Text-to-SQL that actually checks your ID at the door

What it does

Vanna 2.0 is an agentic Python framework that translates natural language into SQL, runs it against your database, and streams the results back as interactive tables, Plotly charts, SQL blocks, and summaries. A UserResolver hooks into your existing cookies or JWTs to identify the caller, and every tool execution checks group memberships before touching data. The project is pitched as a complete rewrite aimed at production deployments, with built-in audit logging, rate-limiting hooks, and FastAPI integration.

The interesting bit

Most text-to-SQL demos ignore the fact that real databases have real permissions; Vanna bakes user identity into system prompts, tool execution, and SQL filtering so Alice can’t accidentally see Bob’s rows. It also treats the frontend as a first-class citizen—not just streaming markdown, but structured UI components rendered inside a drop-in <vanna-chat> web component.

Key highlights

• Plugs into virtually any LLM (OpenAI, Anthropic, Ollama, Gemini, Bedrock, Mistral) and database (PostgreSQL, Snowflake, BigQuery, DuckDB, ClickHouse, and others).
• Brings your own auth: resolves users from existing cookies, JWTs, or OAuth tokens without replacing your login flow.
• Extensible agent architecture: register custom tools by extending a Tool base class, add LLM middleware for caching or prompt engineering, and hook into the request lifecycle for quotas or content filtering.
• Ships with a framework-agnostic <vanna-chat> web component that handles light/dark themes and mobile layouts.
• Includes a LegacyVannaAdapter so 0.x users can migrate gradually rather than rewriting immediately.

Caveats

• The README notes this is a “complete rewrite” from the 0.x API, so existing users face a migration; the old VannaBase class methods are gone.
• It is explicitly opinionated about its agent-based, streaming, web-first architecture, which may be heavier than a simple notebook script or CLI utility.

Verdict

Worth a look if you need to expose database querying to non-technical users inside a multi-tenant or audited environment. Skip it if you just want a quick, anonymous script to generate SQL without the web component or auth plumbing.