live wire
▸Snowflake agent evals can pin judge versions; unpinned metrics may roll forward and shift scoresSnowflake▸ThoughtSpot makes Spotter 3 default for new instances; it requires download rights and always shares query data with an LLMThoughtSpot documentation▸MotherDuck adds image classification and object location to prompt_jev(), returning typed SQL outputs with confidence scoresMotherDuck▸BigQuery conversational analytics adds Montréal and Toronto; mixed-region agents still default to globalGoogle Cloud Documentation▸Fabric enables Azure OpenAI Copilot access by default, but OpenAI-subprocessor and cross-region processing/storage switches remain offMicrosoft Learn▸Snowflake Cortex Agents now continue by default when named tools are inaccessible, emitting warnings instead of failing the runSnowflake documentation▸Databricks Genie One can use group memberships to tailor answers, while Unity Catalog remains the access-control boundaryDatabricks documentation▸Fabric data agents can query Power BI models with Read alone; Build and workspace access are unnecessaryMicrosoft Learn▸Fabric data-agent Git configs expose column flags, but selecting a table still includes every columnMicrosoft Learn▸Google Data Agent Kit offers remote Spark kernels, but notebook exports can still move results into local Pandas or ArrowGoogle Cloud Documentation▸Cube says production analytics agents need explicit partial-result states, caller-filtered model search and durable artifactsCube▸Thinking Machines names Bridgewater behind ReViSQL-K2.6, citing 92.97% SC-16 accuracy at 15% of frontier-model costThinking Machines Lab▸AWS says a mismatched data/tool/prompt release cut its Field Sales agent pass rate from 78% to 38% in pre-productionAWS Artificial Intelligence Blog▸NL2SQL Multi-Agent ships evaluation artifacts across BIRD, CSpider, Archer and KDD DataSpace—but no software licenseGitHub▸Snowflake agent evals can pin judge versions; unpinned metrics may roll forward and shift scoresSnowflake▸ThoughtSpot makes Spotter 3 default for new instances; it requires download rights and always shares query data with an LLMThoughtSpot documentation▸MotherDuck adds image classification and object location to prompt_jev(), returning typed SQL outputs with confidence scoresMotherDuck▸BigQuery conversational analytics adds Montréal and Toronto; mixed-region agents still default to globalGoogle Cloud Documentation▸Fabric enables Azure OpenAI Copilot access by default, but OpenAI-subprocessor and cross-region processing/storage switches remain offMicrosoft Learn▸Snowflake Cortex Agents now continue by default when named tools are inaccessible, emitting warnings instead of failing the runSnowflake documentation▸Databricks Genie One can use group memberships to tailor answers, while Unity Catalog remains the access-control boundaryDatabricks documentation▸Fabric data agents can query Power BI models with Read alone; Build and workspace access are unnecessaryMicrosoft Learn▸Fabric data-agent Git configs expose column flags, but selecting a table still includes every columnMicrosoft Learn▸Google Data Agent Kit offers remote Spark kernels, but notebook exports can still move results into local Pandas or ArrowGoogle Cloud Documentation▸Cube says production analytics agents need explicit partial-result states, caller-filtered model search and durable artifactsCube▸Thinking Machines names Bridgewater behind ReViSQL-K2.6, citing 92.97% SC-16 accuracy at 15% of frontier-model costThinking Machines Lab▸AWS says a mismatched data/tool/prompt release cut its Field Sales agent pass rate from 78% to 38% in pre-productionAWS Artificial Intelligence Blog▸NL2SQL Multi-Agent ships evaluation artifacts across BIRD, CSpider, Archer and KDD DataSpace—but no software licenseGitHub
nl2sql.ai
releaseNEW ENTRANT

Datatide launches self-hosted conversational BI with an unusually explicit security boundary

The new MIT project combines natural-language analysis, scheduled reports, Skills and MCP—but plainly says its guard is lexical and its permissions stop at the dataset.

Datatide’s capabilities contrasted with its explicit security limits.
AI-generated illustration
By The Tools Desk· Sep 6, 2026the quick take — two AI hosts go live when you do

Datatide arrived on GitHub on September 6 as an MIT-licensed, self-hosted conversational-BI project. Its initial 0.1.0 package describes a TypeScript service built on the Pi coding-agent SDK, DuckDB and the Model Context Protocol SDK, with Node 22.19 or newer required. The repository had no tagged release, stars or forks when checked, so this is an entrant to watch—not adoption evidence. (repository metadata; package manifest)

More than a chat-to-SQL demo

The implemented surface is broad for a first public version. Datatide accepts CSV, Parquet and Excel uploads, and mounts PostgreSQL read-only through DuckDB. Users can ask multi-step questions across authorized datasets, generate ECharts visualizations, export answer tables, and create scheduled Markdown reports. Administrators can grant dataset access, inspect token usage and audit logs, mount external SKILL.md procedures, and configure stdio or Streamable HTTP MCP servers. (README)

That combination matters because it packages three objects that small NL2SQL repositories often leave separate: the data connection, the reusable analysis method, and the recurring report. Datatide’s default agent tools expose dataset metadata, guarded SQL execution, chart creation, skill loading and an MCP gateway. The project also documents a REST surface for dataset grants, session ownership, report history and administrative audit access. (README)

The useful part is the warning label

Datatide does not present those features as a finished enterprise control plane. Its own security section says authorization is dataset-level, with no row- or column-level policy. It also says the SQL guard is lexical rather than a full abstract-syntax-tree parser, even though it restricts execution to one SELECT or WITH statement and blocks DDL, DML, PRAGMA, ATTACH, file-reading functions, unauthorized objects, excessive rows and long runtimes. PostgreSQL is attached read-only, while external MCP services and configured models can still create their own network behavior. (README)

That disclosure gives evaluators a concrete acceptance plan. Before connecting sensitive data, test nested writes and dialect edge cases against the lexical guard; verify that two users with different dataset grants receive different object lists; and treat any requirement for tenant, row or column isolation as unmet until the project implements and tests it. Those are not hypothetical enterprise extras—they are the boundary the maintainer explicitly documents today. (README)

Datatide is therefore notable less for claiming a novel model than for shipping a coherent, inspectable workflow and naming where trust stops. The next evidence to watch is a tagged release, independent users, stronger SQL parsing, finer-grained authorization and published live-evaluation results. (repository metadata; README)

sources

Filed by The Tools Desk. Corrections: desk@nl2sql.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk