Skip to content
DATAPILOT
Sign in

How it works

A supervised team, measured on a public benchmark.

DataPilot turns single-call text-to-SQL into a LangGraph team: a planner, a schema linker, three parallel SQL strategies, a guard and read-only executor with a repair loop, a voting verifier, a browser-side Python analyst, a chart agent and a narrator whose numbers are checked. Each addition is measured in the ablation on the Benchmarks page.

The agent graph

Input guardPROMPT GUARD 2 + RULESPlanner1–4 STEPSClarifyINTERRUPT()Schema linkerBM25 · VECTORS · VALUESDirectQWEN 27BPlan → SQLQWEN 27BFew-shotGEMINI FLASHGuard → executorREAD-ONLY · REPAIR ≤ 2Confirm> 100K ROWSVote + verifierADAPTIVE KAnalystPYODIDE IN BROWSERChartVEGA-LITE SUBSETNarrator → groundingEVERY NUMBER CHECKED

Dashed crimson = human checkpoints (LangGraph interrupt → resume). Green = guards.

Stack at $0

  • Web — Next.js on Vercel Hobby: Auth.js, a JWT-minting proxy, the Pyodide worker, Vega-Lite.
  • API — FastAPI + LangGraph in one Docker container on Render free (512 MB), read-only SQLite demo databases baked in.
  • Models — Gemini Flash / Flash-Lite and Groq Qwen 27B free tiers, Prompt Guard 2; model ids are env vars.
  • Data — Neon Postgres for threads, traces, caches and the quota ledger.
  • Evals — BIRD Mini-Dev in GitHub Actions; traces in the shared trace.v1 format for AgentForge.

Why it's measured

Linking, candidates, repair and verification each cost calls. The ablation (C0 single call → C4 full + adaptive) shows what each one buys in execution accuracy and what it costs at list price, so the trade-off is a chart, not a claim.

Guardrails, in order of defense.

  1. 01

    SQL guard

    sqlglot parses every statement: exactly one SELECT (or WITH … SELECT), no DDL/DML/PRAGMA/ATTACH, no dangerous functions, allow-listed tables, bounded recursion, no unconditioned cross joins on big tables, LIMIT ≤ 1,000.

  2. 02

    Read-only engine

    SQLite opened with mode=ro&immutable=1, PRAGMA query_only=ON and an authorizer that only allows reads. The files are read-only in the container. Even a guard bug can't write.

  3. 03

    Cost checkpoint

    EXPLAIN QUERY PLAN estimates scanned rows; above 100,000 the graph pauses and asks you — run, narrow down, or cancel.

  4. 04

    Sandbox

    Model-written Python runs in Pyodide in a Web Worker in your browser. fetch, XHR, WebSocket and importScripts are replaced before user code; packages are frozen; 10-second kill switch.

  5. 05

    Grounding

    Every number in the answer must appear in the results or be a derivation (difference, percent change, ratio, total) computed by code. Otherwise: one rewrite, then the sentence is removed — and you're told.

  6. 06

    Budgets

    ≤ 4 plan steps, ≤ 3 candidates, ≤ 2 repairs each, ≤ 25 LLM calls, ≤ 60K tokens and ≤ 90 s per question. Providers fall back on 429s; a circuit breaker opens after 5 failures.

  7. 07

    Privacy

    Personal-data columns are masked in docs and never sent to a model as samples; traces are redacted before export. Guests get their own rate-limited identity.

  8. 08

    Locked profile

    Prompts live in a versioned profile that AgentForge can optimize — but the guards, limits and PII policy are locked in code and rejected if a profile tries to set them.

Built to be evaluated.

Every run emits a trace.v1 record and loads a versioned profile.v1. An eval adapter CLI runs case.v1 files against fresh database copies, with red-team seed overrides (injection strings in rows, a canary table) — so a separate platform, AgentForge, can score, attack and optimize DataPilot without touching its guards.