AI assistant and MCP
Sondar has two AI features, and both are in every edition:
- Ask in plain English on the Search page writes a SonQL query from a question.
- An MCP server lets AI clients that speak the Model Context Protocol (Claude, Copilot, Cursor and others) search Sondar, read-only.
Neither one sends anything to Sondar.
Ask in plain English
Section titled “Ask in plain English”An administrator sets it up under Settings > Advanced Settings > AI assistant:
| Setting | What to enter |
|---|---|
| Endpoint | The base URL of an OpenAI-compatible API, for example http://ollama.internal:11434/v1 for a model on your own network, or your cloud provider’s. /chat/completions is added. |
| Model | The model name the endpoint expects. |
| API key | Optional; many on-network endpoints need none. It is encrypted in the browser, stored as ciphertext and never shown again. |
It is off until you turn it on, and while it is off nothing is sent anywhere. Try a question sends a sample question and shows the query that comes back.
Once it is on, the Search page shows Ask in plain English above the query bar. The answer is written into the query editor and is not run: read it, change it if you like, then search. That is also a quick way to learn SonQL.
What is sent to your endpoint: the question, the names of the indexes the asking user is allowed to read, and the field names of the index they ask about. No log data is sent.
What comes back is checked. Sondar parses the query with the same parser search uses. If it does not parse, the model is asked once more with the parser’s own message. If it still does not parse, you see the query marked as one that may not run, with the reason. A query that contains a backtick is always refused, because a backtick in SonQL is a macro reference, not a quote.
The MCP server
Section titled “The MCP server”The endpoint is https://<your-sondar>/api/v1/mcp (JSON-RPC over HTTP POST). An
MCP client authenticates as a Sondar user with an app token, sent as
Authorization: Bearer <token>; create one under Configure > Access Control >
App Tokens. It offers three tools, all read-only:
| Tool | What it does |
|---|---|
list_indexes | The indexes the token’s user may read. |
list_fields | The fields of one index, from the last 24 hours. |
search | Runs a SonQL query and returns the rows as JSON: at most 500 rows (100 by default), at most 30 days back (60 minutes by default). |
A search runs with that user’s permissions: index access, row-level limits and masking apply exactly as on the Search page. The MCP server does not use the AI endpoint above; the model belongs to the client.