AKKOAnalytics Kernel · Keep OwnershipDocumentationWrite to usFR

The sovereign data and AI platform. On your ground. Under your rules.

AKKO federates your Hadoop, your databases and your object storage, and puts AI on top. Every question carries the identity of the person who asks; every answer respects their rights.

Presentation mode

AKKO

Seven layers, each one replaceable. One identity crosses them all.

  • UsesCockpit, SupersetExplore, govern, publish dashboards.
  • AIADENA question in plain language becomes SQL, under the rights of the person.
  • AINORA, vector indexA data steward reviews what NORA proposes; the index finds the tables.
  • GovernanceOPA or Ranger, KeycloakRow and column rights, a single identity; every access is logged.
  • CatalogueOpenMetadataGlossary, lineage, a description for every table.
  • Semantic layerApache Ossie modelsMeasures and dimensions written once, in the open Apache Ossie format; ADEN uses them to answer right.
  • FederationTrinoOne SQL query across every source.
  • StorageIceberg on S3, Polaris catalogueOpen tables on SeaweedFS by default or your own S3, with the Apache Polaris REST catalogue.
  • FoundationKubernetes or OpenShiftThe control plane keeps the desired state; Prometheus and Grafana watch it.

Deploy wherever you want, on premises or in the cloud

Your Hadoop

Federate your Hadoop without moving your data. AKKO plugs into the cluster in place; its rights and its catalogue stay the reference.

  • ClouderaThe distribution in place, kept as it is.
  • Hive and IcebergThe Hive and Iceberg tables of the cluster, federated by Trino through its metastore.
  • HDFSThe storage of the cluster, never copied.
  • RangerThe access policies, applied to every query.
  • AtlasThe technical catalogue and lineage of the cluster.
  • KerberosThe authentication of the cluster, respected end to end.
  • ARCHEThe edition of AKKO for a Hadoop in place: federation and AI under the Ranger rights and the Atlas catalogue already defined, agents through the AKKO MCP connector. Reasoned, Controlled, Inherited, Explainable access.

Objects and databases

This island holds object storage and databases. The data stays where it is; only answers travel.

  • S3Any S3-compatible object storage (Ceph, MinIO, a host’s service), on premises or hosted.
  • SeaweedFSThe S3-compatible object storage AKKO installs by default; any other S3 storage can replace it.
  • IcebergThe open table format, with history and schema evolution.
  • Trino and its connectorsAt the heart of AKKO, Trino reads more than thirty sources in place: relational databases, warehouses, documents, search, streams, open tables. Pinot, Hudi, Delta Lake, Loki, Vertica and Exasol too.
  • PostgreSQL, MySQL, MariaDB, Oracle, SQL Server, Snowflake, BigQuery, Redshift, ClickHouse, Druid, MongoDB, Cassandra, Elasticsearch, OpenSearch, Redis, Kafka, Iceberg, Hive, Google Sheets, Prometheus, SingleStore, DuckDB

AI and agents

Models run on your ground or with a host you choose; agents go through AKKO and its rights.

  • MistralModels served by API or installed on site.
  • OllamaOpen models on a single machine.
  • vLLMHigh-throughput model serving on GPUs.
  • MCPThe gate every agent goes through; each call carries the identity of the person it works for, and each tool is authorised.
  • LiteLLMOne gateway to every model, with quotas and traces.
  • Other providers, through LiteLLMOpenAI, Anthropic, Google Gemini, Llama, Qwen, DeepSeek, Hugging Face: by explicit choice; by default, models run on your side.
  • Claude, GitHub Copilot, CursorAgents that query the data through MCP, within the rights of that person.
  • In-house agentYour own agents, on the same protocol.

The Lab

The workspace of data teams: notebooks, code, compute, models and orchestration, on the same rights.

