[WIP] Add customer-hosted agent with secure connection

[Copilot]

• Understand the repository structure and existing codebase
• Create agent service module for customer-hosted deployments
  • Agent registration and authentication system (agent/auth.py)
  • Secure token-based communication protocol with HMAC signatures
  • Agent configuration schema and models (agent/models.py)
• Create backend API endpoints for agent management
  • POST /agent/register - Register a new customer agent
  • POST /agent/heartbeat - Agent health check endpoint
  • POST /agent/query - Execute query through customer agent
  • GET /agent/status/{agent_id} - Get agent connection status
  • GET /agent/list - List all agents for a user
  • DELETE /agent/{agent_id} - Delete an agent
  • POST /agent/test-connection - Test agent connection
• Create secure communication utilities
  • Token generation and validation (agent/auth.py)
  • HMAC-based payload signing for secure requests
• Create agent service for customer deployment
  • AgentService class for query execution (agent/service.py)
  • AgentManager class for server-side management (agent/manager.py)
  • Standalone agent runner script (agent/run_agent.py)
• Add database schema for Agent model
• Add documentation for customer-hosted agent setup (agent/README.md)
• Fix code review issues (imports, SQL injection)
• Run security scan (no issues found)
• Add Streamlit demo app (demo/streamlit_app.py)

Original prompt

🥈 Option 2 — Customer-hosted Agent (Very strong, hackathon-friendly)
This is a killer differentiator and extremely smart for your product.

How it works
You provide a Docker agent / binary
They run it inside their VPC
The agent:
Connects to Postgres locally
Exposes a secure HTTPS endpoint
Your SaaS talks only to the agent, never the DB
Why this is powerful
You never touch credentials
DB traffic never leaves their network
Instant trust
Enterprise-friendly
Embedding
Their frontend calls your SaaS
Your SaaS delegates queries to their agent
This is how tools like Datadog, HashiCorp Vault, and Sentry work.

I want to implement this
Refer the new-design branch, it contains the updated file structure

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
nl-to-sql	Ready	Preview, Comment	Jan 2, 2026 8:44am

[ancient-kid]

@copilot Create a new branch and implement all changes

[Copilot]

@copilot Create a new branch and implement all changes

The implementation has been completed on the existing branch copilot/add-customer-hosted-agent. I'm unable to create new branches directly, but all the changes are implemented here.

Commits:

• 840874c - Add customer-hosted agent with secure connection infrastructure
• a9e56fc - Fix code review issues

Key features implemented:

• Customer-hosted agent service with secure token-based authentication
• API endpoints for agent registration, heartbeats, and query execution
• HMAC-based payload signing for secure communication
• Read-only mode and SQL validation for safety
• Standalone runner script for customer deployment
• Database schema for Agent model
• Comprehensive setup documentation

[ancient-kid]

@copilot how do i test the program?

[Copilot]

@copilot how do i test the program?

Here's how to test the customer-hosted agent:

1. Start the backend server:

cd backend
pip install -r requirements.txt
uvicorn main:app --reload --port 8000

2. Test the API endpoints using curl:

Register an agent:

curl -X POST http://localhost:8000/agent/register \
  -H "Content-Type: application/json" \
  -d '{"agent_name": "Test Agent", "host_url": "http://localhost:8443", "user_id": "test_user"}'

List agents:

curl "http://localhost:8000/agent/list?user_id=test_user"

3. Run the customer agent (requires PostgreSQL):

cd backend
# Create config file with credentials from step 2
cp agent/agent_config.example.json agent_config.json
# Edit agent_config.json with your agent_id, agent_secret, and database_url
python -m agent.run_agent --config agent_config.json

4. Test agent health:

curl http://localhost:8443/health

Note: The agent requires a running PostgreSQL database. For quick testing without a database, you can test just the API endpoints (steps 1-2). Full end-to-end testing requires setting up a PostgreSQL instance and configuring the connection string in agent_config.json.

[ancient-kid]

@copilot Run the customer agent (requires PostgreSQL):

Do i need to locally run postgresql? for that step?

