AI tool listing.
CoreBase is no longer a pre-launch enterprise-data concept. The current product is infrastructure for building governed AI agents on live business systems: databases, REST and GraphQL APIs, SaaS applications, uploaded documents and on-premise or legacy systems.12 It can be used through a hosted chat/API, an embeddable widget or an open-source on-prem gateway called CoreMCP. The important product idea is governance around the agent’s access rather than a proprietary reasoning model.
The hosted platform is designed around per-caller scope. Developers can sign user-specific tokens that limit which sources a person may access and apply quotas or policies before the agent runs.1 CoreBase says tenant isolation is enforced at the data-access layer and that each question executes under the identity/scope of the person asking rather than giving a shared agent broad organization-wide credentials.13 That is a materially safer starting point for customer-facing agents than relying on prompt text such as “only show this user their own data.”
Read access is conservative by default. Database connections are documented as read-only unless writes are explicitly enabled, and mutating API operations are not exposed to the agent unless the connection permits them.3 When writes are enabled, policies can require a human approval before a consequential action runs. CoreBase’s current product example holds a refund over a configured threshold, preserves the exact proposed call and executes only after approval.1 This is stronger than asking the model to remember a policy because the restriction is enforced outside the model.
The product also limits which tools an agent receives. CoreBase describes its governance system as compiling rails so a step that should not reach a source does not receive the relevant tool at all.1 That reduces the attack surface from prompt injection or model misbehavior: a model cannot be persuaded to invoke a capability that was never bound into the execution step. The platform also records allowed, blocked and approved actions in an audit trail.1
CoreMCP handles the difficult on-premise side. It is an Apache-2.0 open-source Go gateway that runs near the customer’s databases and can connect outward over WebSocket rather than requiring inbound firewall exposure.4 Current stable adapters include Microsoft SQL Server and PostgreSQL; SQL Server support extends back to very old versions and includes legacy/Turkish-collation handling. Firebird remains in progress and MySQL is on the roadmap in the current repository.4 This distinction matters: marketing may speak broadly about legacy connectivity, but not every planned adapter is equally mature today.
For fully isolated deployments, CoreBase documents cloud-direct, cloud-relay, self-hosted/VPC and Enterprise air-gap modes.2 In an air-gapped design, the entire stack can remain within the customer perimeter rather than sending raw rows to CoreBase Cloud. For ordinary cloud-relay use, the on-prem CoreMCP gateway executes against local systems and returns relevant results through the encrypted connection; the exact data path therefore depends on deployment mode and should be reviewed per workload.56
The managed platform adds semantic context above raw connectivity. Query Memory and schema/business-glossary annotations let teams define what internal fields and concepts mean so the agent does not have to rediscover business semantics in each prompt.23 This is valuable for legacy schemas where a technically correct SQL query can still answer the wrong business question if internal codes, exclusions or company terminology are not modeled.
CoreBase is also designed to cross systems in one answer. An internal assistant can query a database, payments API and other systems, combine the results and show the query/actions used.3 That makes it closer to a governed agent runtime than to a narrow text-to-SQL tool. The same engine can be embedded into a customer-facing product through an OpenAI-compatible API or widget.2
The SDK story is still moving. CoreBase’s Python package reached PyPI in July 2026 but is now marked archived, while the hosted API remains OpenAI-compatible and the documentation emphasizes direct API/widget use.72 An archived first-party SDK is not fatal when the protocol surface is simple, but it is a maintenance signal developers should notice rather than assuming every client library is actively supported.