  • JupyterLab, Jupyter AIA notebook for each person, signed in with their identity; Jupyternaut answers in the page.
  • code-serverVS Code in the browser, with dbt Power User, SQLTools and its Trino driver, and GitLens.
  • Coding with an AI assistantJupyternaut and Continue write the code on request, on models that run on your side through LiteLLM, never a cloud by default.
  • akko-labThe ready environment: libraries, connections and access to Trino, under the rights of the person.
  • SparkDistributed compute for heavy processing.
  • MLflowExperiment tracking and the model registry.
  • AirflowOrchestration of the processing chains.
MCP 4 rows2 rowscolumn masked3 rows4 rows2 rowscolumn masked3 rowsARCHEStorageFederationSemantic layerCatalogueGovernanceAIADENNORAvector indexUsesKeycloakAKKOKubernetesOpenShiftYour HadoopClouderaHiveHDFSObjects and databasesSeaweedFSIcebergTrino, 30+ sourcesAI and agentsThe LabJupyterLabcode-serverSparkMLflowDeploy wherever you want, on premises or in the cloudHover an island to see what it holds

AKKO

Seven layers, each one replaceable. One identity crosses them all.

  • UsesCockpit, SupersetExplore, govern, publish dashboards.
  • AIADENA question in plain language becomes SQL, under the rights of the person.
  • AINORA, vector indexA data steward reviews what NORA proposes; the index finds the tables.
  • GovernanceOPA or Ranger, KeycloakRow and column rights, a single identity; every access is logged.
  • CatalogueOpenMetadataGlossary, lineage, a description for every table.
  • Semantic layerApache Ossie modelsMeasures and dimensions written once, in the open Apache Ossie format; ADEN uses them to answer right.
  • FederationTrinoOne SQL query across every source.
  • StorageIceberg on S3, Polaris catalogueOpen tables on SeaweedFS by default or your own S3, with the Apache Polaris REST catalogue.
  • FoundationKubernetes or OpenShiftThe control plane keeps the desired state; Prometheus and Grafana watch it.

Deploy wherever you want, on premises or in the cloud

Your Hadoop

Federate your Hadoop without moving your data. AKKO plugs into the cluster in place; its rights and its catalogue stay the reference.

  • ClouderaThe distribution in place, kept as it is.
  • Hive and IcebergThe Hive and Iceberg tables of the cluster, federated by Trino through its metastore.
  • HDFSThe storage of the cluster, never copied.
  • RangerThe access policies, applied to every query.
  • AtlasThe technical catalogue and lineage of the cluster.
  • KerberosThe authentication of the cluster, respected end to end.
  • ARCHEThe edition of AKKO for a Hadoop in place: federation and AI under the Ranger rights and the Atlas catalogue already defined, agents through the AKKO MCP connector. Reasoned, Controlled, Inherited, Explainable access.

Objects and databases

This island holds object storage and databases. The data stays where it is; only answers travel.

  • S3Any S3-compatible object storage (Ceph, MinIO, a host’s service), on premises or hosted.
  • SeaweedFSThe S3-compatible object storage AKKO installs by default; any other S3 storage can replace it.
  • IcebergThe open table format, with history and schema evolution.
  • Trino and its connectorsAt the heart of AKKO, Trino reads more than thirty sources in place: relational databases, warehouses, documents, search, streams, open tables. Pinot, Hudi, Delta Lake, Loki, Vertica and Exasol too.
  • PostgreSQL, MySQL, MariaDB, Oracle, SQL Server, Snowflake, BigQuery, Redshift, ClickHouse, Druid, MongoDB, Cassandra, Elasticsearch, OpenSearch, Redis, Kafka, Iceberg, Hive, Google Sheets, Prometheus, SingleStore, DuckDB

AI and agents

Models run on your ground or with a host you choose; agents go through AKKO and its rights.

  • MistralModels served by API or installed on site.
  • OllamaOpen models on a single machine.
  • vLLMHigh-throughput model serving on GPUs.
  • MCPThe gate every agent goes through; each call carries the identity of the person it works for, and each tool is authorised.
  • LiteLLMOne gateway to every model, with quotas and traces.
  • Other providers, through LiteLLMOpenAI, Anthropic, Google Gemini, Llama, Qwen, DeepSeek, Hugging Face: by explicit choice; by default, models run on your side.
  • Claude, GitHub Copilot, CursorAgents that query the data through MCP, within the rights of that person.
  • In-house agentYour own agents, on the same protocol.

The Lab

The workspace of data teams: notebooks, code, compute, models and orchestration, on the same rights.

