Tessera

Tessera puts the whole data workflow in one self-hosted application: connectors and streams, pipelines, data quality, personal-data masking, a catalog, semantic models, dashboards, scheduled reports, executive briefs with forecasts, AI agents and an MCP server. It runs on a laptop, a VM or a container. Your data stays on your hardware, and every feature, including SSO, SCIM and audit, is in the free product under Apache 2.0.

What you can do with it

Bring data in	25 connector types: PostgreSQL, SQL Server and Fabric Warehouse, Snowflake, BigQuery, Databricks, Redshift, MySQL, Oracle, Trino, ClickHouse, MongoDB, Elasticsearch, Delta Lake, Apache Iceberg, S3, SFTP, REST APIs with OAuth 2, files and any SQLAlchemy database. Ready-made connections to 11 business applications (Salesforce, Dynamics 365, Microsoft 365, HubSpot, Stripe, GitHub, Jira, Zendesk, ServiceNow, Shopify, Airtable), most of them loading only what changed. Copy a whole database in one step, with merge loads detected per table.
Mirror it	PostgreSQL mirroring from the database's change log: inserts, updates and deletes arrive within seconds, with no reloads and nothing to install on the database. Schema changes in any source are recorded and announced with their downstream impact.
Stream it	Kafka (Confluent, Redpanda, MSK), Azure Event Hubs, Amazon Kinesis, MQTT and HTTP push land continuously in tables. Positions are saved after each batch, so a restart never loses events. Dashboards have a Live mode.
Make it trustworthy	Pipelines with dependencies, retries and schedules. Nine kinds of quality rule, suggested from the data, that can stop bad data before it is published. Personal data is detected and masked on publish. Row-level security follows each person everywhere.
Define it once	Semantic models hold certified measures such as Revenue and Refund rate, so every report, question and AI answer agrees. A catalog, glossary, lineage and an AI-readiness score per dataset.
Use it	Ask questions in plain English, explore 15 visuals, build dashboards by dragging tiles, schedule emailed reports and alerts, share or embed read-only links.
Lead with it	One click from any dashboard: where the year will land, how likely each target is, what moved the numbers, with forecasts that state their method and error.
Ask AI, safely	Built-in agents (analyst, incident responder, modeler and more) work inside your permissions and every figure they quote is checked against the data. An MCP server gives Claude, IDEs and your own agents the same governed access.
Fit in	Power BI, Excel and Tableau read governed data through an OData feed. Pipelines deliver published data to Snowflake, BigQuery, Databricks, Fabric or a Delta lake. OpenLineage to Purview, DataHub or Marquez. dbt docs and tests import. Airflow, Dagster and ADF trigger pipelines over the API.

How it compares

Tessera does a lot of what Microsoft Fabric does, in one open-source application you run anywhere. Here is where each is stronger.

	Tessera	Microsoft Fabric
Where it runs	Your laptop, server, Kubernetes, AWS or Cloudflare; data stays where you put it	Microsoft's cloud, on Azure capacity
Cost	Free (Apache 2.0); you pay only for the machine	Capacity-based subscription
What's included	Everything, including SSO, SCIM, audit, row-level security and AI agents	Depends on the capacity and licences you buy
Data quality	Built into pipelines: rules suggested from the data, gates that stop bad data before publishing	Through Microsoft Purview or your own notebooks
Personal data	Detected and masked on publish, with an AI-readiness score per dataset	Microsoft Purview sensitivity labels and policies, licensed with Microsoft 365 or Purview
AI	Agents that work inside your permissions and check every figure, plus an MCP server; bring any model provider	Copilot, on paid Fabric capacity
Connectors and mirroring	25 connector types, 11 business applications, PostgreSQL mirroring	Far more connectors and mirroring sources
Scale	One server: comfortable to hundreds of gigabytes	Distributed Spark and warehouse engines for very large data
BI	Built-in dashboards, plus Power BI, Excel and Tableau over OData	Power BI, the most mature of the lot
Operations	One process you run and upgrade yourself	Fully managed

Pick Tessera if you want one tool you own, that runs anywhere, with governance and AI built in. Pick Fabric if you need petabyte scale, hundreds of managed connectors and a service Microsoft runs for you. They also work together: Tessera reads from and delivers to Fabric, and Power BI reads Tessera's governed data.

