Probe reads a proposed statement and returns risk guidance. It can point out patterns worth reviewing before a write proceeds. It does not issue a PASS receipt, and it never authorizes execution.
We keep Probe free because charging for the diagnostic can obscure the more important boundary. The paid control is not a better lint result. It is the authorization path that binds a decision to the exact SQL, signs the receipt, and requires verification before execution.
Catalogs can lag the wire
One operational wrinkle is worth stating plainly: third-party catalogs can lag. Some discovery
metadata may still show an old paid Probe listing. The live SQLGuard wire is authoritative:
POST /v1/probe is free.
This separation keeps the first question easy—“what looks risky here?”—without weakening the second: “where is the verified permission for this exact write?”
Inspect the boundary
The public limits are in Trust, current catalog issues are in Reviews, and the Challenge shows where guidance ends and a receipt begins.