datacharter
This server provides read-only, governed access to data sources via SQL and certified metrics.
List data sources – see configured sources and their types.
List tables – enumerate queryable tables with fully-qualified relation names.
Describe table – inspect columns and types for a given relation.
Run read-only SQL queries – execute SELECT-style queries against the data, with guidance to use LIMIT and fully-qualified names.
List certified metrics – view available governed metrics, their definitions, dimensions, and time-grain support.
Run certified metrics – query governed metrics by name, optionally grouped by dimensions and/or time grain (day, week, month, quarter, year).
Allows querying DuckDB databases as a data source via read-only SQL.
Integrates with GitHub Actions to run data quality tests and schema drift checks in CI.
Allows querying MySQL databases as a data source via read-only SQL.
Enables local agent queries using Ollama-hosted models, with full governance and no data leaving the machine.
Supports any OpenAI-compatible agent for natural language querying of connected data sources.
Allows querying Snowflake data warehouses as a data source via read-only SQL.
Allows querying SQLite databases as a data source via read-only SQL.
DataCharter
Query all your data locally. Hand agents exactly the columns you choose.
A local SQL workspace over files and databases, federated by DuckDB and
governed by charter.yaml. Agents get read-only, PII-masked access to what
the contract grants. Apache-2.0. No paid edition.
datacharter.dev · Docs · Desktop · GovBench · Deploy
Two ways in. Same kernel.
Laptop
Drop a file. Query it. Chart it. An agent sees ••• where PII lives.
uvx datacharter serve # demo workspace, http://127.0.0.1:8321
# or: datacharter init --from && datacharter serve
# or: datacharter init --template life && datacharter serve --localNo terminal: desktop app (beta). macOS (Apple Silicon) or Windows. Unsigned until Apple secrets exist.
brew install datacharter/tap/datacharter # macOS
pip install datacharter # Python 3.11+The workspace is a directory: charter.yaml, queries/, guides/. Commit it.
Secrets stay out. Optional agent: SpaceXAI, Claude Code, Ollama (--local),
or any OpenAI-compatible endpoint.
Related MCP server: RecoSearch
Company
The same binary, on a shared MCP endpoint. Identities live in git, not on our servers. No rows leave your infrastructure.
datacharter mcp --http --host 0.0.0.0 # OAuth env required off loopback
helm install datacharter ./chart \
--set oauth.issuer=... --set oauth.audience=... --set oauth.jwksUri=...
datacharter govbench --json # cite corpus govbench-v1MCP Streamable HTTP (
POST /mcp) with optional OAuth 2.1principals:andgrants:incharter.yaml(default-deny on HTTP)Helm chart and OCI image
Hash-chained audit plus SIEM JSON/OTLP
GovBench: frozen 28-attack corpus, grade A-F
Wrap someone else's MCP server: datacharter mcp --guard "npx -y some-mcp-server".
What the contract enforces
PII default-deny, row filters, plain-English policies (aggregates only),
canaries, a flight recorder, datacharter redteam, access diff on PRs.
CLI reference: docs/cli.md. Security: docs/security.md.
Status: pre-release. V1 in development.
Privacy
Runs on your machine or in your cluster. No telemetry. No DataCharter-operated data plane. Privacy Policy.
License
Available Tools
6 toolsdescribe_tableDescribe tableARead-onlyIdempotent
Show columns and types for one relation (e.g. 'crm.customers').
