K-Lake KDBL Context LakeK-Lake runs as a small set of services in your Kubernetes cluster. It reads your object stores, file shares and Microsoft 365 libraries read-only, extracts and enriches what is inside every file, and serves the result to people and AI assistants, trimmed to what each of them may already open.
Sources
A source is one location K-Lake is told to track. Each has its own credentials, encrypted before they reach the database, its own enable switch, and its own policy for how much metadata to capture. Crawls run on demand, on a schedule, or through the API, and record what they find without moving, renaming or rewriting a single file.
| Object stores | Amazon S3 and S3-compatible stores such as MinIO, Wasabi and on-prem gateways. Azure Blob Storage, including ADLS Gen2. |
|---|---|
| File shares | SMB and CIFS shares, over a userspace client or the kernel client. NFSv3 and NFSv4 exports. |
| Microsoft 365 | SharePoint document libraries and OneDrive for Business, through Microsoft Graph. |
| Access | Read-only, always. K-Lake never writes to a source. |
Content extraction
Every source runs its files through an extraction pipeline that pulls text and structure out of PDFs, Office documents, spreadsheets and images, and transcribes audio and video. All of it runs on self-hosted engines inside your cluster, so no file content leaves your environment.
Tune it per source: file-size ceilings, include and exclude paths, extension lists, and which engine to use. Watch progress live in pages per second, with quarantined failures listed alongside.
Per-source extraction settings in the console.
Extraction is the heavy job, so it is sized separately from the crawl workers and scales out as a fleet. Add replicas to extract more files in parallel. Runners scale automatically with the backlog: capacity is added when work piles up and released when it drains. Both the default and document engines run on x86-64 and ARM nodes.
Sizing guide
The extractor fleet, by engine.
Hybrid lexical and semantic search over extracted content, across every source in the tenant at once, with every result trimmed to what the caller can open.
Exact terms, phrases and operators when you know the words; semantic matching when you know the meaning. Results are ranked across both and grouped by document.
A hit on the file name is shown alongside content hits, so a search for a project code finds both the folder named after it and the memo that mentions it.
A result opens the original file at the page, or at the timecode where a word was spoken. The caller's permission is re-checked at open time.
The same search, with the same trimming, from the web console, the command line, the REST API and any MCP assistant.
Where a source has redaction enabled, search and AI return the masked text, so identifiers and card numbers never surface in a result.
Search the whole tenant or scope to one source. Sources can also be hidden from AI access while remaining searchable in the console.
AI over MCP
K-Lake ships a Model Context Protocol server, so Claude Desktop, Claude Code, ChatGPT, Cursor, IDE assistants and your own agents can search and read your extracted content without a bespoke integration. It serves extracted text and metadata only, never original file bytes.
Live access flow: users, platforms, tools and sources.
Tenant administrators get a dedicated MCP view in the console: the live access flow, active connections by user and client, token revocation, and per-source exposure control. Hide a source from AI with one switch while it stays searchable in the console.
Each tenant gets its own MCP endpoint and its own sign-in issuer, so a token is resolved to exactly one tenant and refused everywhere else. For local evaluation and air-gapped sites an assistant can authenticate with a personal access token and no identity provider at all.
Active sessions, with revocation.
Orient with an estate summary, list sources and files, search content, read a file's text or a window of it, compare versions, and walk the knowledge graph.
Bundled guidance teaches an assistant how to use the tools well: search before reading, cite what it found, and respect what it cannot see.
Tested with Claude Desktop, Claude Code, ChatGPT and Cursor, and works with any client that speaks MCP over Streamable HTTP.
Knowledge graph
Enrichment reads the text K-Lake has already extracted and records the people, organisations, locations, agreements and whatever else you configure, along with the relationships the text asserts between them. Enable it per source; it backfills files extracted before you switched it on.
Entity results obey the same per-file trimming as search. A user sees how many of an entity's documents they can read, and the tenant-wide mention count, so they know it matters more widely without learning anything about the files themselves.
Orbit view with the matching table beneath. Illustrative data.
Discover
Discover turns everything K-Lake has crawled and extracted into a tenant-wide estate overview, with no re-crawl and no extra configuration. It answers the governance question every organisation eventually asks: what exists, where, how old, how much is searchable, and how exposed.
Coverage is reported honestly. Where a facet depends on metadata only some sources captured, the card says so rather than presenting a partial number as ground truth.
Discover, ranked by file count. Toggle to rank by size.
Smart Actions
After each crawl, every file flows through a pipeline of actions you compose per source. Actions run in order, each building on the last. Everything a step produces is stored alongside the file and never written back into it.