Start in one minute

With Docker (Linux, macOS or Windows; amd64 and arm64):

docker run -d --name tessera -p 8710:8710 -v tessera-data:/data ghcr.io/vvipinthomas/tessera:latest
docker logs tessera 2>&1 | grep "Setup code"

Or with Python 3.11 or newer, from the latest release:

pip install "https://github.com/vvipinthomas/tessera/releases/download/v1.7.4/tessera-1.7.4-py3-none-any.whl"
tessera serve

Open http://localhost:8710, enter the setup code, create your admin account and keep Start in demo mode ticked for a guided tour with sample data. (The tessera package on PyPI is an unrelated project; install from the release as shown.)

Run it on your computer

To work from the source code, you need Python 3.11 or newer.

git clone https://github.com/vvipinthomas/tessera.git
cd tessera
python -m venv .venv && source .venv/bin/activate      # Windows: .venv\Scripts\activate
pip install -e ".[s3,kafka,mqtt,iceberg,sftp,delta,mongodb]"
tessera serve

Open http://127.0.0.1:8710. The terminal prints a one-time setup code (it is also saved as tessera-data/setup-code.txt). Enter it, create the first admin account, and leave Start in demo mode ticked to get a sample retail workspace, a live demo stream and a guided tour of every screen. When you are ready, Switch to real data in the top bar removes exactly what the demo created and keeps your users and settings.

Everything Tessera stores lives in one folder, ./tessera-data by default (set TESSERA_DATA_DIR to move it): the metadata database, the DuckDB warehouse, uploads, exports and the encryption key.

The base install covers files, PostgreSQL, SQLite, REST APIs, HTTP push streams and everything in the app. Add drivers with extras:

Extra	Adds
kafka	Kafka, Confluent, Redpanda, MSK and Azure Event Hubs streams
mqtt	MQTT streams
s3 / kinesis	S3 and S3-compatible storage, Kinesis streams
iceberg, delta	Apache Iceberg and Delta Lake tables
sftp	SFTP file drops
mongodb	MongoDB, Atlas, Cosmos DB (Mongo API)
mysql, sqlserver, oracle, snowflake, bigquery, databricks, trino, clickhouse	Those databases and warehouses
all	Every driver that installs without system packages

SQL Server also needs the Microsoft ODBC Driver 18 on the machine.

Run it with Docker

git clone https://github.com/vvipinthomas/tessera.git && cd tessera
docker compose up -d                # uses the published image; add --build to build from this source instead
docker compose logs tessera | grep "Setup code"

Open http://localhost:8710. Data is kept in the tessera-data Docker volume, so upgrades and restarts keep it.

For HTTPS with an automatic certificate, point a domain at the machine and run:

TESSERA_DOMAIN=tessera.example.com \
  docker compose -f docker-compose.yml -f deploy/https/docker-compose.https.yml up -d --build

Deploy it

Tessera is one process with its data in one folder (DuckDB plus SQLite). Give it a persistent disk, or run it in cloud mode, where it keeps its data in object storage and restores itself on start. Step-by-step guides:

Where	How	Guide
AWS	One CloudFormation stack: EC2 with Docker, an encrypted EBS data volume, HTTPS through Caddy, nightly backups to a private S3 bucket, shell access through Systems Manager.	AWS · deploy/aws/tessera-ec2.yaml
Cloudflare	All of Tessera on Cloudflare: a Worker front door, Tessera in Cloudflare Containers, data backed up to R2 every few minutes and on every shutdown, restored automatically. npx wrangler deploy and you are live.	Cloudflare · cloudflare/
Cloudflare Tunnel	Tessera on your own server, published through Cloudflare with no open ports, optionally behind Cloudflare Access.	Tunnel · deploy/cloudflare
Any server	Docker Compose with Caddy for HTTPS.	Docker

Serverless platforms with temporary disks (Cloudflare Containers, Fargate, Cloud Run) work in cloud mode: tessera cloud-run restores from an S3-compatible bucket on start and backs up while running and on shutdown. Function platforms such as Workers alone or Lambda cannot host the server itself.

