DataCharter
Local-first, contract-governed data explorer with read-only, PII-masked query tools for AI agents.
DataCharter
Query all your data locally. Hand agents exactly the columns you choose.
A local SQL workspace over files and databases, federated by DuckDB and
governed by charter.yaml. Agents get read-only, PII-masked access to what
the contract grants. Apache-2.0. No paid edition.
datacharter.dev · Docs · Desktop · GovBench · Deploy
Two ways in. Same kernel.
Laptop
Drop a file. Query it. Chart it. An agent sees ••• where PII lives.
uvx datacharter serve # demo workspace, http://127.0.0.1:8321
# or: datacharter init --from && datacharter serve
# or: datacharter init --template life && datacharter serve --local
No terminal: desktop app (beta). macOS (Apple Silicon) or Windows. Unsigned until Apple secrets exist.
brew install datacharter/tap/datacharter # macOS
pip install datacharter # Python 3.11+
The workspace is a directory: charter.yaml, queries/, guides/. Commit it.
Secrets stay out. Optional agent: SpaceXAI, Claude Code, Ollama (--local),
or any OpenAI-compatible endpoint.
Company
The same binary, on a shared MCP endpoint. Identities live in git, not on our servers. No rows leave your infrastructure.
datacharter mcp --http --host 0.0.0.0 # OAuth env required off loopback
helm install datacharter ./chart \
--set oauth.issuer=... --set oauth.audience=... --set oauth.jwksUri=...
datacharter govbench --json # cite corpus govbench-v1
- MCP Streamable HTTP (
POST /mcp) with optional OAuth 2.1 principals:andgrants:incharter.yaml(default-deny on HTTP)- Helm chart and OCI image
- Hash-chained audit plus SIEM JSON/OTLP
- GovBench: frozen 28-attack corpus, grade A-F
Wrap someone else's MCP server: datacharter mcp --guard "npx -y some-mcp-server".
What the contract enforces
PII default-deny, row filters, plain-English policies (aggregates only),
canaries, a flight recorder, datacharter redteam, access diff on PRs.
CLI reference: docs/cli.md. Security: docs/security.md.
Status: pre-release. V1 in development.
Privacy
Runs on your machine or in your cluster. No telemetry. No DataCharter-operated data plane. Privacy Policy.
License
Installation
Source-derived launch command. Check the maintainer’s required arguments and credentials before running:
uvx datacharterSet up in your AI client
Merge this template into ~/Library/Application Support/Claude/claude_desktop_config.json. Keep existing servers. Add any arguments, credentials, and permissions required by the maintainer; this template has not been install-tested.
{
"mcpServers": {
"io-github-datacharter-datacharter": {
"command": "uvx",
"args": [
"datacharter"
]
}
}
}Restart Claude Desktop completely for changes to take effect. Confirm the server appears connected in the client’s tool list, then try a read-only example from its documentation.
Claude Desktop setup referencePackage
Compatible MCP Clients
DataCharter works with any MCP-compatible client. Copy the config snippet from the Configuration section above and add it to the file shown for your client, then restart the application.
- Claude Desktop
~/Library/Application Support/Claude/claude_desktop_config.jsonRestart Claude Desktop completely for changes to take effect. - Cursor
~/.cursor/mcp.jsonRestart Cursor for changes to take effect. - VS Code
.vscode/mcp.jsonReload VS Code window for changes to take effect. - Windsurf
~/.codeium/windsurf/mcp_config.jsonRestart Windsurf for changes to take effect. - Claude Code
.mcp.jsonSave at the project root, then start Claude Code in that project and review the MCP server approval prompt. Keep real credentials out of shared files.