Your complete data platform.
One pod. One command. Self-hosted.
MDS bundles ingestion, lakehouse storage, SQL federation, orchestration, AI agents and SSO into one stack. Spin it up on a laptop, deploy to your own server, or scale it on OpenShift and Kubernetes. Same stack at every stage. Yours to run.
Built for the long term.
One contract. One stack. One platform you will still be running in five years, with the same predictable bill.
One flat fee. Any volume.
Single annual support price. Same fee whether you ingest a gigabyte or a petabyte. No per-row, per-query, or per-seat surprises. Budgetable forever.
Yours forever.
MIT licensed. No vendor lock-in. No data egress fees. No phone-home telemetry. Walk away with everything you built if you ever need to.
One stack. One contract.
Replaces the warehouse, BI, ETL, observability, identity, vector search, and secrets vendors you stitched together. One bill, one vendor relationship, one procurement cycle instead of twelve.
Compliance from day one.
SOC2-aligned controls. GDPR by architecture, not by checkbox. EU-resident or air-gapped on your own infrastructure. Every secret access audit-logged via OpenBao.
Your stack, your portal.
Self-serve access to your Meshly Data Stack: license, team, contracts, contacts, support, release updates. All in one place.
Your stack, your team, your contracts. One sign-in.
From licence to launch, everything related to your Meshly Data Stack lives in one place. See your team, your contracts, your contacts. No ticket to file just to know what is yours.
Every customer you onboard, in their own tenant.
Bring your customers, we bring the stack. Each customer gets their own tenant, their own users, their own history. You stay in control; they stay isolated.
Best-of-breed open source, pre-wired.
Thirty-two containers in the Standard tier, one shared network namespace, randomly generated credentials stored in OpenBao. Every component is production open source: Trino, Kafka, Iceberg, Airflow, Superset, Keycloak. All chosen and tuned to work together.
Domain modules, installed in one click.
Beyond the 32 containers in your stack, browse and install domain modules from the Meshly catalog. Tier-locked, signature-verified, one click from your portal into your stack.
+ FinOps Suite · ITxPT Ingestion · OPC-UA Bridge · Fleet Analytics · Milvus · LangFlow · MDS Scraper. New modules added regularly.
A layered platform, not a pile of containers.
Every layer talks to the ones beside it through pre-wired connections. Credentials flow from OpenBao at startup; SSO flows from Keycloak across every UI; queries flow through Trino; events flow through Kafka into the lakehouse.
Pick a footprint. Not a checkout.
Configuration tier picks which services run. Hardware sizing is a separate axis: the same code runs at any size, from a laptop to a production rack. Price is a flat annual support fee, not a usage tax.
- Pick individual components
- Keycloak + OPA always required
- Tight resource budgets
- Specialised deployments
- No stream / batch by default
- Lakehouse: Iceberg on MinIO + Nessie
- Trino federation across all sources
- Real-time CDC: Debezium → Kafka → any sink
- Airflow + OpenMetadata + Superset
- Keycloak SSO, OPA RBAC, OpenBao
- Meshly Build connector + MDS-BI builder
- Qdrant vectors + Valkey cache
- MDS Dashboard included
- Everything in Standard
- Apache NiFi visual ingestion
- Apache Flink stream processing
- Apache Spark batch + ML
- Spark History server
- Complex event processing (CEP)
- Faust auto-disabled if Flink is on
Separate axis from configuration tier. Pick the row that matches what you will actually do with the stack.
One pane of glass for every container.
The MDS Dashboard ships with the stack. Live container metrics, structured logs, Postgres schema and query inspection, an OpenBao secrets browser, Data API consumer key lifecycle, module installs and quick restarts, all behind Keycloak SSO.
↓918
Four surfaces, one stack.
From code on the host, inside the pod, or in an external container, to operators and agents driving the stack through the Meshly CLI from any workstation. Every surface is documented; every path stays the same as your deployment grows.
from trino.dbapi import connect
conn = connect(
host="localhost", port=8180,
user="dev", catalog="meshly_coffee",
)
Production-grade by default.
MDS is shaped by the things you only learn from running platforms in production: secrets rotation, blue-green deploys, structured logging, backup retention.
Zero hardcoded passwords.
Every service password is generated at install and sealed in OpenBao. Per-service tokens grant least-privilege reads. Rotate any credential with one script.
One Keycloak realm, every UI.
Superset, Grafana, Airflow, OpenMetadata, NiFi, MDS-BI. All federate through the mds realm. Bring your own Entra ID, Google Workspace or LDAP.
Versioned, testable backups.
PostgreSQL, Keycloak, Grafana, MinIO buckets, OpenBao Raft snapshot, Trino catalogs and OpenSearch dumped into ~/.meshly-data-stack/backups/ with retention. Restore in dry-run mode before committing.
Laptop, server, OpenShift.
Same install on macOS, Linux, WSL2, plus OpenShift and Kubernetes 1.19+. --mode server --domain yourdomain.com generates Nginx + SSL config and per-service subdomains. K8s manifests ship default-deny NetworkPolicies and Secret-driven credentials. Same stack at every stage, no migration project.
Pino logs. Prometheus metrics.
Every container’s stdout streams to OpenSearch automatically: Fluent Bit tails Podman log storage, parses each line, and writes to logs-<service>-YYYY.MM.DD indices. Zero per-app config. Prometheus scrapes every container, Grafana ships with default dashboards, health checks across every container with auto-recovery via MDS Sentinel.
Agents are first class.
Two AI surfaces. The ops surface (MDS MCP Server, 340+ tools across 20 categories) lets Meshly Build and Claude Code introspect, query, and manage the stack. The customer surface (LangGraph) hosts your own agentic flows on Postgres-checkpointed state with Keycloak-validated per-user identity. Both behind audit trails.
Components install and uninstall like packages.
Per-component install, uninstall and purge with explicit flags on the installer. The component registry rehydrates on stack updates so customisations survive upgrades, no manual reinstall. Component runtime config lives in OpenBao, managed via MCP tools, and every write is audited.
Run the stack from a workstation that never touches the internet.
One CLI talks to MDS and Meshly Build. SSO through your Keycloak realm. Works fully offline against a local stack, or over a VPN to a customer site. A real differentiator for regulated, sovereignty-conscious deployments.