The problem
Every business question needed a developer. Operators queued report requests, waited days, and made decisions on stale numbers.
The approach
We built an agent that translates plain-English questions into ORM-safe queries against the live database. Role-based access is validated before execution. Prompt-injection safeguards, retry queues and async processing make it safe to expose to non-technical staff. Delivered through Claude MCP for real-time interaction.
The outcome
Answers in seconds instead of days. Developers off the report queue. No raw SQL ever touches the database.
Business operators were drowning in manual report requests. Every insight required a developer query, a ticket, and a wait.
What we built
A natural-language interface over live ERP data, delivered through Claude MCP. Staff type a question. The agent translates it into an ORM-safe query, validates the caller’s role, executes it, and returns an answer or a generated report.
- ORM-safe query execution: no raw SQL reaches the database
- Role-based access validated before every call
- Prompt-injection safeguards on every input
- Retry queues, conflict handling and async processing for reliability
- AI-driven report generation from query results
NL→SQL
Plain English to live data
100%
Prompt-injection hardened
Why it is safe to hand to non-technical staff
The model never gets direct database access. It proposes, the ORM layer disposes. Every query is scoped to what the user could already see in the UI, and adversarial inputs are caught before they reach the runtime.
Result: answers in seconds, developers off the report queue, and an audit trail on every question asked.
