andrebentorj/rosie-nl2sql

Ask your database in plain language. See what was checked, and what was not.
Rosie is a self-hosted text-to-SQL engine for MySQL, MariaDB, PostgreSQL and SQL Server. You point it at
a database, it learns the schema, and people (through an embeddable chat widget) or AI agents
(through MCP) ask questions in plain language. Rosie writes the SQL, checks it, runs it
read-only and answers.
What sets it apart is what happens after the SQL runs. The answer goes through a set of
deterministic checks for the ways a query can be wrong without any error, and the outcome is
shown next to the number: the Answer Certificate. When a check could not run, Rosie says
that too. The checks look at the structure of the calculation, not at whether the question
was understood; docs/CERTIFICATE.md says exactly what is covered.
Two real answers from the demo database. On the left, the number was re-derived by a second
route and matched. On the right, the question asks for a period that runs six months past
the last record, and Rosie says so instead of handing over a total that looks complete.
| Checked and confirmed | Flagged |
A query that runs and returns a plausible number is the failure that hurts, because nobody
looks twice. On the demo data, a join that repeats each invoice once per
line turns a revenue of 2,328.60 into 20,848.62 without any error; the certificate reports
both figures and marks the answer CONTRADICTED.
## What it does
| Answer Certificate | After the SQL runs: detects joins that inflate totals, filters on values that do not exist, periods the data only partly covers, filters that remove nothing, and queries that ignore a declared metric definition. For totals over joins it re-derives the number by a second route and reports CROSS_CHECKED or CONTRADICTED. Every answer carries an explicit verdict, including NOT_CHECKED with the reason. |
| Read-only by construction | SQL is parsed and validated before it runs: SELECT only, tables and columns from an allowlist, no system functions. The database user is checked at startup and Rosie refuses to answer if it can do more than SELECT. |
| Personal data stays put | Masked columns are never read, never returned and never sent to the model provider. |
| Per-tenant isolation | Row policies filter every query by the caller's verified identity (JWT). The filter is applied by the engine, not by the model, and cannot be talked around. |
| Approved queries | A query a person reviewed for a question is run unchanged when the question comes back, with only the values swapped, and the answer says who approved it. The checks cover the calculation; this covers the meaning. |
| Metrics with one definition | Declare "revenue" once, or import it from dbt or Cube. Answers that compute it differently are flagged. |
| Two ways in | A chat widget (one script tag, white-label) and an MCP server for Claude, Cursor and other AI clients. |
| Runs where your data is | Your server, your database, your model key. Works with any OpenAI-compatible endpoint, including a model you host. |
## Measured, on public data
Our own regression suite: 194 questions over the public Chinook sample database, the same