KarhutlaSQLAnalytical SQL with governance built into the server

Arrow Flight SQL on DuckDB — a single Go binary for on-prem and air-gapped environments, with SSO, masking, row-level security, WORM access history, and signed reports.

⚡

DuckDB speed, Arrow end to end

A columnar DuckDB engine whose results stream as Arrow to JDBC, ADBC (Python, Go, R), and the CLI — no row-by-row conversion.

Your first query

🛡️

Governance in the server

Default-deny privileges per catalog, schema, and table; tag-based masking and row-level security rewritten in the server, so no client can bypass them.

Masking & RLS

🔑

SSO and session control

OIDC (Keycloak, Entra ID, Okta), TLS/mTLS, kill-session that applies across instances, rate limits, queues, and per-team quotas.

SSO login

📜

Audit trail for regulators

Per-column PII access history in WORM Parquet, Ed25519-signed report runs anyone can re-verify, and data-subject access answers (Indonesia PDP law).

Signed reports

✅

Data quality and catalog

Great Expectations results gate report runs; table metadata, classification tags, and DQ status sync to Unity Catalog OSS for discovery.

Data quality

🤖

Ready for AI agents

A built-in MCP server lets agents such as Claude or Copilot query data under the same privileges, masking, and ai_sandbox limits as everyone else.

AI agents via MCP

🔌

Connect the way your tools talk

Besides Flight SQL, a PostgreSQL wire listener for psql, Power BI, and ODBC, and an HTTP endpoint that streams Arrow to web apps and notebooks — all under the same rules.

PostgreSQL & HTTP

🤝

Share data with outside parties

A Delta Sharing server gives regulators and partners read-only tables through pandas, Spark, or Power BI — masked and audited per recipient, no database account needed.

Delta Sharing

⏱️

Automate reports and marts

Cron-scheduled signed report runs and atomic materialized-table refreshes, each under its own policy-granted identity; plus PII auto-classification to find untagged columns.

Scheduled jobs

🖥️

A web UI in the box

A browser SQL editor with your readable tables, results and CSV export, sessions, query history, and jobs — embedded in the server, governed like the API.

Web UI

🧭

Vector search (preview)

Store embeddings as FLOAT[n] and find nearest rows with SQL, optionally accelerated by an HNSW index — under the same row filters and masking.

Vector search

🗂️

Query SQLite files too (preview)

Attach application SQLite files read-only as extra catalogs and join them with your warehouse, governed and audited like every other table.

SQLite catalogs

How it works

Every statement — from a BI tool, a notebook, a Postgres client, a web app or the built-in web UI, a scheduled job, a sharing recipient, or an AI agent — takes the same path through the server before it touches data:

Flight SQL (JDBC · ADBC · CLI)   PostgreSQL wire   HTTP Arrow   Delta Sharing   MCP   jobs
   │                                   │                │            │           │      │
   └─────────────── all become Flight SQL statements with the caller's identity ────────┘
   ▼
┌─ karhutlasql-server ──────────────────────────────────────────────┐
│ 1. Authenticate   local password / OIDC token, session, rate limit │
│ 2. Govern         privileges → masking → row filter → limits       │
│ 3. Execute        resource-group queue → quota → result cache      │
│ 4. DuckDB         stream Arrow results back to the client          │
│ 5. Record         audit · per-column access history · metrics      │
└────────────────────────────────────────────────────────────────────┘
   ▼
DuckDB file  ·  DuckLake (Postgres + MinIO)  ·  SQLite files (read-only)  ·  WORM archive

The interactive architecture diagram shows every component and integration (Keycloak, Vault, Great Expectations, Unity Catalog, the PostgreSQL and HTTP listeners, Delta Sharing, scheduled jobs) with links to the source code.

Choose your path

I want to…	Start with
Decide whether KarhutlaSQL fits my team	Why KarhutlaSQL?
Try it on my laptop in five minutes	Quick start
Connect Python, DBeaver, or an application	Tutorial 2 · Tutorial 3
Connect psql, Power BI, ODBC, or a web app	Tutorial 12: PostgreSQL & HTTP
Protect PII columns	Tutorial 4: masking & RLS · auto-classification
Share tables with a regulator or partner	Tutorial 13: Delta Sharing
Schedule reports and refresh marts	Tutorial 11: scheduled jobs
Give people a query tool in the browser	Tutorial 14: web UI
Search embeddings or join SQLite files	Tutorial 15: vector search · Tutorial 16: SQLite
Run it in production	Installation · Kubernetes · Configuration
Understand the design	Core concepts · Architecture diagram