QueryCraft

QueryCraft was my final-year engineering project, built by a team of three. I was the primary technical contributor: the conversational interface, generation through locally hosted models, validation before execution, execution safeguards and the self-hosted inference setup.

Getting a model to emit something that looks like SQL is easy. A model will also produce queries that are syntactically valid but wrong or unsafe, and unlike a chat reply, a query has consequences when it runs. So generation was treated as a proposal: each query came back with an explanation in a card, and nothing ran until the user chose to execute it.

• A validation step ran before execution and blocked destructive statements.
• That check ran in the client and matched patterns rather than parsing the query, and database connections were not restricted to read-only accounts.
• That is a prototype's level of protection, and a later review of the original code recorded the same gaps. I describe it here as what it was.

Generation ran on open models (Qwen and Mistral) through Ollama on hardware we controlled, rather than through a hosted API. With smaller models there is nowhere to hide a weak prompt or a missing check, which made the constraint instructive.

HubZero later rebuilt QueryCraft as a separate production codebase. That rebuild is not the final-year project and is not described here as my work.