[Copilot]

@copilot Run the customer agent (requires PostgreSQL):

Do i need to locally run postgresql? for that step?

Yes, to run the customer agent for step 3, you need a PostgreSQL database that the agent can connect to. This can be:

1. Local PostgreSQL - Install and run PostgreSQL on your machine
2. Docker PostgreSQL - Quick setup:

   docker run -d --name postgres-test -e POSTGRES_PASSWORD=postgres -p 5432:5432 postgres:15

3. Cloud PostgreSQL - Use any hosted PostgreSQL (Supabase, Neon, AWS RDS, etc.)

The database_url in your config should point to whichever PostgreSQL instance you use:

postgresql://user:password@localhost:5432/database_name

Alternative for quick testing without PostgreSQL:
You can still test the backend API endpoints (steps 1-2) without a database. The agent registration, listing, and other management APIs will work with just the backend server running. Only the actual query execution through the customer agent requires PostgreSQL.

[ancient-kid]

@copilot INFO: Application startup complete.
INFO: 127.0.0.1:53216 - "POST /agent/register HTTP/1.1" 422 Unprocessable Entity
INFO: 127.0.0.1:53218 - "POST /agent/register HTTP/1.1" 422 Unprocessable Entity
[AGENT] ✗ Error listing agents: relation "Agent" does not exist
LINE 2: SELECT * FROM "Agent" WHERE "userId" = 'test...
^

INFO: 127.0.0.1:51212 - "GET /agent/list?user_id=test_user HTTP/1.1" 500 Internal Server Error

[Copilot]

@copilot INFO: Application startup complete.
INFO: 127.0.0.1:53216 - "POST /agent/register HTTP/1.1" 422 Unprocessable Entity
INFO: 127.0.0.1:53218 - "POST /agent/register HTTP/1.1" 422 Un...

These errors indicate two setup issues:

1. 422 Error (Register endpoint):
The request body might not be parsed correctly. Try with explicit content-type:

curl -X POST http://localhost:8000/agent/register \
  -H "Content-Type: application/json" \
  -d '{"agent_name": "Test Agent", "host_url": "http://localhost:8443", "user_id": "test_user"}'

2. 500 Error (Agent table doesn't exist):
The Agent table needs to be created in your database. Run the Prisma migration:

cd my-app
npx prisma migrate dev --name add_agent_table

Or if you're using an existing database, push the schema directly:

cd my-app
npx prisma db push

Make sure your DATABASE_URL environment variable is set correctly in both the my-app/.env and backend/.env files pointing to your PostgreSQL database.

After running the migration, restart the backend server and try the curl commands again.

[ancient-kid]

@copilot give all the commands to run on windows powershell

[Copilot]

@copilot give all the commands to run on windows powershell

Here are all the commands for Windows PowerShell:

1. Setup and start backend:

cd backend
pip install -r requirements.txt
uvicorn main:app --reload --port 8000

2. Run database migration (in a new PowerShell window):

cd my-app
npx prisma db push

3. Test API endpoints:

# Register an agent
Invoke-RestMethod -Uri "http://localhost:8000/agent/register" -Method Post -ContentType "application/json" -Body '{"agent_name": "Test Agent", "host_url": "http://localhost:8443", "user_id": "test_user"}'

# List agents
Invoke-RestMethod -Uri "http://localhost:8000/agent/list?user_id=test_user" -Method Get

4. (Optional) Run PostgreSQL with Docker:

docker run -d --name postgres-test -e POSTGRES_PASSWORD=postgres -p 5432:5432 postgres:15

5. Run the customer agent:

cd backend
Copy-Item agent/agent_config.example.json -Destination agent_config.json
# Edit agent_config.json with your credentials
python -m agent.run_agent --config agent_config.json

6. Test agent health:

Invoke-RestMethod -Uri "http://localhost:8443/health" -Method Get

Make sure your DATABASE_URL environment variable is set:

$env:DATABASE_URL = "postgresql://postgres:postgres@localhost:5432/postgres"

[ancient-kid]

@copilot how do i practically showcase this thing works to the hackathon judges?

[Copilot]

@copilot how do i practically showcase this thing works to the hackathon judges?

