ctxd

Stop your AI agent hallucinating against your production database.

A release-aware context layer and MCP runtime. Agents get reviewed metric definitions, approved join paths, read-only enforcement and PII masking — instead of raw schema and a guess.

View on GitHub Open the interactive demo

The problem

An agent reading raw schema has to guess

Nothing in a column name says which of three csat tables is canonical, that rating = 0 means the survey was never answered, or that *_history holds superseded rows.

An AI agent inspects the schema, picks a plausible table, and reports the wrong CSAT figure.
Asked for CSAT on settled claims, the agent inspects the schema, finds three plausible tables, picks one, and reports 2.70 / 5. No error. No warning. It reads exactly like a finished answer.

With ctxd

The same question, answered from a reviewed definition

A real Claude Code session calling ctxd's MCP tools and returning the correct CSAT figure.
Claude finds the governed metric csat.settled_claims, applies the rules it already encodes, and returns 4.67 / 5 across 900 answered surveys — citing the snapshot release it read.

A real Claude Code session over ctxd's MCP server. The tool calls, arguments, returned values and final answer are verbatim; the frames are re-typeset for legibility rather than screen-captured. The database is synthetic, and all three recorded takes returned 4.67.

Quickstart

npm install -g @dagurupriyan/ctxd@next
ctxd init          # scaffold .env
ctxd doctor        # check connectivity and snapshot readiness
ctxd refresh       # index Metabase into a versioned snapshot
ctxd serve --http  # serve MCP to Claude, Codex, or any client

Requires Node 20+. Point METABASE_URL and METABASE_API_KEY at your instance; there is no mapping file and no plugin to install.

What it enforces

Read-only by default Agents get context and drafted SQL. Execution is opt-in via CTXD_ALLOW_QUERY.
Fails closed Single SELECT/WITH only. Mutations, DDL, stacked statements and SELECT … INTO rejected.
PII stays masked Denylisted columns stay indexed but carry no values. Wildcards like *.email cover every table.
Versioned snapshots Every answer cites a release and schema fingerprint, so drift is visible instead of silent.
Reviewed semantics Metric definitions are data your team approves — not something the model infers per request.
Auditable Every executed query is appended to audit/queries.jsonl.

What it is not

ctxd does not replace Metabase, dbt, Cube, or your warehouse. It is the contract, compiler, release gate, and evaluation layer between those systems and an agent.