A source's pipeline in the console.
| Content extraction | Pulls searchable text and structure out of each file. The default first step. |
|---|---|
| Redaction | Masks identifiers, email addresses, card numbers, phone numbers, IP addresses and your own patterns in the extracted text, so search and AI return the masked version. Includes a rule tester and a record of what each run removed. |
| Webhook | Sends a signed JSON notification to an HTTPS endpoint you control whenever a file completes its pipeline, with a pre-flight check on the target. |
| Fallback extraction | When the default extractor fails on a file, or optionally when it reports a table it could not structure, retries that file on a heavier engine. Scoped by extension, size and path. |
| Entity enrichment | Builds the knowledge graph from extracted text, with a per-source schema and a bounded budget per document. |
| Coming soon | Data placement to copy or tier objects elsewhere; custom sandboxed scripts; a custom container run as a one-shot job per file. |
Security
A caller sees a file only if the file's source-native permissions grant their identity access. NTFS and NFSv4 ACLs and POSIX ownership are captured at crawl time, correlated to your directory identities by directory enrichment, and enforced by row-level security in the database. The same guarantee applies to the console, the CLI, the API and AI over MCP.
Trimming status per source, and the per-file access check.
Federated sign-in over OIDC and OAuth 2.1 to Microsoft Entra ID, Okta, Google, Keycloak or any compliant provider. K-Lake holds no passwords. Personal access tokens act as exactly one user.
TLS in transit. Secrets sealed with authenticated encryption before they reach the database, under a master key supplied from a Kubernetes Secret or external manager and re-read per use, so rotation needs no restart.
Every AI query and every open of an original file is recorded with principal, tenant, sources and files returned, client address and outcome. Structured logs and Prometheus-compatible metrics for your SIEM.
Services and every connector are written in Rust, eliminating buffer overflows, use-after-free and data races at compile time.
Signed release images, minimal containers, and a rolling daily security report of vulnerability findings across every shipped image.
KDBL is registered with the UK Information Commissioner's Office. Because K-Lake is self-hosted, KDBL never processes or receives your indexed data.
K-Lake runs inside your own Kubernetes environment. Licensing is offline and fail-closed, with no licence-server call-home, so it works where the internet does not.
The evaluation installer stands up the full stack on a single Docker or Podman VM, onboards a demo tenant, and prints the console URL and tokens. Eight vCPU and 16 GB is comfortable; a 30-day evaluation licence is included.
Helm-based deployment into your cluster, with a managed database or one you bring, separate sizing for crawl workers and the extraction fleet, and autoscaling on the backlog.
Deploy through the Azure Marketplace offer and entitlement follows your plan for the life of the deployment, with no licence to obtain or apply by hand.
Runs with no internet egress at all, including fully on-prem AI retrieval over MCP with a self-hosted model. Regulated and disconnected environments are first-class.
Every source, user and file belongs to exactly one tenant, isolated in the database. Each tenant gets its own MCP endpoint and can federate to its own identity provider. Licences can carry a product name for white-label deployments.
Licensed by source-file capacity with an expiry, as a signed, tamper-evident document you apply once. Renew or resize by applying a new licence, with no reinstall.
Every action is scoped to your tenant and audited. Pick whichever suits the job; they act on the same data.
Dashboards, source management, content search, Explore, Discover, the MCP view, users and tokens. Signs in through your identity provider.
Dashboard Sources Discover Search Explore MCP Extractors Fleet Settings
Seed crawls, manage sources and pipelines, onboard tenants, apply licences, query the graph and the estate.
kdbl-control source add smbfs://nas/contracts kdbl-control entities intersect --ids 12,48,301 kdbl-control discover breakdown age --metric bytes kdbl-control licence status
Programmatic access to every operation, authenticated with a personal access token or an OIDC bearer token.
GET /api/content/search?q=renewal GET /api/discover/overview GET /api/entities/12/related GET /api/licence
The index K-Lake builds is the foundation for what comes next. Here is what is in development now, and how to be first to hear about further products.
Discover's exposure signals are the bridge to a classification release: labelling what each file is and how sensitive it is, from the content K-Lake has already read.
A Smart Action to copy or tier each object to another location once it has been read and classified.
Sandboxed custom scripts and one-shot custom containers as pipeline steps, so your rules run inside the same governed flow.
Further KDBL products are in development. Register interest
No. Sources are read read-only and the originals stay exactly where they are. K-Lake stores metadata, extracted text and what enrichment derives from it, alongside the file record, never in the file. The MCP server serves extracted text and metadata, not original bytes.
No. An assistant connects as the individual user and inherits their per-file trimming, enforced by row-level security in the database. Every answer is limited to files that person could already open, and every query is recorded in the audit trail.
Not unless you choose it. Extraction and transcription run on self-hosted engines in your cluster, licensing is validated offline, and the product does not phone home. If you configure an external extraction provider for some files, each send is recorded in the audit trail with the file, the provider and the bytes sent. Which model your assistant uses is your choice; a fully on-prem model works over MCP in air-gapped mode.
A single-VM installer brings up the full stack in one command with a 30-day evaluation licence. Point it at a representative share or bucket, extract, search, connect your assistant, and open the originals behind the answers. When it fits, the same product deploys into your production cluster.
By licensed source-file capacity and term. Azure Marketplace deployments follow your plan. Tell us the size of your estate and we will quote for it.
Tell us what you hold and what you want to ask of it. We will demonstrate K-Lake on a representative estate and set you up with an evaluation licence.
Request a demo