  • JupyterLab, Jupyter AIA notebook for each person, signed in with their identity; Jupyternaut answers in the page.
  • code-serverVS Code in the browser, with dbt Power User, SQLTools and its Trino driver, and GitLens.
  • Coding with an AI assistantJupyternaut and Continue write the code on request, on models that run on your side through LiteLLM, never a cloud by default.
  • akko-labThe ready environment: libraries, connections and access to Trino, under the rights of the person.
  • SparkDistributed compute for heavy processing.
  • MLflowExperiment tracking and the model registry.
  • AirflowOrchestration of the processing chains.
MCP 4 rows2 rowscolumn masked3 rows4 rows2 rowscolumn masked3 rowsStorageFederationSemantic layerCatalogueGovernanceAINORAADENvector indexUsesKeycloakAKKOYour HadoopObjects and databasesAI and agentsThe LabTap an island to see what it holds

Built on the technologies you know

  • Trino
  • Apache Iceberg
  • SeaweedFS
  • OpenMetadata
  • Apache Airflow
  • Apache Spark
  • Apache Superset
  • JupyterHub
  • MLflow
  • Keycloak
  • Open Policy Agent
  • Kubernetes
  • OpenShift
  • PostgreSQL
  • OpenSearch
  • Ollama
  • vLLM

Federation

Start by federating, without moving your data.

Your data stays in PostgreSQL, Hive or Iceberg. AKKO exposes it through a single Trino engine: one SQL query, several sources, one result. Only the requested rows travel.

Every query runs under the identity of the signed-in person. Row and column rules apply at query time, across every source, and every execution is logged.

The catalogue fills up as you federate: NORA suggests descriptions and flags what is missing. When a source deserves a copy, Iceberg and Airflow take over, on your team's decision.

WITH COPYPostgreSQL · customersHive · salesIceberg · logsETLCopied warehouseyesterdayDashboardThree copies to maintain.Rights copied by hand.Yesterday's data.WITHOUT COPY, WITH AKKOIN PLACE, WITH YOUPostgreSQL · customersHive · salesIceberg · logsSELECT … FROM pg.clients JOIN hive.ventesSQL engineTrino, under the identity of the personNotebook, BIor ADENNo copy.Rights applied by the engine, on every query.The data at the moment of the question.

What AKKO installs on your side

Nine layers, one cockpit, one identity.

Each layer is an open component you know, installed and wired by AKKO, replaceable by what you already have. The cockpit brings them together; the identity of the signed-in person runs through all of them.

Keycloak

Pick a layer to lift it.

Uses

The cockpit brings every layer together; each screen opens under the identity of the signed-in person.

  • AKKO cockpitExplore, govern and publish from a single entry point.
  • SupersetDashboards, with the rights of the signed-in person.
AKKO cockpit, home page

AI

By default, models run on your side. Every answer shows its steps.

  • ADENA question in plain language becomes SQL, under the rights of the person.
  • NORAA data steward reviews what NORA proposes for the catalogue.
  • Vector indexIt finds the tables that answer the question.
ADEN, the steps of a governed answer

Lab

Data teams work on the same data, under the same rights.

  • JupyterHubA notebook for each person, signed in with their identity.
  • SparkDistributed compute for heavy processing.
  • MLflowExperiment tracking and the model registry.
AKKO cockpit, platform roles and access to tools

Orchestration

Processing runs on a schedule or an event, and its lineage reaches the catalogue.

  • AirflowScheduled processing chains and their follow-up.

Governance

Rules apply at query time, on every source, for a dashboard, a notebook or an answer of the AI.

  • OPA or RangerRow and column rights, applied to every query.
  • KeycloakOne identity, from your directory.
  • Access logEvery access is logged.
AKKO cockpit, data access: policies per catalogue and per group

Catalogue

The same truth for people and for models; NORA proposes, a data steward reviews.

  • OpenMetadataGlossary, lineage, owners and a description for every table.
AKKO cockpit, NORA: review of catalogue enrichments

Semantic layer

Measures and dimensions are written once; ADEN uses them to answer right.

  • Apache Ossie modelsAn open format for shared definitions.

Federation

Your data stays in its sources; only the requested rows travel.

  • TrinoOne SQL query across every source, without copying data.
AKKO cockpit, federated data sources

Storage

Open-format tables on your storage, readable by any engine.

