DreamFactory is a secure, self-hosted enterprise data access platform that generates governed REST and MCP APIs for the databases and file storage an organization already runs, built for enterprise development teams that need role-based API access without writing backend code.

What it is

DreamFactory is an open-source, self-hosted data access platform built on the Laravel framework and written primarily in PHP and Shell. It is distributed under the Apache-2.0 licence and lives in the PHP/Laravel ecosystem, sitting under the Developer Tools / API Development & Testing category. The platform connects to a data source, introspects its schema, and generates a complete REST API with full CRUD operations, relationship handling, stored procedure access, and OpenAPI/Swagger documentation — all in minutes. Alongside REST, it exposes an MCP server so that enterprise applications and on-premises LLMs can reach the same data through governed endpoints with role-based access and identity passthrough.

The concrete problem it solves is the hand-written CRUD layer. A team with an existing MySQL, PostgreSQL, SQL Server, or MongoDB database would normally build controllers, serializers, validation, pagination, and documentation by hand before any frontend, mobile app, or AI model can read the data. DreamFactory replaces that hand-coded CRUD API with auto-generated, documented endpoints, and it wraps legacy SQL Server stored procedures, Oracle databases, and mainframe data in modern REST APIs instead of forcing a rewrite.

Key capabilities

• Automatic REST API creation for SQL and NoSQL databases, requiring no application code.
• OpenAPI/Swagger documentation generated automatically for every endpoint.
• Stored procedure and function support, exposing database logic as API endpoints.
• Related data retrieval, server-side filtering, sorting, and pagination, plus bulk insert, update, and delete on every endpoint.
• Role-based access control (RBAC) with granular permissions per table, endpoint, and HTTP verb, together with API key management, rate limiting, audit logging, SSO via SAML 2.0, OAuth 2.0, OpenID Connect, Azure AD, and LDAP/Active Directory, and field-level data masking.
• Server-side scripting in PHP, Python, or Node.js, including pre- and post-process event scripts, webhook and event broadcasting, and custom service creation.
• An MCP server that gives ChatGPT, Claude, or local LLMs governed access to enterprise data.

Who uses it and how

• API-first development teams generating REST APIs for existing databases without writing backend code.
• Organizations modernizing legacy systems by wrapping SQL Server stored procedures, Oracle databases, and mainframe data in REST APIs.
• Teams connecting ChatGPT, Claude, or local LLMs to enterprise data through MCP or REST APIs with governed access controls.
• Mobile and web application teams that need secure, role-based data access for frontend clients.
• Data integration teams combining multiple databases and services behind a single API gateway.

Getting started

DreamFactory installs on Linux, Windows, Docker, or Kubernetes. The project publishes a Docker repository at dreamfactorysoftware/df-docker and a Helm chart at dreamfactorysoftware/df-helm for Kubernetes deployments.

How it compares

The supplied facts name no paid products that DreamFactory replaces and no comparable tools in this registry, so no licence, self-hosting, data-ownership, or cost comparison can be drawn here. The repository does carry a commercial licences section alongside its Apache-2.0 project licence, which indicates that some commercial arrangements exist outside the open-source core.

When to use it — and when not to

A self-hoster operates the platform itself, provisions and secures connections to every underlying database, and configures the identity provider (Azure AD, LDAP, or another SSO source) plus roles, API keys, and audit logging — so teams wanting a managed service with no operational surface should look elsewhere. It is also a poor fit when no governance layer is needed, such as a small static site with one read-only endpoint. The facts show a modest footprint — 1,788 stars, 354 forks, and a Shell language label that understates the Laravel/PHP stack — and a commercial licences section that suggests checking which capabilities sit outside the Apache-2.0 core before committing.