New Tenants: several teams or customers on one deployment, each with its own audit log. See how it works →
Self-hosted · open-source core, AGPLv3

Give AI agents governed access to the data you already have.

The Data-Bridge sits in front of the databases you already run and makes them queryable by AI agents, scripts and BI tools — read-only, audited, and inside your own infrastructure. No migration, no SaaS copilot in the middle, and results sized for an agent's context window, so you pay for answers rather than overhead.

Get started — free Request a 30-day evaluation

Free edition: one Docker command, no account. Engineers: read the docs.

~⅓ fewertokens on large results with Lean Mode — a smaller bill and more room for the agent to think
Same answersLean Mode on or off, all 21 questions in our accuracy test came back the same
7 sourcesPostgreSQL, MySQL, SQL Server, Snowflake, CSV, Parquet, DuckDB — any MCP client, and Postgres BI tools in the commercial edition
1 commandThe free edition runs in a single Docker container. No account, no data copied

Token figures measured with Claude Code and Claude Opus 5.5, October 2026. Lean Mode is opt-in. How we measured

The lifecycle

From a registered source to an audited answer.

Five stages, the same for every caller. Pick one to see what happens there.

Register a source once.

Point TDB at a database or a file. It keeps the credentials encrypted and gives the source a governed name; nobody downstream ever sees a connection string.

Registering sources →
  • PostgreSQL, MySQL, SQL Server, Snowflake, CSV, Parquet and DuckDB
  • A whole database or a single table
  • Credentials encrypted at rest, no plaintext mode

Why teams choose it

Production-safe AI access, without building it yourself.

Connecting a model to a database is the easy half. The governance around it is the half that keeps projects out of production.

01

Governed access, not raw credentials.

Agents get a key scoped to what they may ask — never your database password. Every statement is checked as read-only before it runs, and the database session enforces it again.

02

Answers, not token overhead.

Lean Mode sends results sized for the agent: about a third fewer tokens on large results, with the same answers. Aggregates and filters run in the database, so the agent reads the answer, not the rows behind it.

03

Evidence, not trust.

Every query, refusal and AI client is recorded in a log you own — even the free edition writes one. The commercial edition chains it so an edit is detectable, and exports it to the SIEM you already run.

How it works

One governed, lean surface in front of every database you run.

Every request — from an agent, a script or a BI tool — passes the same six steps on its way to your data and back, with no per-dataset API to build.

Who asks

No custom integration

  • Claude, Cursor, VS Code — any MCP client
  • Metabase, DBeaver, psql
  • REST and OpenAPI
  • Your own services

The Data-Bridge

On your infrastructure

  1. IdentitySingle sign-on, OAuth 2.1, API keys, roles, tool scopes
  2. Read-only checkRead the way each of five SQL dialects reads it
  3. Bounded runRead-only session, row ceiling, timeout at the source
  4. Injection filterHidden instructions in data are redacted
  5. Lean ModeResults sized for the agent: ~⅓ fewer tokens, same answers
  6. Signed auditWho, which AI client, what SQL, what came back

Your data

Stays where it is

  • PostgreSQL
  • MySQL
  • SQL Server
  • Snowflake
  • CSV and Parquet files, DuckDB databases

What sets it apart

The usual ways to put AI on company data, compared on what a security review asks first.

The Data-Bridge
Warehouse AI assistants
SaaS copilots
DIY MCP servers
Runs inside your perimeter
Yes
No
No
Yes
Works on the databases you already run, all of them
Yes, seven source types
Data must move in first
Not a database gateway
Usually one database
An audit log you own
Yes, hash-chained
The vendor's
The vendor's
Usually none
Authentication and access control
Single sign-on, roles, tool scopes
Yes
Yes
Usually none
Open-source core you can inspect
Yes, AGPLv3
No
No
Usually

Categories, not named products, as described in Why TDB.

Build or buy

What your team would otherwise build — and keep building.

Connecting one agent to one database takes an afternoon. Making it safe enough for production data, and keeping it that way as databases, clients and the MCP spec move, is a standing commitment. This is the part TDB takes off your roadmap.

  • Read-only, in five SQL dialects

    A check that reads SQL the way each engine does, read-only sessions at the source, and refusal of over-privileged database roles. We published two security advisories for this layer in 2026; your own version would need the same scrutiny.

  • An audit log a reviewer accepts

    Hash-chained entries, refusals and failures included, values in SQL kept out if you choose, verification on demand, retention without deletion, and incremental export to Splunk or S3.

  • Keeping up with MCP

    Four protocol revisions served side by side, so an AI client upgrade doesn't break your integration — and the next revision is our job, not yours.

  • Identity and access

    Sign-in through your identity provider, SCIM provisioning, API keys with rotation, OAuth 2.1 with PKCE for AI clients, roles, tool scopes and rate limits.

  • Your BI tools, unchanged

    A PostgreSQL wire gateway, so Metabase, DBeaver and psql get the same governance and audit as the agents.

  • Patching, forever

    Seventeen security updates published since September 2026, each with what was exposed and what to do. See them all.

Your engineers keep the work only you can do — the agents and what they're for. TDB keeps the plumbing current.

What Lean Mode saves you

Your numbers, our measured saving on large results.

Saved per month––

Uses the measured 34% saving on a 100-row result (10,412 → 6,868 tokens). Agents that mostly ask for aggregates saw about 6% overall in our test, so treat this as the upper end.

