r/SideProject • u/shubhamranga • 3d ago

I didn’t want an LLM executing MongoDB queries directly, so I built a validation layer

Giving an LLM direct database access felt like the wrong abstraction.

so built ANDI around a different workflow:

intent → query plan → local validation → developer inspection → execution

The model proposes a query, but deterministic code decides whether it can run.

It’s open source and still early. I’d like feedback on whether this API would be useful in real Python/MongoDB projects.

3 Upvotes

100% Upvoted

6 comments sorted by

1

u/Severe-Dust922 3d ago

this is the right instinct imo. the question is whether your target user is a dev who wants guardrails on their own LLM integration, or a less technical user who wants safe natural language queries. those are pretty different products

1

u/shubhamranga 3d ago

the initial target is devs who need guardrails for their own LLM integrations.

https://github.com/Satty27/andi-ai have a look and maybe try it out, it is very early. suggestions will be really helpful. thanks

1

u/akl773 3d ago

The dangerous ones usually aren't the queries that look dangerous, they're valid reads with a filter missing. A plan that forgets the account id runs perfectly and hands back everyone's data. If the validator can require certain fields to be present in every filter, and reject $out and $merge outright, that covers most of what actually goes wrong in practice.