Install schemagate

Apache-2.0. One required dependency (SQLAlchemy). No API key for the part that selects tables — that is BM25 plus a hashed embedder, and it runs offline.

Docker — nothing to install but Docker

docker run -p 8770:8770 ghcr.io/ashishsinha1602/schemagate

Opens the Studio on http://localhost:8770 with a demo schema — 42 objects, 3,817 rows — so there is something to click before you have connected anything. Point it at your own database with a URL:

docker run -p 8770:8770 \
  -e SCHEMAGATE_DATABASE_URL=postgresql+psycopg://user:pass@host/db \
  ghcr.io/ashishsinha1602/schemagate

The image runs as a non-root user, carries a healthcheck, and is built for linux/amd64 and linux/arm64. Tags are :latest and the release tag with its v — :v1.15.4. There is no :1.15.4.

pip

pip install schemagate                 # the library, the CLI and the Studio
pip install "schemagate[postgres]"     # or [oracle], [mysql], [mssql]
pip install "schemagate[databases]"    # all four drivers

The Studio needs no extra — it is a single page served by the standard library. The driver extras are only the database driver.

schemagate demo                                    # a schema to look at, no database
schemagate studio --url "postgresql://localhost/app"
schemagate select "revenue by month" --url "postgresql://localhost/app" --prompt

Oracle Autonomous Database

An Autonomous Database only speaks TLS, so the URL carries a connect descriptor in dsn rather than a host and port. With mutual TLS switched off on the database (the console’s “Access control list” / “mTLS not required” setting) no wallet is needed:

pip install "schemagate[oracle]"

schemagate select --schema APP "unpaid invoices" --prompt --url   "oracle+oracledb://ADMIN:PASSWORD@/?dsn=(description=(address=(protocol=tcps)(port=1522)(host=adb.us-phoenix-1.oraclecloud.com))(connect_data=(service_name=abc123_mydb_low.adb.oraclecloud.com))(security=(ssl_server_dn_match=yes)))"

The host, port and service are the ones in the console’s connection strings (the _low service is the right default). Percent-encode a password that contains @, / or #. --schema names the schema to read; without it you get the connecting user’s own objects. A database that requires mutual TLS takes the wallet instead: unzip it, name the tnsnames.ora alias as dsn and point the three wallet parameters at the folder (verified against a live Autonomous Database):

schemagate select --schema APP "unpaid invoices" --prompt --url   "oracle+oracledb://ADMIN:PASSWORD@/?dsn=mydb_high&config_dir=/path/to/wallet&wallet_location=/path/to/wallet&wallet_password=WALLETPASSWORD"

In Python, the whole of it:

from schemagate import Catalog, Principal

cat = Catalog().bootstrap("postgresql://localhost/app")
cat.restrict("hr_compensation", ["payroll"])       # who may even see it

sel = cat.select("revenue by month", top_k=6,
                 principal=Principal("okta:jdoe", roles=finance))

sel.prompt_fragment()   # compact DDL for just those tables, for the system prompt
sel.explain()           # why each object was picked

Oracle Cloud, as a stack

A Resource Manager stack that builds an Always Free VM with the Studio behind TLS:

Download the stack .zip Terraform Registry

Without an API key at all

Selecting tables never calls a model. Writing the SQL does, and that can be a model on your own machine, a server you already run, or a chat window you have open anyway — the local-model page is the detail.

Also

Try it in the browser first GitHub