QueryPilot

QueryPilot is a VS Code extension that lets you ask questions about a MySQL 8 database in ordinary English. SQL generation uses a local Ollama server; generated SQL is shown for inspection, validated, and only executed after you press Execute.

Features

• MySQL host, port, username, database, and password inputs; Test, Connect, Disconnect, and schema refresh.
• Password stored using VS Code SecretStorage. It is not sent to the webview or stored in history.
• INFORMATION_SCHEMA table, column, key, foreign key, and index discovery.
• Local Ollama model and endpoint settings; schema-aware SQL generation and clarification response.
• Parser based read-only policy; SELECT, SHOW, DESCRIBE only; reject comments, invalid SQL, and multiple statements.
• Final SQL is validated again at execution and compared against the query approved at validation.
• Configurable timeout and row cap, execution timing, results table, CSV/JSON copy, and local history.
• React webview inherits VS Code's current theme.

Install from source

Requirements: VS Code 1.85+, Node.js 20+, MySQL 8+, and Ollama installed locally.

npm install
npm run build
npm test
npx vsce package

Install the generated querypilot-nl2sql-0.1.9.vsix in VS Code with Extensions: Install from VSIX... or:

code --install-extension .\querypilot-nl2sql-0.1.9.vsix

Open the QueryPilot activity icon in the sidebar.

Ollama setup

Install Ollama from ollama.com, ensure its local server is running, and download the default model:

ollama pull qwen2.5-coder:3b

The default endpoint is http://localhost:11434. Change querypilot.ollamaEndpoint and querypilot.model in VS Code Settings to use another local Ollama endpoint/model. QueryPilot sends only the user request and discovered schema identifiers/types to this endpoint; it does not send database rows to the model.

MySQL setup

Use the connection form in QueryPilot to enter the MySQL host, port (3306 by default), username, and database. QueryPilot prompts for the password using VS Code's secure input, then stores it in SecretStorage. Create a dedicated database user with only the privileges needed. For example, grant SELECT and metadata visibility on the target database. MySQL permissions remain the final protection boundary; QueryPilot's SQL guard is defense in depth. Test, then connect. The actual schema appears in Database Explorer.

Safety and privacy

• Model inference is local to Ollama; there is no paid/cloud AI integration.
• Passwords use VS Code SecretStorage and are never inserted into the webview's messages.
• Only one parsed statement of type SELECT, SHOW, or DESCRIBE is permitted. SQL comments are rejected.
• A result cap defaults to 500 rows and is configurable via querypilot.maxRows; timeout defaults to 15 seconds (querypilot.queryTimeoutMs).
• Execute requires prior validation and the SQL string must exactly match the string that was validated. Review/edit before execution.
• History is kept in VS Code global extension state and excludes credentials.
• Prefer a dedicated MySQL read-only account. Parser checks cannot replace database grants.

Limitations

The SQL validator checks discovered table names and verifies column references in the main select and common filters/order/group clauses. It does not yet fully resolve every alias, CTE, or nested query scope against metadata. Treat model output as a draft and retain MySQL read-only grants. The current UI renders one capped result page rather than providing server-side pagination. The history status currently records successful executions; failures are presented in the UI but are not persisted. Tests are unit tests using mocked Ollama calls and SQL policy inputs; no live MySQL/Ollama integration is assumed.

Development

npm run build
npm test
npm run package