Here's a demo flow for hackathon judges:

Live Demo Script (5 minutes):

1. Show the Problem (30 sec):
"Companies can't use cloud NL-to-SQL tools because their databases contain sensitive data they can't expose."

2. Show the Solution Architecture (30 sec):
Open backend/agent/README.md and show the architecture diagram - the agent runs inside the customer's firewall, only query results leave their network.

3. Live Demo (3 min):

# Terminal 1: Start backend
cd backend
uvicorn main:app --port 8000

# Terminal 2: Register an agent (simulating customer setup)
Invoke-RestMethod -Uri "http://localhost:8000/agent/register" -Method Post -ContentType "application/json" -Body '{"agent_name": "Acme Corp Agent", "host_url": "http://localhost:8443", "user_id": "demo_user"}'

Show the returned agent_id and agent_secret - explain these are the secure credentials.

# Show agent is registered
Invoke-RestMethod -Uri "http://localhost:8000/agent/list?user_id=demo_user"

4. Key Talking Points (1 min):

• ✅ Customer's database credentials never leave their network
• ✅ HMAC-signed requests prevent tampering
• ✅ Read-only mode prevents data modification
• ✅ Works with any PostgreSQL database

Backup if live demo fails:
Show the code structure: backend/agent/ folder with auth.py (security), service.py (query execution), manager.py (coordination).

[ancient-kid]

@copilot I have successfully created the api endpoint for my SaaS application... Now how do I demonstrate this to the hackathon judges?
I am expecting something like this, I will use a laptop with minimal setup, and another laptop containing our server hosting SaaS, and then completely use the program on that computer using api calls

[Copilot]

@copilot I have successfully created the api endpoint for my SaaS application... Now how do I demonstrate this to the hackathon judges?
I am expecting something like this, I will use a laptop with m...

Here's the two-laptop demo setup:

LAPTOP 1 (SaaS Server) - Setup beforehand:

cd backend
pip install -r requirements.txt
uvicorn main:app --host 0.0.0.0 --port 8000

Note the IP address (e.g., 192.168.1.100)

LAPTOP 2 (Customer) - Live demo with judges:

Step 1: Register agent from customer laptop

# Point to SaaS server IP
$SERVER = "http://192.168.1.100:8000"

# Register the customer's agent
Invoke-RestMethod -Uri "$SERVER/agent/register" -Method Post -ContentType "application/json" -Body '{"agent_name": "Customer DB Agent", "host_url": "http://192.168.1.101:8443", "user_id": "customer_1"}'

Save the returned agent_id and agent_secret.

Step 2: Configure and run agent on customer laptop

cd backend
# Edit agent_config.json with credentials from Step 1
python -m agent.run_agent --config agent_config.json

Step 3: Show it works

# From SaaS laptop - verify agent is connected
Invoke-RestMethod -Uri "$SERVER/agent/list?user_id=customer_1"

# Show agent health from customer laptop
Invoke-RestMethod -Uri "http://localhost:8443/health"

Key demo narrative:
"The customer's database stays on their laptop. Our SaaS only sends queries and receives results - we never see their credentials or raw data."

Both laptops need to be on the same network (WiFi/hotspot).

[ancient-kid]

@copilot agent_id : agent_5ed2175c987ddecb84d5bbc6
agent_token : tok_8ec4ca7282565447b39752b00594b5598c2b496e1351a11f
agent_secret : 2005752cd9804287260f43ba31a9ea93030b5b5ed8d504eb373f66bbc442980a
message : Agent registered successfully. Use these credentials in your agent configuration.
status : pending

This was the output
What to do next?

[Copilot]

@copilot agent_id : agent_5ed2175c987ddecb84d5bbc6
agent_token : tok_8ec4ca7282565447b39752b00594b5598c2b496e1351a11f
agent_secret : 2005752cd9804287260f43ba31a9ea93030b5b5ed8d504eb373f66bbc44298...

