From Plausible to Provable: Giving AI Agents the Truth About Your Airbyte Streams

Watch a coding agent write transformation logic against ingested data and you can see the exact moment it starts making things up. Asked to build staging models over an Airbyte-landed orders stream, it will confidently produce column lists it inferred from the table name, treat every id as a unique key, assume updated_at implies incremental sync, and enumerate status values it has seen in other companies' schemas. The output is fluent, well-formatted, and structurally fictional — not because the model is weak, but because nothing in its context contained the actual schema. Agents don't fail loudly on missing ground truth; they interpolate over it.

The fix is not a smarter agent. It is a consultable source of truth — and a governed Airbyte catalog is precisely that.

What the governed model knows that the agent would otherwise guess

When an Airbyte catalog is imported into CoreModels, the semantics an agent needs are captured as explicit, queryable facts rather than left for inference:

• Identity. Each stream is a governed Type with namespace-qualified identity — public.orders is itself, not a fuzzy match for every orders-shaped thing in the estate.
• Optionality. Nullability comes from the catalog's own declarations — type arrays like ["null","string"] — and required properties become not-null checks. Which fields can be missing is a recorded fact, not a hunch.
• Types. Native types are recorded with a defined precedence from the catalog's type metadata and mapped honestly into the governed model: timestamp types carry date-time semantics, while genuinely untypeable object and array fields are approximated and flagged rather than dressed up as clean scalars.
• Accepted values. Declared enums become managed taxonomies. "What can status contain?" has an authoritative answer instead of a distinct-query guess.
• Keys and sync behavior. Source-defined or configured primary keys are explicit key checks — unique-plus-not-null for a single column, not-null members plus a dataset-level composite-key check otherwise; supported sync modes and cursor configuration ride on the model as Airbyte metadata. Whether deduplication is safe is now a lookup.

Every one of those bullets is a category of hallucination retired.

Consultation, not context-stuffing

Agents reach these facts over the Model Context Protocol. A CoreModels deployment serves an MCP endpoint at /mcp — for example https://coremodels.example.com/mcp — secured with OAuth, and the tools relevant to this work are read-only by design.

A typical grounded session composes a few of them. The agent calls list_projects and get_project_summary to orient itself, then search_nodes to find the governed types and elements for the streams it is working against. With get_vendor_integration_status it discovers which vendor connectors are registered and what each can do, and — given the vendor key airbyte and a project — retrieves the last-import state: when the catalog was imported, its content fingerprint, and how many datasets are governed. That last call deserves more respect than it usually gets: a grounded agent should know how fresh its ground truth is, and be able to say so instead of presenting stale facts with full confidence.

The most powerful move is audit_vendor_project. An agent holding a freshly discovered catalog can audit it against the governed model on demand — read-only, no writes anywhere — and receive machine-readable results: error, warning, and info counts, plus findings with stable codes such as field-type-drift, enum-widened, stream-no-primary-key, and untyped-fields, each naming its subject, alongside a Markdown report written for humans. Stable codes are the underrated detail. An agent can branch on a code — refuse to scaffold dedup logic for a stream carrying stream-no-primary-key, or warn before building on a field flagged as untyped. It cannot reliably branch on prose. And when a catalog is too large to paste inline, the tools accept artifact URLs instead, fetched server-side under strict safety rules.

The write boundary is part of the grounding story

Grounding is only trustworthy if the ground can't be quietly rewritten — including by the agents consulting it. CoreModels enforces this at the protocol surface: the public /mcp endpoint serves read-only tools, while write tools live on a separate admin endpoint, and importing a vendor catalog requires Admin membership on the project. Even then, the import is additive — existing governed nodes are never mutated, and the import tool's own guidance directs agents to run the audit to see drift rather than attempt to reconcile it themselves.

This division of labor is the right one for agents in governance workflows: agents observe, audit, and propose; humans gate changes to meaning. An agent can tell you, with evidence, that a governed field's type has drifted in the source. It cannot decide on its own that the governed meaning should change to match. That is not a limitation to be engineered around; it is the property that makes the agent's reports worth trusting.

Why this beats pasting schemas into prompts

The obvious alternative — copy the catalog JSON into the agent's context — works exactly once. The pasted schema is unversioned, immediately stale, stripped of everything the import derives (checks, taxonomies, metadata), and invisible to every other agent and teammate. Consultation over MCP inverts each weakness: one governed model, current as of a known import with a verifiable fingerprint, richer than the raw catalog, shared by every consumer — human or machine — and safe to expose because the surface is read-only.

The pattern generalizes well beyond Airbyte, but ingestion is where it bites first, because ingestion is where structure is least documented and most guessed-about. An agent that consults the governed model produces answers in a different category from an agent that autocompletes them: provable, attributable, and current — with the receipts one tool call away.

To set this up for your own connection, the CoreModels Airbyte quickstart covers the import, the audit, and the MCP tool calls in one pass.