Tessera puts the whole data workflow in one self-hosted application: connectors and streams, pipelines, data quality, personal-data masking, a catalog, semantic models, dashboards, scheduled reports, executive briefs with forecasts, AI agents and an MCP server. It runs on a laptop, a VM or a container. Your data stays on your hardware, and every feature, including SSO, SCIM and audit, is in the free product under Apache 2.0.
What you can do with it
| |
|---|
| Bring data in | 25 connector types: PostgreSQL, SQL Server and Fabric Warehouse, Snowflake, BigQuery, Databricks, Redshift, MySQL, Oracle, Trino, ClickHouse, MongoDB, Elasticsearch, Delta Lake, Apache Iceberg, S3, SFTP, REST APIs with OAuth 2, files and any SQLAlchemy database. Ready-made connections to 11 business applications (Salesforce, Dynamics 365, Microsoft 365, HubSpot, Stripe, GitHub, Jira, Zendesk, ServiceNow, Shopify, Airtable), most of them loading only what changed. Copy a whole database in one step, with merge loads detected per table. |
| Mirror it | PostgreSQL mirroring from the database's change log: inserts, updates and deletes arrive within seconds, with no reloads and nothing to install on the database. Schema changes in any source are recorded and announced with their downstream impact. |
| Stream it | Kafka (Confluent, Redpanda, MSK), Azure Event Hubs, Amazon Kinesis, MQTT and HTTP push land continuously in tables. Positions are saved after each batch, so a restart never loses events. Dashboards have a Live mode. |
| Make it trustworthy | Pipelines with dependencies, retries and schedules. Nine kinds of quality rule, suggested from the data, that can stop bad data before it is published. Personal data is detected and masked on publish. Row-level security follows each person everywhere. |
| Define it once | Semantic models hold certified measures such as Revenue and Refund rate, so every report, question and AI answer agrees. A catalog, glossary, lineage and an AI-readiness score per dataset. |
| Use it | Ask questions in plain English, explore 15 visuals, build dashboards by dragging tiles, schedule emailed reports and alerts, share or embed read-only links. |
| Lead with it | One click from any dashboard: where the year will land, how likely each target is, what moved the numbers, with forecasts that state their method and error. |
| Ask AI, safely | Built-in agents (analyst, incident responder, modeler and more) work inside your permissions and every figure they quote is checked against the data. An MCP server gives Claude, IDEs and your own agents the same governed access. |
| Fit in | Power BI, Excel and Tableau read governed data through an OData feed. Pipelines deliver published data to Snowflake, BigQuery, Databricks, Fabric or a Delta lake. OpenLineage to Purview, DataHub or Marquez. dbt docs and tests import. Airflow, Dagster and ADF trigger pipelines over the API. |
How it compares
Tessera does a lot of what Microsoft Fabric does, in one open-source application you run anywhere. Here is where
each is stronger.
| Tessera | Microsoft Fabric |
|---|
| Where it runs | Your laptop, server, Kubernetes, AWS or Cloudflare; data stays where you put it | Microsoft's cloud, on Azure capacity |
| Cost | Free (Apache 2.0); you pay only for the machine | Capacity-based subscription |
| What's included | Everything, including SSO, SCIM, audit, row-level security and AI agents | Depends on the capacity and licences you buy |
| Data quality | Built into pipelines: rules suggested from the data, gates that stop bad data before publishing | Through Microsoft Purview or your own notebooks |
| Personal data | Detected and masked on publish, with an AI-readiness score per dataset | Microsoft Purview sensitivity labels and policies, licensed with Microsoft 365 or Purview |
| AI | Agents that work inside your permissions and check every figure, plus an MCP server; bring any model provider | Copilot, on paid Fabric capacity |
| Connectors and mirroring | 25 connector types, 11 business applications, PostgreSQL mirroring | Far more connectors and mirroring sources |
| Scale | One server: comfortable to hundreds of gigabytes | Distributed Spark and warehouse engines for very large data |
| BI | Built-in dashboards, plus Power BI, Excel and Tableau over OData | Power BI, the most mature of the lot |
| Operations | One process you run and upgrade yourself | Fully managed |
Pick Tessera if you want one tool you own, that runs anywhere, with governance and AI built in. Pick Fabric if you
need petabyte scale, hundreds of managed connectors and a service Microsoft runs for you. They also work together:
Tessera reads from and delivers to Fabric, and Power BI reads Tessera's governed data.
