Compare

Where QueryAPIGate fits, and where something else does

The tools below are good at what they do. This page is about the shape of the problem each one solves, so you can pick the right one quickly.

The one-line difference

Others expose tables. QueryAPIGate exposes queries you wrote.

Most data-API tools expose tables and let the caller compose the query. QueryAPIGate exposes queries you wrote, and governs who may call each one, what rows and columns they get back, and leaves a record. It is for the moment you want to hand data to a partner, a pipeline or an AI agent without handing them your schema.

Side by side

Eight dimensions, five tools

Scroll sideways on a narrow screen; the dimension column stays put.

DimensionQueryAPIGateHand-rolled APIPostgREST / SupabaseHasuraDirectus
Unit of exposureA SQL query you wroteWhatever you codeTables and viewsTables, via GraphQLCollections, via REST/GraphQL
Caller composes the query?No. Typed parameters onlyNoYes, URL filtersYes, GraphQLYes, query params
DatabasesPostgreSQL, MySQL, SQLite, DuckDB, ClickHouse, + files, MongoDB, JDBCAnyPostgreSQLPostgreSQL, others via connectorsSeveral SQL
Row and column policyGrants, values bound from token claims, masking traced through SQLYou write itDatabase RLS and grantsPermission rules per roleRole and field permissions
AI agentsMCP server, OAuth 2.1, descriptions, approved writesYou build itCommunity MCP serversCommunity / PromptQLMCP via extension
Exports and eventsScheduled incremental exports to S3/GCS/R2, SSEYou build itRealtime via SupabaseSubscriptionsFlows and webhooks
DeploymentOne pip install, SQLite store; or several instances on Postgres + RedisYoursSingle binary / cloudDocker / cloudNode / cloud
LicenceApache-2.0—MIT / Apache 2.0Apache 2.0 (core)BSL

Feature summaries of other projects are from their public documentation at the time of writing and may be out of date. Corrections welcome on GitHub.

Decision

Which one, in one glance

✓Pick QueryAPIGate when

The SQL is the contract: you want callers to run this query, not explore your tables.
Callers are outside your trust boundary: partners, pipelines, AI agents.
You need grants, masking and an audit trail without writing them per endpoint.
Your data is in several engines, or in files on S3.
You want one pip install and a SQLite file to start.

→Pick something else when

Your frontend needs flexible, client-composed queries over your own tables: PostgREST, Hasura.
You want a headless CMS with content editing: Directus.
The API needs business logic beyond what SQL expresses: write the service.
You need Snowflake, BigQuery or Redshift today (on the backlog, not shipped).
In practice

Alongside, not instead

QueryAPIGate sits in front of databases you already run. Teams use it next to PostgREST (internal app traffic there, partner and agent traffic here), behind an existing API gateway for TLS and routing, and under Airflow or cron for scheduled deliveries. The Management API means it can be configured from the same place as the rest of your infrastructure.

Next toPostgRESTInternal app traffic there, partner and agent traffic here.
BehindYour API gatewayTLS and routing stay where they are.
UnderAirflow or cronScheduled deliveries on your existing schedule.