Building it yourself

Example values — replace them with your own estimates.

First year––

Compare with a 30-day evaluation and a quote: hello@tdb.asvanlabs.com.

Requirements

Check it against your requirements list.

What ships today and what is on the roadmap, without dates we can't keep. Unless marked, each item is in the commercial edition.

Data stays in your perimeter

Ships

One container on your infrastructure. Your data is never copied, and TDB sends no telemetry. Free edition included.

Air-gapped install

Ships

The licensed image is delivered as a tar bundle; no registry or internet access needed to run it.

Read-only access

Ships

Checked before a statement runs and enforced by the database session. Free edition included.

Audit evidence

Ships

Evidence for SOC 2, HIPAA and EU AI Act reviews: a hash-chained log naming the caller and AI client of every query, refusal and failure, with values in SQL kept out if you choose, verification, sealed retention, Splunk and S3 export.

Identity

Ships

API keys with rotation, JWT, OAuth 2.1 with PKCE. The person behind each request is named in the audit log.

Access control

Ships

Roles (read, readwrite, admin), tool scopes by key or group, rate limits by key or person.

Column and row rules, PII masking

Ships

Rules by key, role or group that withhold or mask columns and filter rows, enforced in the database on REST, MCP and the wire gateway, with the rule in the audit log. Mid-Market. With a rules file, a source it does not name is refused.

Secrets

Ships

Source credentials encrypted at rest, with no plaintext mode; API keys never written to a log.

Existing BI and SQL tools

Ships

PostgreSQL wire gateway for Metabase, DBeaver, psql and JDBC clients.

Agent token cost

Ships

Lean Mode per call or server-wide, free edition included; per API key in the commercial edition.

Observability

Ships

Prometheus metrics and a health check.

Single sign-on and SCIM

Ships

OIDC sign-in on Mid-Market. Identity-provider groups decide roles, column and row rules, and tools, and removing someone ends their access. Tested with Keycloak; ask us about your provider. SAML on request.

Results beyond 1,000 rows

Ships

Page with a cursor, or stream a whole result as NDJSON or CSV, under the same row caps and audit log.

Human approval for sensitive reads

Ships

A policy rule can make a query that reads named columns wait for a person. The approver decides from the CLI or API, never the person who asked, and the audit log records the request, the decision and every run.

Several teams or customers on one deployment

Ships

Tenants on the Enterprise edition: each team or customer has its own sources, keys, rules and hash-chained audit log, chosen by the credential alone. An operator role manages tenants and reads none of their data.

More sources, exporters and sign-in

On request

BigQuery, JSON and NDJSON files, and MongoDB as sources; Datadog and OpenTelemetry for audit export; SAML sign-in. Each is built when a customer needs it, with no published date. Tell us if one decides your evaluation.

The audit log

Not a checkbox. The reason this exists.

When an agent can query production data, "what did it actually do?" stops being a curiosity and becomes an audit question. TDB answers it by default, in a format you can hand to a compliance reviewer.

  • Hash-chained records — a removed or edited entry breaks the chain and is detectable.
  • Refusals are logged too, so a blocked write is evidence rather than silence.
  • Every MCP call names the AI client and protocol version that made it.
  • Retention by sealing, never deletion — segments stay independently verifiable.
  • Incremental export to Splunk or S3, so it lands in the SIEM you already run.
tdb_audit.jsonl
{
  "event": "query",
  "source_id": "3f1c…a90b",
  "sql": "SELECT region, SUM(amount) …",
  "rows_returned": 112,
  "key_hint": "tdbk_a…",
  "mcp_client": "analytics-agent/2.1",
  "mcp_protocol": "2026-07-28",
  "seq": 4127,
  "prev_hash": "9c2f…",
  "hash": "e70a…"
}
{
  "event": "denied",
  "action": "mcp_query",
  "reason": "sql_validation_failed",
  "sql": "DELETE FROM orders …",
  "mcp_client": "analytics-agent/2.1",
  "seq": 4128
}

Proof you can check

Don't take our word for it.

No logos yet, so here is what you can verify yourself today.

Open source core

The community edition is AGPLv3. Read the read-only check, the audit log and Lean Mode line by line. GitHub →

Published advisories

Seventeen security updates since September 2026, each saying what was exposed and what to do. Advisories →

Tested with

Checked end to end against real clients:

Claude CodeClaude DesktopVS CodeMetabaseDBeaverpsqlpgjdbc

And real databases:

PostgreSQLMySQLSQL ServerSnowflake

Editions

Evaluate it free. Upgrade when a second source shows up.

The community edition is a complete, honest version of the idea for one CSV source — enough to answer "does this work for us?" without talking to anyone.

Community

Free

AGPLv3 · self-hosted · one Docker command

  • One CSV data source
  • REST + MCP (query_source), MCP spec 2026-07-28
  • Read-only SQL, 1,000-row ceiling
  • Lean Mode: smaller results for agents
  • Local audit log (NDJSON)
  • Auto schema detection · CLI · OpenAPI
View on GitHub

Try it against your own CSV in a minute.

Nothing to sign up for. If it fits, get in touch about the commercial edition and a 30-day evaluation.

Start with the quickstart Talk to us
The Data-Bridge in 60 seconds

Recorded against the published tdb-community 0.13.0 image: every response on screen is real output. No sound.