console preview — illustrative
Kydra
Governed, permission-checked context for AI agents
Kydra runs in your VPC, between your data platform and your AI agents. Agents connect over MCP and get context — schemas, glossary terms, join paths, metrics, lineage — only after their permissions are checked, with provenance stamped on every answer. Permissions are enforced before retrieval and re-checked before context assembly; any mismatch fails closed. No raw-data lake inside Kydra, no context your policy didn't allow.
Private alpha — self-hosted, shaped with a handful of design partners
01 — Problem
Why this exists
Schema checks pass while meaning breaks: cents become euros, a timezone shifts, an enum gets repurposed — and every contract test stays green. AI assistants amplify the risk instead of reducing it: they retrieve whatever they can reach, confidently ground answers in the wrong table, and have no idea which context they were never allowed to see.
02 — Capabilities
What it does today
Governed MCP server
Six read-only, scope-enforced tools — search_assets, get_asset_context, get_join_path, resolve_metric, list_glossary_terms, check_access. Agents get exactly the context their grants allow, nothing else.
Private by default
Capability grants with explicit deny and expiry, no-oracle denials that don't reveal what exists, and time-limited, audited break-glass for real emergencies.
Postgres, Kafka, Elasticsearch
Read-only connectors for PostgreSQL, Apache Kafka — including Confluent Schema Registry — and Elasticsearch: the systems where your data's meaning actually lives.
Lineage & freshness, with evidence
Declared FKs are ground truth; inferred lineage carries a confidence score; humans can vouch. Freshness separates event-time from observation-time, probes Kafka offsets and flags schema drift.
PII scrubbing & egress firewall
Microsoft Presidio detects and scrubs PII, a prompt-injection guard screens retrieved content, and a role × sensitivity firewall filters what leaves — before any model sees it.
Zero-spend re-scans
Content fingerprints and scan budgets mean unchanged data is never re-profiled — re-scanning a stable estate costs zero LLM spend.
03 — How it works
From connection to production
- 01
Connect, read-only
Point Kydra at PostgreSQL, Kafka (with Confluent Schema Registry) and Elasticsearch using read-only credentials. Everything runs self-hosted, in your own VPC.
- 02
Discover with evidence
Discovery builds the catalog with content fingerprints and scan budgets — unchanged data costs zero LLM spend. Lineage carries evidence tiers: declared foreign keys as ground truth, inferred links with a confidence score, human-vouched links marked as such.
- 03
Grant, don't hope
Access is private by default. You grant capabilities — discover, understand, ask, sample, review — with explicit deny, expiry and audited break-glass. AI agents are first-class identities: effective permissions are the intersection of agent and user.
- 04
Query with provenance
Agents go through the governed MCP server, humans through the console. Every answer ships its provenance; permissions are re-checked before context assembly, and a mismatch fails closed — no leakage, no oracle.
04 — Use cases
Where it fits
Platform, data and security teams that want AI assistants on their data — without handing over the keys.
Give assistants data access — not the keys
Your teams want AI assistants over the warehouse and the streams. Kydra is the layer that decides what each assistant may see, proves where every answer came from, and refuses the rest — fail closed, audited.
Publish assets that stay governed
As a data owner, make a dataset discoverable and understandable — glossary, join paths, lineage — while keeping ask and sample behind grants you control and can expire.
Least privilege on sensitive data
For teams handling regulated or sensitive data: capability grants with expiry, no-oracle denials, PII scrubbing on any sample, and an audit trail for every access — break-glass included.
05 — Where it's heading
On the roadmap — not shipped yet
Planned work, in the order design partners need it. Nothing below is presented as available today.
- R-01
Asset Families
Recognize that dev, staging and prod assets are the same logical dataset, even when physical names differ.
- R-02
Semantic Profiles
Versioned profiles of what a dataset means — units, populations, distributions — as a reviewable artifact.
- R-03
Semantic Watch
Detect the meaning changes schemas miss: cents turned into euros, repurposed enums, silently filtered populations.
- R-04
Promotion Risk Reviews
Evaluate a promotion with evidence and return a verdict — SAFE, REVIEW, BREAKING or UNKNOWN. Unknown is a valid result and is never converted into reassurance.
- R-05
Incident Time Machine
Replay what a dataset meant at a point in time, to explain what an incident actually changed.
FAQ
Product FAQ
Where does Kydra run?
Self-hosted in your own VPC: PostgreSQL as system of record, a FastAPI backend and a React console. Nothing about your data leaves your infrastructure.
Does Kydra store my data?
There is no raw-data lake inside Kydra. It stores metadata, fingerprints and evidence. Sampling is a separate, explicitly granted capability — bounded reads, PII-scrubbed, audited.
Which LLM providers can I use?
Kydra is provider-agnostic through LiteLLM — bring the provider and keys your company already approved. And evidence comes before AI: every safety-critical decision belongs to deterministic policy, not to a model.
How do AI agents connect?
Over MCP, as first-class identities. An agent's effective permissions are the intersection of its own grants and those of the user it acts for — and every tool call is scope-checked and logged.
Build it with us
A small group of design partners gets direct access to the founder and real weight on what ships first. If the problem above is yours, let's talk.