  • Iceberg on S3The open table format, with history and schema evolution.
  • Apache PolarisThe REST catalogue of the Iceberg tables.
  • SeaweedFSThe object storage installed by default; any S3 storage can replace it.

Foundation

AKKO installs from one Helm chart, on premises or in the cloud.

  • Kubernetes or OpenShiftAny conformant distribution.
  • Control planeIt keeps the desired state of every brick and restores it.

Sovereignty

Sovereignty, in concrete terms.

No data passesthrough AKKOModelsIndexesLogsDirectoryAKKOOpen formatsYour toolsIceberg · ParquetYour ground No data passesthrough AKKOModelsIndexesLogsDirectoryAKKOOpen formatsYour toolsIceberg · ParquetYour ground
Built in France
AKKO is a French project. The platform is designed and developed in France.
Hosted with you
The platform, the default AI models, the indexes and the logs run in your cluster. No data passes through AKKO.
Identity end to end
Your directory remains the source of accounts and groups; data rights are expressed per group and apply down to the query, including the assistant's answers.
Reversibility
Open formats (Iceberg, Parquet), an OpenMetadata catalogue, a Trino engine: your data and metadata can be read back with tools you do not buy from AKKO.

Deployment

AKKO deploys anywhere, on premises or in the cloud.

One Helm chart, one values file per environment, the same result everywhere: your servers, a sovereign cloud or a public cloud, connected to the Internet or isolated. On premises and with sovereign hosts, AKKO is installed and tested; on the managed Kubernetes of public clouds, it is compatible by construction.

helm install akkoON PREMISESYour serversbare metal or virtualisedSOVEREIGN CLOUDOVHcloud, Scaleway, Outscalein your accountPUBLIC CLOUDAWS, Azure, Google Cloudon their managed KubernetesNO INTERNET ACCESSIsolated networkembedded images and chartsSAME CHART · SAME IMAGES · KUBERNETES OR OPENSHIFT

Ecosystem

What AKKO connects to.

AKKO installs on what exists and federates it: a Kerberised Hadoop cluster with Ranger and Knox, an ODP or OKDP distribution, a corporate directory, databases and lakes in place, sovereign models running on your side.

Where it runs

  • Kubernetes
  • OpenShift
  • OVHcloud
  • Scaleway
  • Outscale
  • AWS
  • Azure
  • Google Cloud
  • Any managed Kubernetes

Existing Hadoop estates

  • Cloudera
  • Kerberos
  • Apache Ranger
  • Apache Knox
  • Hive Metastore
  • ODP (Clemlab)
  • OKDP (TOSIT)

Data sources

  • PostgreSQL
  • Apache Iceberg
  • Apache Hive
  • SeaweedFS / S3
  • MySQL
  • Oracle
  • ClickHouse
  • MongoDB
  • Cassandra
  • Elasticsearch
  • Kafka
  • Delta Lake

Identity

  • Keycloak
  • LDAP
  • Active Directory
  • Kerberos
  • Open Policy Agent
  • Apache Ranger

Models

  • Mistral
  • Ollama
  • vLLM
  • LiteLLM
  • Qwen
  • DeepSeek
  • Llama
  • OpenAI
  • Anthropic
  • Google Gemini
  • Hugging Face
  • Any OpenAI-compatible endpoint

Catalogue, semantics and observability

  • OpenMetadata
  • Apache Polaris
  • Apache Ossie
  • OpenSearch
  • Prometheus

Sovereign AI

Connect your federated sources with Trino, query them with Mistral.

ADEN puts the question to a model and runs the SQL on the federated engine, under the identity of the person. The model is the one you choose: Mistral, Qwen or DeepSeek running in your cluster with Ollama or vLLM, or the API of Mistral AI, a French company. Every answer comes with its chart, its SQL, its steps and the name of the model that produced it.

  1. PostgreSQL · Hive · Iceberg
  2. Trino
  3. ADEN
  4. Mistral · Qwen · DeepSeek
ADEN, choix du modèle
The choice of model, per question or automatic.
ADEN, réponse de mistral-small avec graphique et SQL
An answer from mistral-small: chart, interpretation, executed SQL.
ADEN, les étapes de la réponse
The nine steps of the answer, from resolved rights to the confidence score.

Governed AI

The same question, two accounts, two answers.