| Name | Required | Description | Default |
|---|---|---|---|
| relation | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description is consistent with annotations (readOnlyHint, idempotentHint) and adds context that it operates on a single relation. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no unnecessary words. It front-loads the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description lacks details about the return format (e.g., column list). However, the example and annotations help. Still, more completion would be beneficial.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the 'relation' parameter. The description provides an example format but does not fully explain the format or valid values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Show' and the resource 'columns and types for one relation', with an example 'crm.customers'. It distinguishes from siblings like list_sources, list_tables, and query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for examining a table schema but does not explicitly state when to use this tool versus alternatives like query or list_tables.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_metricsList certified metricsARead-onlyIdempotent
List certified metrics — name, what each computes, its dimensions, and whether it supports a time grain. Prefer query_metric over writing SQL when a metric matches the question.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true. The description adds value by specifying the output content: name, what it computes, its dimensions, and time grain support. This is useful behavioral context beyond the safety flags. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the action ('List certified metrics') and includes essential output details plus a usage preference hint. Every part earns its place with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and no output schema, the description effectively communicates the return information (name, computation, dimensions, time grain). The added guidance about query_metric helps the agent decide when to use this tool or query_metric, making the description complete for a simple listing tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema coverage is trivially 100%, so there are no parameter semantics to clarify. The baseline for a zero-param tool is 4, and the description does not need to explain inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description begins with 'List certified metrics' — a clear verb+object. It then enumerates the specific attributes returned: name, what each computes, its dimensions, and whether it supports a time grain. This distinguishes it from sibling listing tools by focusing specifically on metrics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides guidance to 'Prefer query_metric over writing SQL when a metric matches the question', which implies that list_metrics is for discovering available metrics. However, it does not explicitly state when to use list_metrics vs list_sources/list_tables/describe_table, so the usage context is implied rather than clearly defined.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_sourcesList data sourcesARead-onlyIdempotent
List configured data sources with their types.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so the agent knows it is safe. The description adds that it lists 'with their types', providing a bit more context about the output beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single, clear sentence with no unnecessary words. Perfectly concise and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool with no parameters, the description is adequate but could hint at the output format (e.g., returns an array). Since there is no output schema, agents might need more detail on what fields are returned.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so the description does not need to add parameter details. Baseline 4 as per rules for zero parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List') and the resource ('configured data sources') and specifies that types are included. This differentiates it from siblings like 'list_tables' and 'describe_table'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool over siblings. However, the context and name imply it is the starting point for exploring data sources.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_tablesList tablesARead-onlyIdempotent
List all queryable tables with their fully-qualified relation names.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, indicating safe, read-only behavior. The description adds that it returns fully-qualified relation names, providing useful output context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no unnecessary words. It is concise and immediately communicates the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, no output schema, and annotations covering safety, the description fully informs the agent. It states the action, scope, and output format, which is sufficient for selecting and invoking the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so baseline is 4. The description explains the output format ('fully-qualified relation names'), adding meaning about what the tool produces.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('all queryable tables') and states the output ('fully-qualified relation names'). It clearly distinguishes from sibling tools like 'describe_table' (describes a specific table) and 'query' (queries data).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when you need to discover available tables, but it does not explicitly state when to use this tool versus alternatives like 'list_sources' or 'describe_table'. Guidance is minimal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
queryRun read-only SQL queryARead-onlyIdempotent
Run a read-only SQL query and return rows. Use fully-qualified relation names. Prefer LIMIT for exploration.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true. The description adds the key behavioral detail 'return rows' and confirms 'read-only.' Since annotations cover safety traits, the description adds moderate value but no extra on auth, rate limits, or side effects. A 3 is appropriate given annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. First sentence: purpose + output. Second sentence: best practices. Every word earns its place. Front-loaded with the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description covers purpose, output, and usage tips. It could mention error handling or query size limits, but given low complexity, it is adequately complete compared to sibling descriptions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 0% description coverage for the single 'sql' parameter. The description compensates fully: it clarifies the parameter is a SQL query, must be read-only, and advises using fully-qualified names and LIMIT. This adds essential meaning beyond the raw schema type.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs a read-only SQL query and returns rows. It uses specific action verbs ('Run') and resource ('SQL query'). It distinguishes from sibling tools (list_sources, list_tables, describe_table) which handle metadata, while this tool executes arbitrary SQL.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance: 'Use fully-qualified relation names' and 'Prefer LIMIT for exploration.' This helps agents write safe queries and understand exploration use. It doesn't explicitly exclude DDL/DML, but the 'read-only' hint covers that. Could mention when to prefer sibling tools, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_metricRun a certified metricARead-onlyIdempotent
Run a certified metric by name and return its governed result. Optionally group by dimensions (by) and/or a time grain.
