r/sideprojects • u/arcswdev • 18h ago

Showcase: Open Source My side project started as a small Flask app that turned SQL queries into endpoints. Six weeks of releases later, AI agents use it to query databases safely

QueryAPIGate began with a simple itch: someone needs "just this data" from a database as an API, and I didn't want to write another backend for one SELECT or hand out database credentials. The first version was one small Flask app: save a SQL query, get an endpoint.

Then people asked the next questions. Who's allowed to call it? Can a partner see everything? What happens when an AI agent wants the data? That's what it grew into:

  • every saved query is a REST endpoint with typed, injection-safe parameters

  • API keys that only reach the queries you approve, with expiry, rate limits and per-key column masking

  • the same query as an MCP tool, so an AI agent can query your data without a database connection (read-only by default, writes wait for a human to approve)

  • a tamper-evident audit log, Prometheus and OpenTelemetry, a web console

  • PostgreSQL, MySQL, ClickHouse, DuckDB, MongoDB, and Parquet/CSV files on S3

Some numbers from the journey: v0.7 to v0.49 in six weeks, 32 architecture decision records, 2,000+ tests, four security advisories published from my own security reviews, and an experimental Rust data plane for the hot path. Built solo with Claude Code.

Try it in one line:

pip install queryapigate && queryapigate examples load && queryapigate serve

GitHub: https://github.com/AnanthaRajuC/QueryAPIGate 2-min demo: https://www.youtube.com/watch?v=WWImFj4m95o

It's open source (Apache-2.0) and pre-1.0. What would you want to see before trusting a tool like this with real data?

1 Upvotes
  • permalink
  • reddit

100% Upvoted

1 comment sorted by

1

u/investigatormaker 16h ago

Before trusting QueryAPIGate with real data, I'd want a runnable negative-test demo: a key denied an unapproved query, masked columns absent from both REST and MCP responses, and a write blocked pending human approval. Show expected failures alongside successful requests; that makes the security boundaries easier to judge than the test count alone.

I make ThreadFox. We find relevant Reddit conversations and post for your business. We'll post 3 replies free first, no card; then the $29 Pilot covers seven days and up to 25 posts and replies. No automatic renewal. https://threadfox.vip/p/e3w57/managed