GitHub user allenjiji added a comment to the discussion: [KPIP] Data Agent Engine — AI-Powered Autonomous Data Analysis for Kyuubi
Disclosure: I work on 0sql, a semantic layer built for exactly this, so I have an interest here. On the concern that an MCP server in front of Kyuubi weakens the guardrails: that only happens if the semantic layer executes queries. It doesn’t have to. The pattern we use is to make the semantic layer a tool alongside the agent, not a gateway in front of the server. The agent calls it with a small spec in business terms, field names and filters, and gets back a single SQL statement for the target dialect. That statement then goes through the existing sql_query tool over JDBC, using the user’s credentials. Ranger, auditing, resource isolation, and the SELECT-only validator all remain exactly where the proposal puts them. The semantic layer never holds a database connection and never sees a row. It also takes a lot of weight off the ReAct loop. Joins come from the model, not from FK inference or MinHash, so there’s no cartesian join to detect after the fact. Measures are defined once, so an average of an average cannot happen. If the model invents a field, the semantic layer rejects it and suggests the nearest valid fields, turning the hallucinated-column rate from a metric you track into an error you handle. The dialect question goes away too, because the planner emits Spark, Trino, or Databricks SQL, and the agent never writes engine-specific syntax. The security context can travel with the request too. The agent passes the identity it is planning for, and row-level policies defined in the model are added to the WHERE clause before Kyuubi sees the statement. Ranger still enforces access at execution time, making this defense in depth rather than a replacement. Happy to help wire this up as a test of the MCP integration once that lands. Docs are at https://0sql.io/ if useful. GitHub link: https://github.com/apache/kyuubi/discussions/7373#discussioncomment-18946850 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
