DETERMINISTIC VERIFICATION FOR AGENT-WRITTEN SQL
Agents write the SQL.
Rune verifies it.
Rune sits between your AI agents and your data. It checks every query before the query runs, deterministically. Every answer carries its verdict. Wrong answers stop looking right.
We’ll only use your email to contact you about the design-partner program.
Your agent doesn’t say “I don’t know.”
An agent answering from your data writes valid SQL and wrong queries. The errors are rarely syntactic. They are semantic: the agent does not know what your tables mean, which one is canonical, or which keys are safe to join on.
The failures repeat in patterns:
Engineering the problem away is hard. Agents rarely find flaws in their own SQL. Across benchmarks, they catch only a few errors in a hundred.
The check has to come from outside the model.
Checked before it runs. Honest when it returns.
Rune has a simple thesis: agents do not need to be smarter, they need evidence.
Rune scans your estate continuously: snapshots, partitions, schema history, profiled columns with real value sets and null rates. All of this is used as evidence to empower agents working on structured data.
Agentic queries are verified against evidence.
Our gateway vets every query against that evidence before the query runs. Provably wrong queries never reach your engine. The agent gets the error and the fix instead. Everything else runs and returns with its verdict (see Fig 01 below).
Semantics exposed to agents in an intuitive format.
Our gateway makes the metadata derived knowledge base easily accessible. Agents can use our MCP endpoints to pre-emptively look up the estate’s broad strokes: enriched schema cards, the join graph with uniqueness evidence, which of five look-alike tables is the live one. Everything carries its provenance: observed fact or human-authored truth.
The agent stops guessing before the checker ever fires. Fewer retries, smaller context windows, lower cost on every question.
Your definitions, the source of truth.
“net revenue” means one exact thing at your company. Define it once, in your own repository. Our engine syncs it from there. The agent does not need to rebuild the query every time net revenue is required, and reuses the definition directly.
An agent computed revenue by region. The SQL was valid. The number was inflated. Here is the certificate that exposed it.
Proven, graded, or refused. Never a guess.
The gateway. Fully open source.
We present frisket: an open-source, Python-native package. It is the whole gateway in one distribution. The verifier, every check, and the certificate format are public. No model sits in the verification path. The same query, against the same evidence, always gets the same verdict.
Frisket deploys against what you already run. It connects read-only and inherits your existing access policies. Nothing migrates. No jobs change.
Supported today.
Same query. Same evidence. Same verdict.
What’s free. What’s paid.
Free forever.
The check catalog never splits across pay levels. Not ever.
Operated understanding.
We meter your costs. We never meter our price.
Open core is a trade. Here is ours, stated plainly.
Enterprises can go further. Rune enforces meaning at the source, across the whole estate, on the open stack you already run.
Become a design partner.
We’re onboarding a small number of design partners: data teams who feel the pain of ungoverned data and want to shape the product with us. If that’s you, we’d like to talk.
We respond to every request personally within a few days. Your email is used only to contact you about the design-partner program.
Not ready to talk?