ContextGuard SQL Agent

Inspiration

Data teams can discover metadata, but analytical agents still need safe and traceable access to schema, ownership, tags, and lineage before generating a query. ContextGuard focuses on that boundary: useful analysis without turning an agent into a catalog or database writer.

What it does

ContextGuard searches a synthetic DataHub catalog; reads entities, schema fields, lineage, and query context; generates explicit SQL with a deterministic planner; validates the SQL; and executes it only against a local synthetic SQLite database. It returns an evidence-backed result and a redacted audit record.

How we built it

We built a Python MCP stdio client, a client-side read-only tool allowlist, a deterministic planner, a SQL safety layer, a SQLite read-only execution layer, and synthetic DataHub fixtures. The official DataHub MCP server was validated locally against a self-hosted DataHub instance with a Reader-only identity.

Challenges

The hard part was proving the negative boundaries: no silent fallback from real mode, no mutation or proposal calls, no writable SQLite path, redacted errors, and clean MCP subprocess shutdown.

Accomplishments

• Real self-hosted DataHub MCP validation.
• Reader-only identity and seven read-only tools.
• Client-side hard blocking of mutation and proposal tools.
• Deterministic local SQLite read-only sales-decline E2E.
• 29/29 offline tests passing.
• Zero mutation or proposal calls in the accepted real run.

What we learned

Metadata context is most valuable when it constrains a query before execution. The client enforces its own allowlist, no-fallback behavior, SQL restrictions, and redaction boundaries.

What's next

Add more explainable synthetic scenarios while preserving the no-mutation contract. Production authorization, real customer data, public deployment, and company database connections remain out of scope.

Safety and privacy

All business data shown is synthetic. The project does not use company data, customer records, production databases, or a network database. Reader credentials remain outside the public repository. Mutation and proposal tools are blocked in the client before any server call.

Known limitations

This is a local MVP, not a production authorization design. The planner is deterministic and does not claim to use an external LLM. No public deployment, browser UI, metadata write-back, or company database access is provided.

Built With

• datahub
• docker
• github
• mcp
• pytest
• python
• sqlite
• wsl