Quickstart

Two required environment variables, then run it.

Installation

Three ways to run Lizard, pick whichever fits your workflow.

npm

npm install
export LIZARD_ENCRYPTION_KEY=$(openssl rand -base64 32)   # required — encrypts stored DB passwords at rest
export ANTHROPIC_API_KEY=sk-ant-...                        # or set LIZARD_AI_PROVIDER=openai/google
npm run dev                                                 # → http://localhost:3111

Then add your own connection(s) in the UI (Settings → Connections) — Postgres, MySQL, and MongoDB are all supported side by side. The connection name doubles as the database alias in cross-database SQL (users_service.public.customers), so it must be a lowercase identifier.

Docker

docker run -p 3111:3111 \
  -e LIZARD_ENCRYPTION_KEY=$(openssl rand -base64 32) \
  -e ANTHROPIC_API_KEY=sk-ant-... \
  -v lizard_data:/app/data \
  ghcr.io/lizardconsole/lizard:latest

Docker Compose

Save as docker-compose.yml, drop your key into .env next to it, then run docker compose up -d.

services:
  lizard:
    image: ghcr.io/lizardconsole/lizard:latest
    ports:
      - '3111:3111'
    environment:
      LIZARD_ENCRYPTION_KEY: ${LIZARD_ENCRYPTION_KEY}   # required — encrypts stored DB passwords at rest
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}            # or set LIZARD_AI_PROVIDER=openai/google
    volumes:
      - lizard_data:/app/data
    restart: unless-stopped

volumes:
  lizard_data:

# .env
LIZARD_ENCRYPTION_KEY=...   # e.g. output of: openssl rand -base64 32
ANTHROPIC_API_KEY=sk-ant-...

Provisioning credentials on your own databases

Lizard wants two roles per database, least privilege (a connection may register with only a read role for read-only mode). For Postgres:

-- run as a superuser on each service database
CREATE ROLE lizard_read LOGIN PASSWORD '…';
CREATE ROLE lizard_write LOGIN PASSWORD '…';

GRANT USAGE ON SCHEMA public TO lizard_read, lizard_write;   -- repeat per schema
GRANT SELECT ON ALL TABLES IN SCHEMA public TO lizard_read;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO lizard_write;
GRANT USAGE ON ALL SEQUENCES IN SCHEMA public TO lizard_write;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO lizard_read;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO lizard_write;

MySQL and MongoDB follow the same shape — a read-only user/role for lizard_read, and optionally a read-write one for lizard_write; grant only what each needs. Lizard never issues DDL against your databases and never stores anything in them — all Lizard state lives in its own local SQLite file.

Key configuration

Development

npm run dev              # dev server
npm test                 # guard adversarial suite + database unit tests
npm run test:integration # end-to-end test — needs two reachable Postgres databases
npm run build             # production build