Start in one minute
With Docker (Linux, macOS or Windows; amd64 and arm64):
docker run -d --name tessera -p 8710:8710 -v tessera-data:/data ghcr.io/vvipinthomas/tessera:latest
docker logs tessera 2>&1 | grep "Setup code"
Or with Python 3.11 or newer, from the latest release:
pip install "https://github.com/vvipinthomas/tessera/releases/download/v1.7.4/tessera-1.7.4-py3-none-any.whl"
tessera serve
Open http://localhost:8710, enter the setup code, create your admin account and keep Start in demo mode ticked
for a guided tour with sample data. (The tessera package on PyPI is an unrelated project; install from the release
as shown.)
Run it on your computer
To work from the source code, you need Python 3.11 or newer.
git clone https://github.com/vvipinthomas/tessera.git
cd tessera
python -m venv .venv && source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -e ".[s3,kafka,mqtt,iceberg,sftp,delta,mongodb]"
tessera serve
Open http://127.0.0.1:8710. The terminal prints a one-time setup code (it is also saved as tessera-data/setup-code.txt). Enter it, create the first admin account, and leave Start in demo mode ticked to get a sample retail workspace, a live demo stream and a guided tour of every screen. When you are ready, Switch to real data in the top bar removes exactly what the demo created and keeps your users and settings.
Everything Tessera stores lives in one folder, ./tessera-data by default (set TESSERA_DATA_DIR to move it): the metadata database, the DuckDB warehouse, uploads, exports and the encryption key.
The base install covers files, PostgreSQL, SQLite, REST APIs, HTTP push streams and everything in the app. Add drivers with extras:
| Extra | Adds |
|---|
kafka | Kafka, Confluent, Redpanda, MSK and Azure Event Hubs streams |
mqtt | MQTT streams |
s3 / kinesis | S3 and S3-compatible storage, Kinesis streams |
iceberg, delta | Apache Iceberg and Delta Lake tables |
sftp | SFTP file drops |
mongodb | MongoDB, Atlas, Cosmos DB (Mongo API) |
mysql, sqlserver, oracle, snowflake, bigquery, databricks, trino, clickhouse | Those databases and warehouses |
all | Every driver that installs without system packages |
SQL Server also needs the Microsoft ODBC Driver 18 on the machine.
Run it with Docker
git clone https://github.com/vvipinthomas/tessera.git && cd tessera
docker compose up -d # uses the published image; add --build to build from this source instead
docker compose logs tessera | grep "Setup code"
Open http://localhost:8710. Data is kept in the tessera-data Docker volume, so upgrades and restarts keep it.
For HTTPS with an automatic certificate, point a domain at the machine and run:
TESSERA_DOMAIN=tessera.example.com \
docker compose -f docker-compose.yml -f deploy/https/docker-compose.https.yml up -d --build
Deploy it
Tessera is one process with its data in one folder (DuckDB plus SQLite). Give it a persistent disk, or run it in cloud mode, where it keeps its data in object storage and restores itself on start. Step-by-step guides:
| Where | How | Guide |
|---|
| AWS | One CloudFormation stack: EC2 with Docker, an encrypted EBS data volume, HTTPS through Caddy, nightly backups to a private S3 bucket, shell access through Systems Manager. | AWS · deploy/aws/tessera-ec2.yaml |
| Cloudflare | All of Tessera on Cloudflare: a Worker front door, Tessera in Cloudflare Containers, data backed up to R2 every few minutes and on every shutdown, restored automatically. npx wrangler deploy and you are live. | Cloudflare · cloudflare/ |
| Cloudflare Tunnel | Tessera on your own server, published through Cloudflare with no open ports, optionally behind Cloudflare Access. | Tunnel · deploy/cloudflare |
| Any server | Docker Compose with Caddy for HTTPS. | Docker |
Serverless platforms with temporary disks (Cloudflare Containers, Fargate, Cloud Run) work in cloud mode: tessera cloud-run restores from an S3-compatible bucket on start and backs up while running and on shutdown. Function platforms such as Workers alone or Lambda cannot host the server itself.