ADEN turns a question into SQL and runs it under the identity of the person asking. That person's row filters and column masks apply, as they do for a dashboard or a notebook. Below, the same question asked by an analyst and by an administrator.

« Customers and their country »AnalystYour teamsAKKOKeycloakGovernance · rights of the personFederation · Trino « Customers and their country »Your teamsAKKOKeycloak

carol_analyst analyst, France scope

1 column masked2 rows

emailmaskedcountry
***@gmail.comFR
***@outlook.comFR

alice_admin administrator

no column masked4 rows

emailcountry
marie.martin0@gmail.comFR
thomas.devries1@outlook.comDE
lea.dubois2@proton.meES
joao.silva3@gmail.comPT
Same question, same SQL, same engine. The rights of each person make the difference.

The two answers, as the cockpit shows them.

ADEN, carol_analyst
carol_analyst sees masked emails and only the scope she is allowed: “1 column masked”.
ADEN, alice_admin
alice_admin sees the emails in clear: “no column masked”. Same question, same SQL, same engine.
ADEN, steps of an answer
Every answer shows its steps: access rights resolved, tables allowed by the policy, generated SQL, confidence score. The reasoning can be exported.

External agents

Cursor, Claude Code or a Mistral agent on your data, under the same rules.

An agent wired with a technical account reads everything; the only guardrail left is the prompt. In AKKO and ARCHE, akko-mcp-trino carries the person's identity down to Trino, refuses any write and logs every call. It connects to the Trino you already have, with your directory.

tests/proofs/akko-mcp-trino-adversarial-live-proof.sh
== 3. Verifications ==-- A. concurrence (streamable-http) : 2 utilisateurs x 4 sessions x 3 appelsOK    appels aboutis24OK    alice : 12 reponses en clair12OK    carol : 12 reponses masquees12OK    reponses croisees (fuite)0-- B. adverseOK    DROP refuseRead-only modeOK    WITH qui enveloppe un DELETE refuseRead-only modeOK    EXPLAIN ANALYZE d'une ecriture refuseRead-only modeOK    carol : TABLE(system.query) refuse (sans masque)Read-only modeOK    injection dans tableTrueOK    jeton signe par une autre cle401/unauthenticatedOK    jeton expire401/unauthenticated== PREUVE ADVERSE OK ==

Every version is proven by replayable scenarios against a real cluster, from the nominal case to adversarial ones, including a Mistral agent and Claude Code as host.

  • 21/21 functional
  • 35/35 adversarial
  • 10/10 Mistral agent
  • 7/7 real host
  • 8/8 two people
  • 26/26 context and catalogue

The proofs in detail

Open source

Discover our published bricks.

The core of akko-mcp-trino is published under the Apache 2.0 licence, on PyPI and GitHub. Its advanced features are delivered in AKKO and ARCHE. akko-lab will be published soon. The building blocks it relies on (Trino, Iceberg, OpenMetadata, Airflow, Spark, Superset, JupyterHub, MLflow) are open source projects that we do not fork.

GitHubPyPIThe coreDocumentation

0.5.3 · Apache 2.0

akko-mcp-trino

Governed MCP server for Trino, read-only. Every call can carry the person's identity down to the engine, which decides.

PyPI · Python 3.12 and 3.13
Soon

akko-lab

The platform lab: notebooks, code environments and models, with data access governed like everything else.

Planned

Identity broker

Carrying the person's identity across several directories and engines, without a shared account.

Planned

Policy sync

A classification set in the catalogue becomes a policy in Ranger, and a refusal in the engine.

Who it is for

Three situations where AKKO gets installed.

A complete platform, on your side

You start from an ageing Hadoop distribution or from nothing, and you want a whole data and AI platform on your Kubernetes, including without Internet access, with your directory. The platform

An AI that answers under your rules

You already have governed data and you want a model to answer on it without ever reading what is forbidden, with an audit receipt per question and models running on your side by default. ADEN and NORA

External agents on an existing Trino

You have a governed Trino, on ODP, Cloudera or Kubernetes, and you are asked for Cursor, Claude Code or an in-house agent on top of it. akko-mcp-trino connects to it, under the identity of each person. akko-mcp-trino

Blog

What we learn while building AKKO.

A technical question?

Write to us.

Write to us The source code

contact@akko-ai.com