Data sources
Scopwis separates data access from analytical execution. OpenDAL and provider adapters expose authorized objects or tables; DataFusion and registered analysis methods perform bounded computation over those authorized inputs.
Source types
A source can advertise one or more access modes:
- batch — files, objects, snapshots, and table-like data read on demand;
- realtime — provider-backed tables or fresh snapshots;
- stream — bounded server-managed event windows.
The catalog is an authorization-aware view, not a promise that every listed object is queryable. The Server revalidates access when metadata or data is read.
Managed data sources
Use Settings → Data sources to create or inspect governed sources. Credentials remain server-side.
Choose local files, online storage, databases, event streams or built-in public data in the same source editor. For an online source or database, enter its location and credentials together and save once. The server encrypts the saved connection automatically. You can reuse a saved connection or manage its deletion and Agent permissions under Saved connections.
Database adapters discover actual authorized schemas and tables and publish complete read-only snapshots into the same analytical pipeline. A snapshot is limited to 32 tables, 256 columns per table, 100000 rows and 32 MiB across the source; an oversized refresh fails without replacing the last verified snapshot. Select fewer tables for larger databases. SQLite and DuckDB files must already exist below the server data root.
Available database engines are PostgreSQL, MySQL, SQLite, DuckDB, SQL Server, ClickHouse, BigQuery, Snowflake, Trino, Presto and Databricks SQL. PostgreSQL and MySQL protocol-compatible engines use their existing connection fields. Trino connectors can expose other authorized databases and lakehouses through the same read-only pipeline. Tables and views are discovered from the actual account permissions.
Supported files include CSV, TSV, JSON arrays, NDJSON / JSONL, Parquet, Avro, ORC, Arrow IPC file / stream / Feather V2, Excel XLSX / XLSM / XLS / XLSB and ODS. When a workbook contains several sheets, the Agent lists the actual sheet names before selecting one; each sheet remains a distinct analytical target. Workbooks require unique text column headers and use stored values; macros and formulas are not executed. Encoded files are limited to 64 MiB, and workbook/ORC expansion and normalized output are also bounded. An engine appears only when its adapter is available from the server.
Saving, installation, and reconnection disable duplicate actions while pending. After you switch settings sections, a previous request cannot clear your current draft or overwrite the new section's loading state. An operation already sent to the Server may still complete; return to its section and refresh to inspect the actual result.
Analyze a specific object
Open the data-object browser from Analyze or desktop navigation, choose a source, and search its object list. Selection opens an inspector on desktop and a detail page on compact screens. Review the object and use the explicit analysis action; selection alone does not start a run. Scopwis sends the Agent an explicit source ID and object path.
Some object stores cannot enumerate their contents but still allow an authorized direct read by path. In that case, a path you explicitly supplied can still be inspected even when the discovery result contains an empty object list. Provider-backed relations remain stricter: the relation must be explicitly discovered before metadata inspection.
External capabilities and MCP
MCP / external capabilities are connected under Settings and follow a probe-first, commit-last flow. Only host-approved research-read tools are projected into the Agent. A remote tool description or readOnlyHint never replaces local authorization.
External tabular results can be materialized into bounded dataset snapshots and then enter the same query/mining/evidence path as native sources.
MCP authentication
Choose the authentication mode provided by your MCP server:
| Mode | Configuration |
|---|---|
| None | Use only when the server intentionally requires no credentials. |
| Bearer token | Enter the access token. |
| HTTP Basic | Enter the username and password. |
| Mutual TLS | Paste the client certificate chain and private key in PEM format. Optionally supply a private server CA. The endpoint must use HTTPS; certificate and hostname verification remain enabled. |
| API key header | Enter the provider's header name, such as X-API-Key, and the API key. |
| OAuth browser sign-in (S256 PKCE) | Enter the issuer, authorization and token endpoints, Client ID, scopes, and public-client or secret-based token authentication. Register the public Scopwis callback /api/v1/capabilities/oauth/callback; complete authorization in the browser, then review tools. |
| OAuth 2.0 client credentials | Enter the token endpoint, Client ID, Client Secret, optional space-separated scopes, and the provider's token authentication method (client_secret_basic or client_secret_post). |
Use Test connection before reviewing and saving the exposed tool catalog. Test performs authenticated initialization and tool discovery. Credential replacement also verifies discovery before it is persisted; removal moves the connector into an explicit reconnect state.
Credentials remain encrypted on the Server and are excluded from the manifest and Agent context. OAuth client credentials obtain a fresh, resource-scoped Bearer token for each MCP operation. Client credentials serve machine identities. Browser sign-in uses a separate Authorization Code + S256 PKCE mode and keeps tokens on the Server; expired connections require browser sign-in again. Its local reuse deadline defaults to one hour when the provider omits expires_in, and is capped at 24 hours when a longer lifetime is declared. Refresh tokens, automatic authorization-server discovery, and JWT assertions are not implemented.
GitHub sign-in is configured separately under Settings → Account; see Configuration.
Data-source rules that matter
- Credentials are not placed in Agent observations.
- Source IDs and object paths do not grant access by themselves.
- Query execution is read-only and typed.
- A stream window is not assumed to be complete history.
- Reconnect/credential state is explicit; Scopwis does not fabricate an empty source when a durable store cannot be read.
- Old artifacts remain immutable even when a source is later refreshed or removed.
Continue with Analyze or Data mining.