Documentation
| Guide | For |
|---|
| User guide | Everyone: every screen, from first sign-in to dashboards, briefs, streams and AI agents |
| Deploy | Running Tessera on AWS or your own server, with HTTPS, backups and upgrades |
| Cloudflare | Running all of Tessera on Cloudflare Containers with R2, Access and Workers AI |
| Cloudflare from your phone | Deploying through GitHub Actions with no computer, then testing on Android |
| Configuration | Every environment variable and command-line option |
| Integrations | Power BI, Excel, Tableau, streaming sources, dbt, OpenLineage, destinations, orchestrators |
| MCP server | Connecting Claude, IDEs and your own agents |
| Enterprise | SSO, SCIM, workspaces, sharing, metrics, audit, backups |
| Architecture | How the pieces fit, the security model and design decisions |
| Security | Reporting a vulnerability and how releases are checked |
How it is built
sources ─┬─ batch connectors ─┐
└─ streams ──────────┴─▶ raw ──transform──▶ curated ──quality gate──▶ PII scan ──publish──▶ serving ─┬─▶ dashboards, briefs, AI, MCP
(engineers) (engineers) (masked, RLS) ├─▶ OData: Power BI, Excel, Tableau
└─▶ deliver: warehouses, Delta lake
Python and FastAPI on the server, DuckDB as the analytical engine (with file and network access switched off for queries), SQLite for metadata, and a dependency-free JavaScript front end. Every query goes through a parser-based guard; people without the engineer role can only read the published, masked zone. Details in docs/ARCHITECTURE.md.
Tested, and honest about limits
The release suite has 306 tests plus a browser test that drives 51 screens in light and dark, desktop and mobile. Connectors run against real services or faithful stand-ins: live PostgreSQL (including mirroring from its change log), every application template against an API simulated from the vendor's paging and sign-in documentation, a Kafka-protocol broker with the librdkafka client, a real MQTT broker and SSH/SFTP server, Kinesis and S3 through moto, real Delta and Iceberg tables, and MongoDB and Elasticsearch stand-ins. An authorization matrix calls every route without credentials and as a viewer. bandit and pip-audit run on every change.
What Tessera is not:
- One server, not a cluster. DuckDB spills to disk, so hundreds of gigabytes are practical on one machine; there is no clustering or automatic failover.
- Micro-batch streaming, not a stream processor. Events land within a second or two of the batch window. Keep Flink or Spark upstream for windowed joins over unbounded streams.
- Statistical forecasts. They learn trend and seasonality from history and show their tested error; they do not know about promotions or price changes.
- No Python notebooks, on purpose: running user code would bypass the permission model. Notebooks are SQL and Markdown.
- No third-party penetration test yet. The security checks are automated and internal.
Connectors marked driver in the app (Snowflake, BigQuery, Databricks, SQL Server, Oracle, Trino, ClickHouse, MySQL, Event Hubs) use each vendor's standard driver and are not exercised by the test suite.
Contributing
Bug reports, connectors, translations and documentation are all welcome. Start with CONTRIBUTING.md; it explains the development setup, how to run the tests and what a good pull request looks like. Good first issues are labelled good first issue. Please follow the code of conduct.
See ROADMAP.md for what is planned and CHANGELOG.md for what changed.
License
Apache License 2.0. Bundled fonts (Instrument Sans, IBM Plex Mono) are under the SIL Open Font License; see NOTICE.
Tessera is built by Vipin Thomas at Vantoras.
