Nobody wants to import your library

A developer released schemagate, an open-source Python library that selects only the database schema objects a given caller is authorized to see before a question is sent to a language model. Across the library's bundled benchmark, the average prompt drops to 631 tokens from 2,583 for the full schema, a 75.6% reduction, and the project ships a CLI, a browser-based studio, and an MCP server exposing select_schema, list_objects and describe_object tools.

I wrote a Python library. Then I watched people not use it. Not because they disagreed with it — the thesis landed fine. The problem was the shape of the ask. Nobody says "I'd like a Catalog object." They say "my agent keeps showing the model tables this user isn't allowed to read, and I already have an agent." Between those two sentences sits an afternoon of wiring that nobody has budgeted. So most of the work on schemagate since the first release has gone into surfaces that require importing nothing. Here are five, in the order of how little you have to change to use them. select used to print a table list. It felt like a demo of an idea rather than a thing that does work. pip install schemagate schemagate demo "which customers owe us money" --answer --provider anthropic --model <model-id schemagate 0.1.42 -- demo schema, 42 objects, caller demo:analyst roles=- hr compensation is restricted to the 'payroll' role. which customers owe us money 9 of 42 objects selected main.crm customer main.v customer balance main.crm contact main.crm opportunity main.sales order main.sales quote main.core party main.core address main.sales order status -- SQL written by Anthropic / <model-id , from 9 tables SELECT c.id, p.display name, v.account number, v.invoiced, v.paid, v.invoiced - v.paid AS balance due FROM v customer balance v JOIN crm customer c ON c.id = v.id customer JOIN core party p ON p.id = c.id party WHERE v.invoiced v.paid id display name account number invoiced paid balance due 1 Northwind Trading ACC-1001 33960.0 22080.0 11880.0 2 Kellner GmbH ACC-1002 8760.0 3000.0 5760.0 Nine objects instead of forty-two, and hr compensation was never a candidate because this caller doesn't hold payroll . Across the benchmark that ships with the library the average prompt is 631 tokens against 2,583 for the whole schema — a 75.6% cut. python tests/bench.py prints that table back at you. Question in, rows out, no database to set up — demo runs against a bundled 42-object schema. To point at your own, the sibling command takes a URL: schemagate select --url postgresql://localhost/app "which customers owe us money" --answer , same flags. Drop --provider and you get no model call at all: it prints a prompt for you to paste into whatever chat window you already pay for, and schemagate select --url ... --sql "SELECT ..." runs what comes back. The selection step itself never calls a model in any of these paths. If the schemagate script isn't on your PATH — a --user install, a container, a locked-down box — python -m schemagate is the same CLI, so every command here works as python -m schemagate demo ... , python -m schemagate select ... and so on. schemagate studio --url postgresql://localhost/app python -m schemagate studio --url postgresql://localhost/app same thing, no PATH needed A local page where you type a question, flip the caller's roles, edit hints, and watch what reaches the prompt and what doesn't. The value isn't the UI, it's the negative space: the panel that lists what was withheld from this caller, next to the DDL that was actually sent. The same page runs publicly on six bundled schemas at ashishsinha1602.github.io/schemagate https://ashishsinha1602.github.io/schemagate/ , in your browser, no server behind it. The selector there is a JavaScript port of the Python one, and a test runs both across 1,789 cases and fails the build unless the object lists, the selection reasons and the scores to ten decimal places are identical. pip install 'schemagate mcp ' SCHEMAGATE DATABASE URL=postgresql://localhost/app python -m schemagate.mcp server Five tools. The three you'll actually call are select schema , list objects and describe object , each taking principal and roles ; refresh catalog and health are there for the operator. Leave the identity arguments out and the caller is anonymous and sees only unrestricted objects. A restricted object and a nonexistent one return the same error, so existence doesn't leak through the error message. The part I spent the most time on is that it doesn't die. The index lives in memory after startup, so the database going away doesn't take the server with it: select schema keeps answering from the last good reflection and refresh catalog reports the failure instead of raising. Every tool catches everything and returns {"error": ...} , because one bad request shouldn't end the session for the other clients. A test throws 25 kinds of garbage — None , a hundred thousand x es, '; DROP TABLE users; -- , five hundred fire emoji, a:b:c:d where an identity should be — at every argument of every tool, 125 cases in all, and after each one checks that a known-good request still returns the right answer with the right restrictions. Another does the same through a real MCP client over stdio. python from schemagate.integrations.langchain import SchemagateRetriever, prompt fragment retriever = SchemagateRetriever catalog=cat, top k=6, principal=Principal "okta:jdoe", roles={"finance"} chain = retriever | RunnableLambda prompt fragment | your sql prompt | llm The principal goes in the constructor, not the call. Build one retriever per caller. A chain cannot forget to pass identity if the retriever already holds it, and "forgot to pass identity" is exactly the bug class this library exists to remove. For a shared endpoint rather than a desktop: a Resource Manager stack that stands up an Always-Free-eligible VM running the MCP server against an Autonomous Database it creates, or one you already have. The deploy button hands OCI a zip built from the repo and attached to every release — no Marketplace listing, no partner membership in the way. On first boot the instance principal calls OCI Generative AI to write a one-sentence description of every table and view. No API key is stored anywhere, and the prompts — schema metadata only, never rows — stay inside your tenancy. That matters more than it sounds: on the bundled 42-object schema, recall@6 is 100% when the question uses words that look like column names and 50% when the same question is phrased the way a person in the business would phrase it. Descriptions are what closes that gap. Three things I'd rather say here than have you find out: The MCP endpoint has no authentication of its own. Identity arrives as the principal on each call, which means anyone who can reach the port can claim any identity. allowed cidr and ssh cidr have no defaults and the stack refuses 0.0.0.0/0 outright — that is the whole security model, and it is on you. The Studio on that instance binds 127.0.0.1 and you tunnel to it over SSH. It has no login; anyone who could reach it could read the entire schema. And the stack has not been applied end to end yet. The Cloud Shell route has — pip install --user 'schemagate oracle,oci ' in OCI Cloud Shell, about a minute, no VM, no Terraform — so if you want the certified path, start there. cat = Catalog .bootstrap "postgresql://localhost/app" cat.restrict "hr compensation", "payroll" sel = cat.select "revenue by month", principal=Principal "okta:jdoe", roles={"finance"} sel.prompt fragment Ten lines if you want them. But I've stopped assuming anyone wants them, and the four surfaces above have had more of my time than the API has. pip install schemagate . Apache-2.0, and the repo is ashishsinha1602/schemagate https://github.com/ashishsinha1602/schemagate . Oracle is certified live on 26ai; SQL Server and MySQL aren't, only because I haven't had an instance to run scripts/certify dialect.py against. If you have one, that script takes one command and I'd like to know what it says.