A Claude Code plugin that analyzes database migrations for destructive operations, estimates lock duration, and generates rollback scripts — before you run anything.
claude plugin install migrate-safeOr clone and install locally:
git clone <repo-url> migrate-safe
cd migrate-safe
claude plugin install .| Command | Description |
|---|---|
/migrate-safe |
Analyze all pending migration files |
/migrate-safe-analyze [file] |
Analyze a specific migration file |
/migrate-safe-rollback [file] |
Generate a rollback script |
/migrate-safe-estimate [file] |
Estimate lock duration with row count |
- Plain SQL (
.sql) - Knex JS/TS migrations
- Prisma
migration.sqlfiles - Alembic Python version files
## migrate-safe Analysis Report
File: migrations/20240601_add_orders_index.sql
Format: SQL
Rollback present: No
| Operation | Risk | Lock Type | Est. Duration | Recommendation |
|-------------------------------|--------|-----------|----------------|--------------------------------------------------------|
| Create index on orders(uid) | MEDIUM | Table | Medium (1-30s) | Use CONCURRENTLY flag to avoid locking in production. |
| Add column orders.archived | LOW | None | Short (< 1s) | Safe metadata-only change (PostgreSQL 12+). |
## Summary
- HIGH risk operations: 0
- MEDIUM risk operations: 1
- LOW risk operations: 1
- Rollback script: missing — run /migrate-safe-rollback
- Recommended action: Review MEDIUM items before proceeding
Reads the migration and outputs a risk table. Detects:
- Destructive operations: table/column removal, type changes, unconstrained row deletion, TRUNCATE
- Locking operations: index creation without CONCURRENTLY, ALTER TABLE, RENAME
- Lock duration estimate: Short / Medium / Long
- Rollback/DOWN migration presence
Generates the inverse operations for a given UP migration. Non-invertible operations (table/column removal, TRUNCATE) are flagged with a WARNING — restore from backup.
Computes estimated lock duration in seconds using operation type + row count. Recommends a maintenance window when total lock exceeds 30 seconds.
Reads local files only. No network calls. No credentials needed. See SECURITY.md.