Built with

The tech stack, layer by layer

Well-known, widely deployed components at every layer. Optional pieces are pip extras, imported only when a feature that needs them is in use, so a server carries only what it runs.

6layers, from the Console to delivery
36components named on this page
4packages at the core; the rest are extras
3.11 – 3.14Python versions tested
L1

Console

6 components

The admin UI, built once and served by the server from /console.

React 19TypeScriptViteTanStack QueryReact RouterOOpenAPI-typed client
L2

Server

8 components

HTTP, the Management API, MCP and the event stream.

Python3.11 – 3.14FlaskgunicornMCP Python SDKPPyJWTJWT / JWKSCcryptographyFernet at restOpenTelemetry SDKtracing, otel extraBboto3AWS secrets, aws extra
L3

Query engine

4 components

Parsing, guarding, masking and shaping every result.

SsqlglotSQL analysis, maskingDuckDBfiles, Parquet, exportsOopenpyxlXLSXPPyYAML
L4

Store and state

3 components

Configuration, keys, run history and the audit log.

SQLitedefault storePostgreSQLmulti-instance storeRedisshared cache, limits, events
L6

Quality and delivery

10 components

Tested against real systems on every commit.

Uunittest + Hypothesisfuzzed SQL guardVitestPPlaywrightGitHub ActionsPostgres, MySQL, ClickHouse, S3, Keycloak, Vault, syslogruff + mypyDockerghcr.ioKubernetesHelmchart on kind in CICcosignsigned releases, SLSA, SBOMRed Hat UBI 9FIPS provider in CI
Upkeep

How the stack is kept healthy

Dependencies

Few at the core

The core needs four packages: Flask, Werkzeug, PyYAML and openpyxl. Drivers, MCP, JWT, Redis, tracing and AWS are extras you add when you use them.

Install and extras
Versions

Oldest versions tested

CI runs the suite on the lowest allowed version of every core dependency and of the mcp, jwt and redis extras, so every minimum in the package metadata is one that works.

Support and versions
Supply chain

Pinned and signed

Base images pinned by digest and every GitHub Action by commit. Releases signed with cosign, with SLSA provenance and an SPDX SBOM listing what is inside.

Trust center

See the stack at work

Every call through every front door runs on these layers. Watch one go through in the Playground, or see each database and service it connects to.