# Nightshift

> The data and analytics layer for AI agents. Connect a source once and any agent gets exactly the data you allow, enforced down to the row, over MCP. The keys never leave your control.

Nightshift, in three verbs. Connect a data source and Nightshift builds a connector and a governed catalog; the data stays where it lives. An agent writes a request against that catalog and queries it live, with no warehouse to stand up. The compiler mints a policy-enforced endpoint, identity-aware and enforced the moment the request arrives: allow, deny, or mask by row, column, and value. Any consumer can call that endpoint (an MCP tool, a browser, a data app), with agents the expected primary consumer. When a policy needs a human, the request is held for an approval before anything flows. Credentials never reach the agent or its model, and observability falls out of routing every access through one compiler.

## Product

- [Console](https://nightshift.sh/console): The governed data layer your team and your agents share: connect any source, query it live in notebooks or over MCP, and govern every read and write by identity.
- [Connect](https://nightshift.sh/connect): Point Nightshift at a source and it builds a connector and a governed catalog. The data stays where it lives; no copy into a warehouse, no key handed to an agent.
- [Govern](https://nightshift.sh/govern): Identity-aware policy, enforced the moment a request arrives: allow, deny, or mask by row, column, and value, down to a named identity.
- [Query](https://nightshift.sh/query): Any agent queries the governed catalog live: analytics that run at the edge of the source, with views, snapshots, and time travel, delivered over MCP.
- [Pricing](https://nightshift.sh/pricing): Usage-based pricing, shown on the page. A free workspace covers one source, with row-level policy and live queries.
- [Product tour](https://nightshift.sh/demo): A guided walkthrough of the platform: catalog, policies, identities, approvals, endpoints, and the audit log.

## Use cases

- [Financial services](https://nightshift.sh/use-cases/financial-services): Identity-aware, row-level access to portfolio, borrower, and fund data. PII and MNPI masked before they leave, sensitive actions gated.
- [Healthcare](https://nightshift.sh/use-cases/healthcare): Clearance-aware access to clinical and claims data. PHI masked in the compiler, restricted records denied, every access logged.
- [Industrial ops](https://nightshift.sh/use-cases/industrial-ops): Agents read the line through the catalog. The path that moves a machine is never exposed, so a wrong write cannot happen.
- [Logistics](https://nightshift.sh/use-cases/logistics): Each partner agent sees only its own lanes across the TMS, WMS, and carrier APIs. Consignee contacts masked, margins denied.
- [Public sector](https://nightshift.sh/use-cases/public-sector): Clearance-aware access to case, benefits, and records data. Sensitive fields masked, restricted records denied, every read on the record.
- [Retail](https://nightshift.sh/use-cases/retail): Governed access to commerce, CRM, and inventory data. Customer PII masked before it leaves, pricing kept behind a gate.

## Company

- [About](https://nightshift.sh/about): Who builds Nightshift and why.
- [Partners](https://nightshift.sh/partners): Working with Nightshift as a partner.
- [Careers](https://nightshift.sh/careers): Open roles.
- [Contact](https://nightshift.sh/contact): Talk to the team.

## Learn

- [Blog](https://nightshift.sh/blog): How we think about giving agents governed access to real data.
- [Resources](https://nightshift.sh/resources): Guides and reference.
- [AI Should Meet You Where You Are](https://nightshift.sh/blog/ai-should-meet-you-where-you-are): Why we built Nightshift to adapt to your infrastructure instead of asking your infrastructure to adapt to it.
- [The Wrong Question About AI Cost](https://nightshift.sh/blog/the-wrong-question-about-ai-cost): What does AI cost? Wrong question. The right one is what it costs to keep doing the work the way you do it now while a competitor instruments theirs.
- [Shipping Real Apps with Harness Engineering](https://nightshift.sh/blog/embracing-harness-engineering-with-nightshift): Dogfooding Nightshift by running Claude Code inside a chicklet to migrate production infrastructure, fix a live ETL bug, and ship a full-stack feature. Harness engineering at the platform level.
- [Containers, But Without The Magic Part 1: Networking](https://nightshift.sh/blog/containers-without-magic-01): Building container networking from scratch using only the ip command. What network namespaces, veth pairs, and CNI plugins actually do under the hood.
- [You Are The BIOS Now: Building A Hypervisor In Python With KVM](https://nightshift.sh/blog/less-cursed-vm): Build a minimal Type-II hypervisor in Python using KVM. A beginner-friendly walkthrough of ioctls, guest memory, and running your first hello-world VM in about 250 lines.
- [Evaluating Large Language Models on Agentic Workspace Bootstrapping](https://nightshift.sh/blog/evaluating-large-language-models-on-agentic-workspace-bootstrapping): How Codex, Claude, and Kimi perform at configuring their own environments from a BOOT.md file.

## Get started

- [Create a free workspace](https://nightshift.sh/signin?mode=signup): One source, with row-level policy and live queries.
- [Open-source spec](https://github.com/nightshiftco/nightshift): The Nightshift specification, developed in the open.

## Full text

- [llms-full.txt](https://nightshift.sh/llms-full.txt): Every page summary plus the full text of each post, inlined for ingestion.