SchemaGate moves authorization ahead of text-to-SQL—but it does not replace database policy

SchemaGate 0.1.9 takes a narrowly useful position in the text-to-SQL stack: decide which schema objects a caller may see before retrieving context for the model, not only when the generated query reaches the database. The Apache-2.0 Python package reached PyPI on September 9 after its initial 0.1.0 upload on September 7, according to PyPI’s release metadata.

That order matters. In the project’s example, a caller without a payroll role never has hr_compensation placed in the model prompt; adding the role makes it eligible for retrieval. The project README says the selector applies identity constraints during initial ranking and foreign-key expansion, and returns the same error for a restricted object and a missing one through its MCP server.

What the release actually provides

SchemaGate reflects database metadata through SQLAlchemy, then combines BM25 and hashed-vector retrieval, expands through foreign keys and emits a compact DDL fragment for a downstream model. It supports SQLite and PostgreSQL, has a live-tested Oracle path, and lists SQL Server and MySQL as not yet tested against live engines in its testing record.

The author reports 100% recall@6 on the standard questions in six synthetic schemas, including a deliberately hostile 260-object catalog. The important caveat is in the same table: business-language questions scored as low as 40% or 50% without descriptions, while hand-written descriptions raised those test subsets to 100%. Those are project-maintained synthetic evaluations, not an independent benchmark or a production-user study, as the testing record makes explicit.

Version 0.1.9 does not change the selector library. Its changelog says it fixes a systemd deadlock in the optional Oracle Cloud stack and records one unattended run that reached a serving MCP endpoint 150 seconds after apply, completed keyless cataloguing and passed the stack’s six certification checks. The package remains classified as alpha on PyPI.

The boundary operators should keep

Pre-prompt filtering can prevent unauthorized table names, columns and comments from becoming model context. It can also avoid a misleading failure mode in which database policy strips every row and an assistant translates the empty result into “no records found.” But SchemaGate’s catalog rules are application-side configuration; they are not a substitute for database grants, row-level security, views or query-time authorization.

The practical deployment pattern is defense in depth: derive the SchemaGate principal and roles from a trusted identity source, filter context before the model call, then execute generated SQL under a least-privileged database identity that independently enforces access. Also test both directions—restricted objects must stay absent, and allowed business-language questions must still retrieve the right objects. The project’s own low no-description scores show why passing the security test does not automatically mean passing the answer-quality test.