Release notes, design notes and performance reports. https://anantharajuc.github.io/QueryAPIGate-website/Blog.dc.html 2026-10-31T12:00:00Z QueryAPIGate https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=the-30-percent-in-the-build 2026-10-31T12:00:00Z

QueryAPIGate's Docker image ran Python about 30% slower per CPU than other builds of the same Python. We found why, measured what fixing it is worth at the gateway (less than 30%), found that the obvious fix came with a security cost, and chose the one that didn't.

https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=every-run-recorded 2026-10-29T12:00:00Z

The Rust data plane served calls faster than QueryAPIGate could record them: at the peak, half the runs never reached the audit trail. An optional ClickHouse run store records every one, in about 13 bytes, with reads in milliseconds at 250 million runs. Experimental, measured, reviewed.

https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=python-decides-rust-serves 2026-10-28T12:00:00Z

A Rust data plane in front of QueryAPIGate's saved queries, with every security decision left in Python: about 8 times the calls a second per core, p99 in single milliseconds, and the audit trail that almost didn't keep up. A prototype, measured and decided go.

https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=one-mysql-six-services 2026-10-25T12:00:00Z

Per-user queries joining across six microservice databases on one MySQL server, through QueryAPIGate: about 1.2 ms added a call, 580-780 calls a second per worker, a ping we didn't know we were paying for, why lookups want one thread, and the isolation gap to close before you rely on table allow-lists.

https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=what-a-governed-call-costs 2026-10-24T12:00:00Z

QueryAPIGate 0.42 on PostgreSQL, measured properly: masking and table allow-lists now cost about 7%, one worker serves 730-875 calls a second, and most of what's left is round trips. The full method, every result with its range, where the time goes, a sizing rule, and what our first two attempts got wrong.

https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=thirteen-releases-to-1-0 2026-10-01T12:00:00Z

Tracing, security headers, per-key limits and quotas, a tamper-evident audit log streamed to your SIEM and a Helm chart. Configuration as code, secrets managers and short-lived credentials, FIPS-approved cryptography. Eight features graduated in 0.30, releases are signed from 0.31, and live events are stable from 0.34. 0.34.1 and 0.34.2 are security fixes for MongoDB connections: upgrade if you use one.

https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=agents-can-write-now 2026-10-11T12:00:00Z

MCP write tools stop being a flat no. An agent proposes a write; it queues in the Console with the exact statement, the key that asked, and the connection it would touch. An administrator approves or rejects it, and both decisions land in the audit log.

https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=why-every-front-door-runs-the-same-eight-steps 2026-10-11T12:00:00Z

REST, MCP, server-sent events and the export CLI all call one engine. Identity, limits, grant, parameters, SQL guard, execution, masking, record: the order is fixed, and a step that fails stops the call with a typed error code.

https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=one-worker-many-threads 2026-10-11T12:00:00Z

/metrics is per process, so gunicorn runs one worker and scales with threads; capacity comes from more instances. Redis then gives you one response cache, one rate-limit budget and one event stream, and if it blinks, limits are never lifted.

https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=sql2api-is-now-queryapigate 2026-10-11T12:00:00Z

The same project, renamed because sql2api was shared by a dozen unrelated projects. A clean break: package, command, environment variables, metrics prefix and Docker image all change, and a server that still finds a SQL2API_* variable refuses to start.