Questions people ask first

A server that sits between your databases and everything that asks them for data. You write a SQL query once; it becomes a REST endpoint, an MCP tool for AI agents, a live event stream and a scheduled export. Every call checks who is asking, what they may see and what they may change, and leaves a record.

Yes. It is open source under Apache-2.0 since 0.39: use, modify and redistribute it for any purpose, commercial or not, including offering it as a service. Versions 0.7.0 through 0.38.0 were released under FSL-1.1-MIT.

On your own infrastructure. It is self-hosted: a pip package, a signed Docker image and a signed Helm chart. Your databases are reached with the credentials you configure, from inside your network.

Python 3.11 or later and one process. The store is a SQLite file by default; several instances share PostgreSQL and Redis instead. Java is needed only for H2 and generic JDBC, and the -h2 image includes it.

pip install queryapigate, then queryapigate examples load and queryapigate serve. That installs four worked APIs on a generated database, with collections, roles and a scoped key for each. Or try the requests in your browser first.

Rows pass through and are not kept. Results are streamed or paged to the caller after masking, and written nowhere unless you turn on the response cache or an export. Parameter values are bound, never logged and never put in a trace, and the access log leaves query strings out.

No. Callers run the saved queries their key or role is granted, with typed parameters that are bound, never spliced into the SQL. Ad-hoc SQL through /execute_sql exists only for keys you grant it, is read-only unless allowed, and is confined to the tables you list.

Encrypted at rest under a key you can rotate, or not stored at all: reference them as ${VAR}, from a file, or from Vault and AWS secret managers, or use short-lived credentials from Vault.

No. Those certify an organisation running a service, and QueryAPIGate runs inside yours, under your controls. What it provides is the evidence your own assessment needs: a security pack, a threat model, a data map, a signed audit trail, FIPS-approved cryptography and releases you can verify.

Yes. Every change is in an audit log where each entry is chained to the one before, so an edited or deleted entry is detectable, and the log streams to your SIEM over syslog with mutual TLS or OTLP.

Those expose your tables and let callers compose queries. QueryAPIGate exposes queries you wrote: callers pass typed parameters and nothing else. It also works across several database engines and files, and governs AI agents with the same rules.

No, it complements one. An API gateway routes HTTP traffic to services you have built. QueryAPIGate is the service: it turns saved SQL into governed endpoints, and can sit behind your gateway like any other upstream.

You can, and for business logic beyond what SQL expresses you should. For data access, a hand-rolled API means writing auth, scoping, parameter validation, rate limits, logging and an audit trail for every endpoint. Here those come with every saved query.

Snowflake works through generic JDBC, which is experimental. Native BigQuery and Redshift support is not shipped.

Yes. The MCP server publishes your saved queries as tools any MCP client can call: Claude, Copilot, Cursor or your own agent. An agent meets the same grants, masking, limits and audit as any application, enforced in the server rather than the prompt.

Only through a saved query whose author marked it for agents, for a key allowed to write. Each write is held until a person approves it in the Console, runs once with exactly the arguments shown, and rolls back if it touches more rows than allowed.

No. Agents authenticate to QueryAPIGate with a key or an OAuth token; QueryAPIGate reaches your databases with each connection’s own credentials and never passes a token or password on.

Start with one instance and a SQLite store. For more, run several instances on a shared PostgreSQL store with Redis, so rate limits, quotas, the cache and live events are counted across all of them. That setup runs with three real servers in CI on every change.

Not without notice. REST endpoints and response shapes, CLI commands, environment variables, the storage format, grant fields, the saved-query format, the MCP tool contract and error codes are under the compatibility promise. Experimental features are labelled wherever you meet them.

Today: H2, generic JDBC and Trino connections, OpenTelemetry tracing, and secrets and credentials from AWS. They work, sit outside the compatibility promise, and are marked in the docs, the Console and the changelog.

Questions and bugs go to the GitHub repository. Security issues should be reported privately, as the security policy describes, not in a public issue.