput?.command ?? "")
-        ? deny("DROP blocked outside the Faz MCP path")
-        : allow();
-    },
-  });
-
-The two compose: Faz inside the MCP path, hooks on everything that bypasses it.
-```
+    import { customPolicies, deny, allow } from "failproofai";
+    customPolicies.add({
+      name: "block-bash-drop",
+      match: { events: ["PreToolUse"] },
+      fn: ({ toolName, toolInput }) => {
+        if (toolName !== "Bash") return allow();
+        return /\bDROP\s+(TABLE|DATABASE)\b/i.test(toolInput?.command ?? "")
+          ? deny("DROP blocked outside the Faz MCP path")
+          : allow();
+      },
+    });
+
+The two compose: Faz inside the MCP path, hooks on everything that bypasses it.
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)

[warning] 17-17: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@drafts/2026-05-04T142954Z.md` around lines 15 - 37, The whole reply is
wrapped in a triple-backtick fence causing HN to render all prose as code and
triggering markdownlint MD040; un-wrap the prose so only the policy snippet is
preformatted, remove the outer ``` block around the entire section, and render
the block-bash-drop policy using HN-friendly indented code (4 spaces per line)
instead of fenced code; specifically edit the text around the customPolicies.add
call (the policy named "block-bash-drop" and the PreToolUse reference) so the
surrounding paragraphs are plain text and the policy lines are each indented by
four spaces.


## Insight for the FailProof team

The MCP-vs-hook seam is now showing up as a recurring framing in this market: products that gate at a *specific tool surface* (Faz on the DB MCP, Cordon on MCP calls in general, AgentPort on integrations) versus products that gate at the *agent harness* boundary (PreToolUse hooks, which see every tool call regardless of which provider routed it). Both are real layers and both have value, but the tool-surface products consistently leave the bash route uncovered, and DB destructive ops via `psql`/`mongosh`/`redis-cli` are a known agent failure mode (the prod-DB thread from late April was exactly this). The marketing angle this opens: a short blog post or comparison page titled something like *"Tool-surface gates vs harness-hook gates: why most agent-DB safety stacks need both"* that walks through `psql -c "DROP TABLE"` slipping past an MCP gate and then being caught at PreToolUse. That is a co-existence story, not a competitor takedown, and it would land on threads like this one.

## Notes / findings

- OP body on Show HNs is sometimes empty (`<div class="toptext"></div>`), with the actual product description living in OP's own follow-up comments. Worth treating both as the "OP body" when scanning for thread-fit; the title alone undersells the design discussion that's actually happening.
- The `comhead` block on each comment includes a `togg.clicky` collapse link with `n=` indicating subtree size; useful for skipping low-engagement subtrees during sweeps.
- Faz is positioned as an MCP server (`fazhq/faz` repo). The `mcp` keyword search on Algolia returns several other DB-safety-flavored projects this week; worth a periodic sweep to make sure FailProof-mentioning replies don't blur into a campaign across them. One reply per qualifying thread, no near-identical paraphrases.
- The reply does not include an install command, a comma-list of policies, scope-merge talk, or a second link to the repo. The disclosure line is the single repo mention. ~115 words of prose, one snippet, one named seam (PreToolUse) - matches the working shape from `comments/2026-04-29T043958Z.md`.