| Name | Required | Description | Default |
|---|---|---|---|
| by | No | ||
| name | Yes | ||
| grain | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint, so the safety profile is covered. The description adds 'governed result' and optional grouping, providing minimal extra behavioral context but no additional details such as permissions, rate limits, or side effects. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the main purpose and return value, then a concise mention of optional parameters. No filler, no redundancy. The structure is clean and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only metric runner, the description covers the essential workflow: run a certified metric, optionally grouped. With no output schema, it does not fully describe the return structure, but 'governed result' gives a reasonable hint. It is adequate for correct invocation, though a bit more detail about the response would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does by mapping `name` to the metric name, `by` to dimensions, and `grain` to a time grain. This adds meaning beyond the bare schema, though it lacks examples or detailed value constraints. The enum for grain is already in the schema, so the description fills the gap reasonably well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses the specific verb 'run' with the resource 'certified metric' and states it returns a governed result. This clearly distinguishes it from sibling tools like 'list_metrics' (which lists) and 'query' (which likely runs ad-hoc queries). The scope is explicit and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for running certified metrics by name and optionally grouping, but it does not explicitly state when to use this tool versus alternatives like 'query' or 'list_metrics' nor does it mention when not to use it. It provides context but lacks explicit exclusions or named alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.24.15- Added
list_metrics - Added
query_metric
4 tool updates
- First observed
describe_table - First observed
list_sources - First observed
list_tables - First observed
query
TDQS
Scored across 6 tools
Each tool targets a distinct action: enumerating sources, tables, or metrics; describing schema; running raw SQL; or running a governed metric. The only near-overlap, query vs query_metric, is explicitly disambiguated by naming and by the guidance in list_metrics.
Tool names follow a predictable verb_noun pattern: list_* for enumeration, describe_table for schema inspection, and query/query_metric for data retrieval. Naming is uniform and intuitive.
Six tools is a well-scoped number for a data discovery and querying server. Each tool covers a necessary step in the workflow—source discovery, table discovery, schema inspection, raw query, metric discovery, and metric query.
The tool set provides a complete read-only analytics flow: discover sources and tables, inspect schemas, run SQL, list certified metrics, and query those metrics. There are no obvious missing operations for its stated purpose.
Maintenance
Related MCP Connectors
Query your warehouse or a CSV with Claude/ChatGPT over MCP, governed by table-level ACL + audit.
Query your org's data in natural language — read-only MCP access to SQL, NoSQL, files & warehouses.
Query, join, profile, clean and convert CSV/JSON/Parquet with server-side DuckDB over MCP.
Draxlr's remote MCP server connects AI assistants to your SQL databases and dashboards. Explore schemas, run read-only queries, manage saved queries and dashboards, and export results, all with row-level security so each user sees only their own data.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceRead-only MCP server for SQL databases (SQL Server, Postgres, SQLite) with multi-server support and three-layer safety using AST validation and linting.MIT

RecoSearchofficial
AlicenseNot gradedqualityCmaintenanceA deterministic MCP server that governs read-only queries across multiple data sources, returning answers with full provenance (every row cited) or a typed refusal, ensuring LLM answers are traceable and contract-enforced.1Apache 2.0- AlicenseNot gradedqualityCmaintenanceRead-only MCP server for SQL databases (SQLite/PostgreSQL) that enables listing tables, describing schemas, and executing SELECT queries with safety guardrails.MIT
- AlicenseAqualityCmaintenancePay-per-call MCP server for market data with USDC micro-payments, featuring unique ML market-regime forecasts, news catalyst radar, and a live-verified algorithmic trading track record.1247 npmMIT