QueryAPIGate began as SQL2API: a way to turn a SQL query into an endpoint without writing the same controller for the fortieth time. It grew into a governance layer because every team that exposed data also needed to say who could ask, what they could see, and prove it afterwards. Then AI agents arrived with the same questions.
Writes are opt-in per connection or key, narrowed to specific operations, and for agents gated by a person. The default is the safe one.
Features under the compatibility promise do not break in a minor release. Experimental ones are labelled in the product and the changelog, and may change.
CI runs against real PostgreSQL, MySQL, ClickHouse, S3 and Keycloak, upgrades from the previous release, and checks the oldest supported dependencies. Every system it connects to, and how each is tested, is on Integrations.
Architecture decision records, a threat model, a prioritised backlog and 65 how-to guides live in the repository next to the code. The components are on Built with.
A SQL query becomes an endpoint, without writing the controller. Released under MIT up to 0.6.1.
Releases from 0.7.0 move to FSL-1.1-MIT.
MCP write tools queue in the Console for an administrator to approve or reject.
Tracing, per-key limits and quotas, a tamper-evident audit log, a Helm chart, configuration as code.
Eight features graduate, releases are signed from 0.31, live events are stable from 0.34.
The code is unchanged; only the licence is.
The compatibility promise without the beta label.
Open source under Apache-2.0, since 0.39. The code is unchanged; only the licence is.
NOTICE file carries the copyright notice.Issues, discussions and pull requests are on GitHub. The contributing guide covers the test suite, ruff, mypy and how integration tests against real databases are switched on.
{{ issues }} open issues{{ forks }} forks