vanna

What it is and what it does

Vanna is a Python framework that bridges natural language and SQL by using an LLM to translate user questions into database queries, execute them, and return results as interactive visualizations and summaries. It ships with a pre-built web component (`<vanna-chat>`) that can be embedded in any webpage and handles authentication via your existing cookies or JWT tokens.

The package is designed for multi-tenant and enterprise use cases, with built-in support for user-aware permissions, row-level security filtering, audit logging, and streaming responses. It integrates with any LLM (OpenAI, Anthropic, Ollama, etc.) and any SQL database (PostgreSQL, MySQL, Snowflake, BigQuery, SQLite, etc.), and provides extension points for custom tools, lifecycle hooks, and observability. However, the repository is archived and abandoned, which may affect long-term support and security maintenance.

Use it for:

• Build a natural-language analytics dashboard where non-technical users ask questions and get instant SQL results, tables, and charts without writing queries.
• Add a multi-tenant chat interface to a SaaS product with automatic row-level security filtering so each user sees only their permitted data.
• Embed a pre-built web component in an existing web app to enable conversational data exploration without building a custom chat UI.
• Implement audit logging and rate limiting per user for compliance and cost control in enterprise data access scenarios.
• Extend Vanna with custom tools (e.g., email, Slack notifications) to create an agentic workflow that answers questions and takes actions.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Vanna converts natural language questions into SQL queries and executes them against databases, returning results as interactive tables, charts, and summaries with user-aware permissions and streaming responses.

Yes, with strong conditions. Vanna is feature-rich and well-suited for building natural-language data interfaces with enterprise security and streaming UI components. However, the repository is archived and marked abandoned, which means security patches for the two known vulnerabilities (GHSA-6mj8-jmp2-g8q7, PYSEC-2026-3397) are unlikely to be released. Install only if you can accept the security risk, have the capacity to fork and patch if needed, or plan to migrate away within a defined timeframe. For new projects requiring long-term support, consider alternatives with active maintenance.

Install

vanna on PyPI

pip install vanna

uv add vanna

poetry add vanna

Installing vanna

Before you install

Low install friction with a pure-Python wheel and no compiled dependencies. However, the repository is archived and marked abandoned as of the latest commit on 2026-02-02, raising concerns about future maintenance and security updates despite recent release activity.

License in practice

MIT license (permissive) means you can use, modify, and distribute Vanna freely in commercial and private projects with minimal restrictions, though you must include the license notice.

Quickstart

pip install vanna

from vanna import Agent
from vanna.integrations.anthropic import AnthropicLlmService
from vanna.tools import RunSqlTool
from vanna.integrations.sqlite import SqliteRunner

llm = AnthropicLlmService(model="claude-sonnet-4-5")
agent = Agent(llm_service=llm)
agent.tool_registry.register(RunSqlTool(sql_runner=SqliteRunner("data.db")))
# Query via agent.chat("Show Q4 sales")

Requires Python 3.9 or later; also requires an LLM API key (e.g., Anthropic, OpenAI) and a supported database connection.

Verify before relying

• Whether the archived repository status means security patches will still be released for the two known vulnerabilities (GHSA-6mj8-jmp2-g8q7, PYSEC-2026-3397).
• Whether the 10 runtime dependencies (pydantic, click, pandas, httpx, PyYAML, plotly, tabulate, sqlparse, sqlalchemy, requests) introduce any transitive vulnerabilities or breaking changes.
• Whether the streaming and enterprise features (row-level security, audit logs, rate limiting) are fully production-tested or still experimental.

Package facts

Evidence: vanna-2.0.2-py3-none-any.whl

Tags

More Front-Ends packages