CoreBase now has public pricing. Free costs $0 and is described as free forever for one data source. It includes a one-time $1 built-in-model credit, optional BYOK model credentials, Developer API access, the embeddable widget, Query Memory, per-tenant isolation and read-only defaults.1 When the included model credit is exhausted, built-in model calls pause rather than generating an automatic charge; users can top up or attach their own provider key.1
Growth costs $79 per month on monthly billing. It adds five data sources across three projects, $5/month of included AI usage, REST/GraphQL and cloud-database connectors, on-prem database access through CoreMCP, document upload/RAG, enforced guardrails and email support.1
Team costs $249 per month and removes the published data-source/project caps, includes $15/month of AI usage, and adds RBAC, full audit logs, per-member usage/cost analytics and priority support.1 Enterprise is custom-priced for air-gapped/on-prem container deployments, dedicated infrastructure, SSO/SAML, SLA and dedicated support.1
Annual billing is advertised at a 25% discount.1 The product also supports BYOK so teams can pay an external model provider directly rather than consume CoreBase’s built-in inference allowance. This separation between platform fee and model spend is useful because it makes the governance/data layer independently purchasable from the LLM relationship.
The included model allowances are deliberately small relative to the platform prices. That suggests the subscription is principally buying connectors, isolation, governance, audit and delivery infrastructure rather than subsidized inference. Teams should therefore estimate model cost separately, especially for long-running or high-volume agents.
The free tier is meaningful for prototyping because it includes the API/widget and one live source rather than restricting the user to a static demo.1 The Growth jump to $79/month is reasonable if CoreBase replaces custom connector/governance engineering, but expensive if the use case is only one internal read-only SQL assistant that could be served directly by CoreMCP or another MCP server.
There is some pricing-document drift in external directories. Recent third-party directory pages still list entry pricing around $49 or $79 depending on crawl date.89 The current first-party $79 Growth price is the reliable current figure; older third-party amounts are stale and should not be averaged into it.
CoreBase has a strong technical first-party surface but very little independent exact-product validation. No substantive exact-product benchmark or mature enterprise user corpus was located. This prevents high confidence in reliability, support quality or real-world governance outcomes.
The open-source CoreMCP repository materially improves inspectability. The gateway is Apache-2.0 licensed, exposes its adapters and read-only defaults, documents security reporting and can be run independently with ordinary MCP clients.4 Open source does not validate the hosted control plane or prove enterprise security, but it allows customers to inspect the code sitting inside their network and to keep database credentials local.
The current repository also provides useful maturity boundaries instead of pretending every connector is complete. MSSQL/PostgreSQL and relevant transports are listed as stable; Firebird is still in progress and other functionality remains on the roadmap.4 This is a positive transparency signal. It also means buyers should validate the exact source they need rather than relying on broad “legacy ERP” messaging.
Current third-party evidence is mostly directory/discovery coverage rather than reviews. ToolStory describes the API/free-tier surface and current governed-agent positioning; Toolify lists the product but shows zero reviews; PeerPush likewise has no user ratings at capture.8109 These sources confirm that the product exists and is being indexed, but provide essentially no independent satisfaction evidence.
Security positioning is technically thoughtful. CoreBase emphasizes read-only database defaults, per-tenant isolation, scoped tokens, explicit write enabling, human approval for configured risky actions, audit logs and outbound-only on-prem connectivity.124 Those are strong architectural controls for agents touching production systems. They are first-party controls, not a substitute for an external certification or penetration-test report.
SOC 2 is specifically not complete today. CoreBase’s own comparison material says SOC 2 is on the roadmap and contrasts that with a competitor already holding SOC 2 Type 2.11 CoreBase should therefore not be described as SOC 2 compliant today. For procurement teams, that is a material maturity gap if certification is mandatory.
The most serious weakness is legal-document synchronization. The current Terms, last updated May 17, 2026, explicitly describe CoreBase as an API/SDK for AI-agent memory and context, yet the user representations say users will not access the Services through automated or non-human means and the prohibited-activities section broadly bans automated system use, robots, scripts and scrapers.12 Read literally, this conflicts with ordinary programmatic use of an API whose entire purpose is agent automation. There may be an intended distinction between authorized API calls and unauthorized automation of the website, but the Terms do not express that distinction cleanly enough.