Documentation

Guide	For
User guide	Everyone: every screen, from first sign-in to dashboards, briefs, streams and AI agents
Deploy	Running Tessera on AWS or your own server, with HTTPS, backups and upgrades
Cloudflare	Running all of Tessera on Cloudflare Containers with R2, Access and Workers AI
Cloudflare from your phone	Deploying through GitHub Actions with no computer, then testing on Android
Configuration	Every environment variable and command-line option
Integrations	Power BI, Excel, Tableau, streaming sources, dbt, OpenLineage, destinations, orchestrators
MCP server	Connecting Claude, IDEs and your own agents
Enterprise	SSO, SCIM, workspaces, sharing, metrics, audit, backups
Architecture	How the pieces fit, the security model and design decisions
Security	Reporting a vulnerability and how releases are checked

How it is built

sources ─┬─ batch connectors ─┐
         └─ streams ──────────┴─▶ raw ──transform──▶ curated ──quality gate──▶ PII scan ──publish──▶ serving ─┬─▶ dashboards, briefs, AI, MCP
                                  (engineers)          (engineers)                         (masked, RLS)       ├─▶ OData: Power BI, Excel, Tableau
                                                                                                               └─▶ deliver: warehouses, Delta lake

Python and FastAPI on the server, DuckDB as the analytical engine (with file and network access switched off for queries), SQLite for metadata, and a dependency-free JavaScript front end. Every query goes through a parser-based guard; people without the engineer role can only read the published, masked zone. Details in docs/ARCHITECTURE.md.

Tested, and honest about limits

The release suite has 306 tests plus a browser test that drives 51 screens in light and dark, desktop and mobile. Connectors run against real services or faithful stand-ins: live PostgreSQL (including mirroring from its change log), every application template against an API simulated from the vendor's paging and sign-in documentation, a Kafka-protocol broker with the librdkafka client, a real MQTT broker and SSH/SFTP server, Kinesis and S3 through moto, real Delta and Iceberg tables, and MongoDB and Elasticsearch stand-ins. An authorization matrix calls every route without credentials and as a viewer. bandit and pip-audit run on every change.

What Tessera is not:

• One server, not a cluster. DuckDB spills to disk, so hundreds of gigabytes are practical on one machine; there is no clustering or automatic failover.
• Micro-batch streaming, not a stream processor. Events land within a second or two of the batch window. Keep Flink or Spark upstream for windowed joins over unbounded streams.
• Statistical forecasts. They learn trend and seasonality from history and show their tested error; they do not know about promotions or price changes.
• No Python notebooks, on purpose: running user code would bypass the permission model. Notebooks are SQL and Markdown.
• No third-party penetration test yet. The security checks are automated and internal.

Connectors marked driver in the app (Snowflake, BigQuery, Databricks, SQL Server, Oracle, Trino, ClickHouse, MySQL, Event Hubs) use each vendor's standard driver and are not exercised by the test suite.

Contributing

Bug reports, connectors, translations and documentation are all welcome. Start with CONTRIBUTING.md; it explains the development setup, how to run the tests and what a good pull request looks like. Good first issues are labelled good first issue. Please follow the code of conduct.

See ROADMAP.md for what is planned and CHANGELOG.md for what changed.

License

Apache License 2.0. Bundled fonts (Instrument Sans, IBM Plex Mono) are under the SIL Open Font License; see NOTICE.

Tessera is built by Vipin Thomas at Vantoras.