Local-first database analytics

Ask your database anything. Your credentials never leave your machine.

Insyte connects with a read-only credential, writes the SQL for you, and runs it through a validator, a PII mask, and an audit log before anything executes. The AI never sees your database URL.

$ pip install insyte

insyte on PyPI

Read the setup guide →

insyte studio — read-only session

✓ validated ✓ pii masked ✓ audit logged

SELECT city, SUM(total_amount) FROM orders WHERE created_at >= date_trunc('month', now() - interval '1 month') GROUP BY city; read-only

revenue by city — last month

Two things are always true

Nothing gets between the guardrail and the query.

AI models never see your credentials

The connection URL stays in a file on your machine, permissioned 0600. It's never written to config, never logged, and never sent to any model.

Nothing bypasses the safety layer

Every query passes through Insyte's SQL validation, row limits, PII masking, and audit log. A dangerous query is rejected before it ever reaches your database — not executed and cleaned up after.

What you can do

One question in, a grounded answer out.

Everything below runs against real numbers Insyte computes from your schema — no hallucinated metrics.

STUDIO / CHAT / MCP

Three ways to use it

A browser workspace, a terminal UI, or straight from Claude Code / Codex over MCP.

TRENDS & FORECASTS

Breakdowns and comparisons

Trends, segments, and forecasts over metrics generated from your schema, with the exact SQL on demand.

INVESTIGATION MODE LITE

Ask "why did it change?"

Studio runs a safe, multi-step investigation: trend, comparison, segment breakdown, freshness checks, next questions.

DETAILED REPORTS · OPT-IN

Full analyst write-ups

Executive summary, root-cause reasoning, evidence and counter-evidence, and a best / expected / worst forecast.

CHARTS

Built to inspect, not just glance

Hover tooltips, readable date labels, fullscreen views, and smooth trend lines.

CONTEXT

Follow-ups that just work

Studio remembers the metric, dimension, and period so "same thing last month" resolves correctly.

Install & set up

Three commands, then a guided walkthrough.

pip — inside a virtual environment

          $ python -m venv .venv && source .venv/bin/activate
          create and activate the environment
          
          $ pip install insyte
          install the package
          
          $ insyte init
          asks for your read-only DB URL and which AI tool, then sets everything up

Give it a read-only URL

Stored once in a 0600 file — never in config, never logged, never sent to an AI.

Pick your AI tool

Claude Code, Codex, or none — Studio still answers metric questions without one.

Let it scan and wire up

Insyte connects, scans the schema, generates metrics, and wires up your AI tool. No scripts, no environment variables.

then, use it

          $ insyte studio
          browser workspace at http://127.0.0.1:3838
          
          $ insyte chat
          terminal UI
          
          $ insyte analyze total_amount --by city
          a single analysis from the CLI

Requirements: Python 3.11+, a PostgreSQL database, and — for natural-language questions — the claude or codex CLI.

recommended — a dedicated read-only role

CREATE ROLE insyte_reader LOGIN PASSWORD '…';
GRANT CONNECT ON DATABASE your_db TO insyte_reader;
GRANT USAGE ON SCHEMA public TO insyte_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO insyte_reader;

Insyte enforces read-only regardless — a dedicated account is just an extra layer.

From your agent

Use it from Claude Code or Codex directly.

insyte init already installs the Insyte MCP server into your chosen tool. Restart it, then ask questions in plain language — your agent calls Insyte's safe tools, which validate, run read-only, mask PII, and audit every query.

re-run anytime

$ insyte mcp install claude install into Claude Code

$ insyte mcp install codex install into Codex

Handy commands

A quick reference.

Everything lives under ~/.insyte/projects/<name>/. The connection URL is read only when needed and never written to config.yaml.

Detailed reports & your privacy

Everything above keeps your data on your machine. The one opt-in exception is the Detailed report: to write analyst commentary, Insyte sends the already-aggregated, PII-masked result of your query — or a grounded investigation bundle built from those results — to your local claude / codex CLI, which forwards it to that provider.

The AI only writes prose — it never sees credentials, never authors SQL, and every chart is built by Insyte from real numbers. It's off by default, shows a one-time notice the first time you enable it, and can be turned off entirely with:

config.yaml

ai.detailed_reports: false