The Terms contain a second, even more important mismatch with Enterprise marketing. The product page markets Enterprise for air-gapped or regulated environments.1 The Terms state that the Services are not tailored to HIPAA or FISMA and say users whose interactions would be subject to such laws may not use the Services; they also say the Services may not be used in a way that violates the Gramm-Leach-Bliley Act.12 A generic claim that CoreBase supports “regulated environments” therefore must not be interpreted as support for every regulated workload. Buyers in healthcare, government or regulated financial services need an explicit contractual deployment analysis before adoption.
The public Terms also point to a Privacy Policy and state that Services are hosted in the United States, but the dedicated privacy page could not be substantively retrieved during this audit.12 Older first-party marketing copy states zero-data-training and local-only/on-prem protections for relevant deployments.13 Those are useful claims, but the inability to read the current privacy document during review leaves a documentation gap for a product whose central selling point is access to sensitive enterprise data.
Air-gapped deployment mitigates some data-path concerns but does not erase contractual questions. An Enterprise container running entirely within the customer perimeter can materially reduce data egress, while cloud-relay deployments necessarily involve some result/context path to the hosted agent/model layer.25 Customers should document exactly what leaves the source system, which model receives it, how logs/memory are stored and whether BYOK changes the processing chain.
Approval enforcement is a genuine strength if the configured policy matches the risk. CoreBase says a held action is preserved as the exact call that a reviewer approves rather than being regenerated after approval.1 That avoids a subtle failure mode where a human approves one proposed action and the model executes a newly generated variant. The remaining risk is policy design: if a dangerous operation is not marked as gated or the source is over-scoped, the enforcement layer cannot infer every business consequence automatically.
The evidence therefore supports low-to-medium confidence in the product architecture but low confidence in a public numeric ranking. CoreBase looks substantially more mature than the old early-access record, yet certification, contractual alignment and independent production evidence have not caught up with the feature set.
CoreBase is best suited to developers shipping AI features that need access to each end customer’s live systems without constructing tenancy, connector authorization, audit and approval logic from scratch.12 The embeddable widget and OpenAI-compatible API make it particularly relevant to B2B SaaS products that want to add a data-aware assistant inside their own interface.
Internal platform teams are another strong fit. A company can put an assistant in front of databases and operational APIs while preserving role/project scope, read-only defaults and an attributable audit trail.3 This is useful where dashboards cannot anticipate every business question but giving broad SQL credentials to staff would be inappropriate.
Legacy/on-prem organizations are a differentiated target. CoreMCP can run behind the firewall and supports older SQL Server deployments that mainstream cloud-agent connectors often ignore.56 Teams with PostgreSQL or supported legacy SQL environments can modernize access without performing an ETL migration first.
CoreBase is also well suited to agents that must occasionally write to production systems. The product can expose writes selectively and place configured high-risk operations behind human approval.1 That is safer than a general-purpose tool connector in which the model automatically inherits every OAuth capability.
It is less compelling for a single-user internal agent with one database and no multi-tenant/governance requirement. The company’s own comparison material acknowledges that a simpler tool layer may be enough when there is only one agent and one credential set.11 CoreMCP alone may also cover a narrow local read-only use case without the full managed platform.
Organizations whose procurement baseline requires SOC 2 Type 2 should wait or obtain alternative assurance because CoreBase states certification is still on the roadmap.11
Regulated buyers must be especially careful. Enterprise marketing mentions regulated deployments, but the current Terms expressly exclude or constrain important HIPAA/FISMA/GLBA contexts.112 Air-gapping is a deployment property, not proof of legal compliance.
Finally, teams that require stable first-party SDK support should evaluate direct API use because the Python package on PyPI is currently marked archived.7 The OpenAI-compatible HTTP surface reduces the impact, but SDK lifecycle should be part of integration planning.
Products matched by shared tasks, audience, workflow, product type and capabilities.