Created with Fabric.js 5.2.4Starlake.ai

Open Source Data Infrastructure for the Agent Era

Agents write the pipelines; a deterministic engine runs them. Agents query production; the credential, not the prompt, decides what they can see, spend, and do. Starflow and Quack on Demand each work on their own. Both Apache-2.0.

Starflow

Open-source ELT · Apache-2.0

Agents write specs. The engine executes them.

Declarative YAML + native SQL pipelines on DuckDB, BigQuery, Snowflake, and Redshift. Everything an agent writes is schema-validated, git-reviewable text. The LLM never enters the execution path.

›

no lock-inno glue codeno LLM at runtime

Star on GitHubDiscover StarflowGet Started
Quack on Demand

Open-source DuckDB fleet control plane · Apache-2.0

Hand your agent the keys: scoped, audited, revocable.

Autoscaling DuckDB fleets behind a governed SQL gateway. Agents connect over MCP with scoped tokens; humans over ODBC/JDBC/ADBC. One enforcement path for both: ACLs, row policies, column masks, budgets, kill switch. Works with any ETL.

›

no telemetryno upsellno shared passwords

Star on GitHubDiscover Quack on DemandGet Started

In production at

BPCE Payment ServicesEstreemAxerealZE EnergyAsendia

The agentic philosophy

An agent is a new kind of user.

Data platforms were designed for two callers: the application, issuing a fixed, reviewed set of statements, and the analyst, issuing arbitrary ones slowly, with a job title attached. An agent is neither. It writes arbitrary SQL like the analyst, at machine speed like the application, and nobody reads it before it runs.

Machine speed, no review

A single agent turn is a dozen exploratory queries, and nobody is going to read them. Whatever policy you want enforced has to be enforced by the platform, on every statement, every time, without a human in the path.

Prompt injection travels through data

An agent believes what it reads. A value in a row can change what the agent does next. For the first time, the content of your tables can influence the behaviour of the caller reading them.

Credentials outlive agents

Agents are spun up, handed a credential, and discarded. When something goes wrong at 3am, "which agent did this, on whose behalf, and how do I stop it" has to be answerable in seconds.

The policy cannot live in the prompt. It lives in the spec and on the credential.

An agent's instructions are advice. Its grants are the only thing an injected instruction cannot argue with. That single idea shapes both products.

Starflow

Agents write specifications. A deterministic engine executes them.

Everything an agent produces is schema-validated, git-reviewable YAML and SQL. Everything that runs is deterministic engine code. Guardrail policies bind every author, human or agent.

Quack on Demand

The database you can hand an agent the keys to.

Scoped, revocable tokens over MCP. One enforcement path for agents and humans alike: grants, row policies, column masks, budgets. A fully compromised agent still cannot exceed its credential.

Open governance

Safe to depend on. Safe to recommend.

Stays Apache-2.0

Both projects are Apache-2.0 and will stay that way. No relicensing to BSL or SSPL. A public, standing commitment.

No telemetry by default

Neither project phones home. No usage tracking, no contact capture, no visibility into your users.

Open contribution

DCO-signed pull requests, transparent review, issues triaged in public on GitHub.

Public roadmap

Direction is decided in the open. Built on neutral, vendor-agnostic standards (Arrow Flight SQL, DuckLake).

FAQ

Frequently asked questions

Still have questions? Email us at [email protected]

Starlake.ai | Open Source Data Infrastructure for the Agent Era