The agent is registered. Now configure and run it on the customer laptop:

Step 1: Create config file

cd backend
Copy-Item agent/agent_config.example.json -Destination agent_config.json

Step 2: Edit agent_config.json with your credentials:

{
  "agent_id": "agent_5ed2175c987ddecb84d5bbc6",
  "agent_secret": "2005752cd9804287260f43ba31a9ea93030b5b5ed8d504eb373f66bbc442980a",
  "database_url": "postgresql://postgres:postgres@localhost:5432/postgres",
  "relix_server_url": "http://YOUR_SAAS_SERVER_IP:8000",
  "port": 8443
}

Replace YOUR_SAAS_SERVER_IP with the SaaS laptop's IP address.

Step 3: Run the agent

python -m agent.run_agent --config agent_config.json

Step 4: Verify it's working

# Test agent health
Invoke-RestMethod -Uri "http://localhost:8443/health"

# From SaaS server - check agent status changed to "connected"
Invoke-RestMethod -Uri "http://YOUR_SAAS_SERVER_IP:8000/agent/list?user_id=customer_1"

Note: Step 3 requires PostgreSQL running. If you don't have PostgreSQL, you can still show judges that the registration worked (status: pending → would become "connected" when agent runs).

[ancient-kid]

@copilot agent_id : agent_5ed2175c987ddecb84d5bbc6
agent_token : tok_8ec4ca7282565447b39752b00594b5598c2b496e1351a11f
agent_secret : 2005752cd9804287260f43ba31a9ea93030b5b5ed8d504eb373f66bbc442980a
message : Agent registered successfully. Use these credentials in your agent configuration.
status : pending

This was the output, what to do next?

[ancient-kid]

@copilot its done....
Now I want to use it on any demo application, or atleast talk to the chatbot in the terminal
How can I do that with the help of my SaaS

[Copilot]

@copilot its done....
Now I want to use it on any demo application, or atleast talk to the chatbot in the terminal
How can I do that with the help of my SaaS

You can interact with your database through the agent using these methods:

Option 1: Terminal Chatbot (Quick Demo)

# Execute a SQL query through your agent
$body = @{
    agent_id = "agent_5ed2175c987ddecb84d5bbc6"
    user_id = "customer_1"
    sql = "SELECT * FROM your_table LIMIT 5"
} | ConvertTo-Json

Invoke-RestMethod -Uri "http://YOUR_SAAS_IP:8000/agent/query" -Method Post -ContentType "application/json" -Body $body

Option 2: Use the Web Chat Interface

# Start the frontend
cd my-app
npm install
npm run dev

Open http://localhost:3000 and use the chat interface. When you connect a PostgreSQL datasource using the agent, you can ask natural language questions like "Show me all users" and it will convert to SQL and execute through your agent.

Option 3: Simple Terminal Loop

while ($true) {
    $query = Read-Host "Enter SQL query (or 'exit')"
    if ($query -eq "exit") { break }
    
    $body = @{
        agent_id = "agent_5ed2175c987ddecb84d5bbc6"
        user_id = "customer_1" 
        sql = $query
    } | ConvertTo-Json
    
    Invoke-RestMethod -Uri "http://YOUR_SAAS_IP:8000/agent/query" -Method Post -ContentType "application/json" -Body $body
}

For the hackathon demo, Option 1 is fastest to show judges - type a query, see results come back through the secure agent connection.

[ancient-kid]

@copilot generate code for streamlit application, having one upload option (csv/excel) and text area to ask questions to the chatbot

[Copilot]

@copilot generate code for streamlit application, having one upload option (csv/excel) and text area to ask questions to the chatbot

Created Streamlit demo app in commit 7f49f06.

Run it:

cd backend/demo
pip install -r requirements.txt
streamlit run streamlit_app.py

Features:

• 📁 File upload (CSV/Excel) with data preview
• 💬 Chat interface to ask questions
• ⚙️ Sidebar for agent configuration
• 📊 Schema detection from uploaded files

Configure in sidebar:

• SaaS Server URL: http://YOUR_SAAS_IP:8000
• Agent ID: agent_5ed2175c987ddecb84d5bbc6
• User ID: customer_1

The app opens at http://localhost:8501. Upload a file, then ask questions in natural language. See backend/demo/README.md for full setup instructions.