AgentQL: .NET Library for AI Agents to Query Databases Safely

What changed

AgentQL is a newly released .NET library that facilitates the interaction between AI agents and Entity Framework Core (EF Core) databases. It achieves this by introspecting EF Core models to generate LLM-friendly schema descriptions and by providing a secure mechanism for executing SQL queries. The library acts as an intermediary, enabling Large Language Models (LLMs) to understand database structures and query them through function calling. AgentQL supports various AI providers, including OpenAI, Anthropic, and Ollama, and integrates with Microsoft.Extensions.AI for seamless function calling.

The core functionalities of AgentQL include:

• Schema Introspection: It analyzes EF Core DbContext models, extracting details about tables, columns, data types, relationships, enums, and inheritance hierarchies to create descriptive text for LLMs.
• Safe Query Execution: AgentQL executes SQL queries within transactions, offering configurable safety features such as row limits, command timeouts, and read-only enforcement. This prevents unintended data modifications and limits resource consumption.
• LLM Tool Exposure: It exposes three essential tool functions—GetDatabaseSchema, ExecuteQuery, and ReportFailure—making them callable by compatible chat clients.

Installation is managed via NuGet packages, with Equibles.AgentQL.MicrosoftAI offering a full-stack solution including schema, query execution, and AI chat client integration. Alternatively, Equibles.AgentQL.EntityFrameworkCore can be used for schema introspection and query execution if developers prefer to manage their own AI client.

Why it matters for builders

For AI builders, AgentQL significantly lowers the barrier to entry for creating AI-powered applications that require direct database access. It abstracts away much of the complexity involved in translating natural language queries into safe, executable SQL. The library's focus on security, with features like statement whitelisting, read-only enforcement, and configurable limits on query size and results, is particularly valuable for production environments. This allows developers to confidently integrate LLMs into data-intensive workflows without compromising data integrity or security.

Practical impact

Developers can integrate AgentQL into their .NET applications by adding the relevant NuGet package and configuring the AddAgentQLChat service. The library automatically registers necessary components like ISchemaProvider, IQueryExecutor, AgentQLPlugin, and IChatClient for dependency injection. Configuration options allow fine-tuning of safety parameters, such as MaxRows, MaxColumns, MaxSqlLength, MaxBytes, ReadOnly, and CommandTimeout. The ReadOnly mode offers multiple layers of defense against write operations, including statement whitelisting and DBMS-level session restrictions where supported.

Furthermore, AgentQL includes a self-correction mechanism that automatically retries failed queries or prompts the LLM to fix them, up to a configurable number of attempts. This enhances the reliability of AI-driven data interactions. Builders can also customize the AI provider, API keys, model names, and other chat-related settings.

Caveats and source limits

This release is marked as a "fresh release" with version v0.2.1, indicating it is still in early development. While the library offers robust safety features, the documentation notes that SQL Server and Oracle do not fully support DBMS-level session read-only enforcement, relying more heavily on the statement whitelist and transaction rollback. The effectiveness of the read-only mode for these specific databases depends on the careful configuration of database principals with minimal privileges. The source does not provide independent benchmark results or performance metrics for the library's introspection or query execution capabilities. The author's website is listed as a homepage, but no direct link to a company or official product page is provided, and the project appears to be community-driven.