Best open source BI tools in 2026: 8 self-hosted options compared on AI, dbt, and security

The best open source BI tools in 2026 are Metabase for teams that don’t write SQL, Apache Superset for large self-hosted deployments with row-level security in the free build, Lightdash for dbt teams, and Evidence for code-first reporting in Git. Grafana, Redash, Rill, and WrenAI cover narrower jobs: time-series dashboards, lightweight SQL dashboards, local metrics-first exploration, and open source text-to-SQL. The biggest change since early 2026 is AI: Metabase now ships natural language questions in its free edition, and Superset 6.1 added an opt-in MCP server, but most other AI features sit in paid tiers.

“Open source” also means different things per vendor. Some licenses cover the whole app, while others keep SSO, row-level security, or the UI in a commercial edition. This guide shows what the free build includes for each tool, what you pay for, and which tool fits which team. All license, feature, and price details were checked against official pages in September 2026.

Which open source BI tools are worth shortlisting in 2026?

• Metabase: best for business teams that want to explore data without SQL, with AI questions included in the free edition.
• Apache Superset: best for large self-hosted deployments that need row-level security and broad database coverage without a license fee.
• Lightdash: best for teams whose metrics already live in dbt.
• Grafana: best when business metrics are time series and the team already runs Grafana for monitoring.
• Redash: best for SQL-fluent analysts who want a simple query editor with shareable dashboards.
• Evidence: best for analysts who want reports written in SQL and Markdown, reviewed in pull requests.
• Rill: best for engineers who want a fast, metrics-first dashboard built from code on DuckDB or ClickHouse.
• WrenAI: best for developers building their own text-to-SQL agents on an open source engine.

How we evaluated open source BI tools

We scored each tool on the questions buyers ask when they search for open source BI, not on GitHub popularity alone.

1. What the license actually covers. Is the whole product open source, or is it open core with SSO, permissions, or the UI in a paid edition?
2. AI in the free build. Can users ask questions in plain English without buying a paid tier or add-on?
3. Security in the free build. Row-level security (RLS), SSO, and data source permissions, which decide whether a self-hosted tool can serve more than one team safely.
4. Warehouse and dbt fit. Native connections to Snowflake, BigQuery, and Postgres, plus how the tool uses dbt models and Git.
5. Self-hosting effort. How many services you run and what the vendor recommends for production.
6. Exit price. What the cheapest paid or managed plan costs when you outgrow self-hosting.

How do the top open source BI tools compare?

Two patterns stand out. Superset and Lightdash are the only tools whose free builds include row-level security. Metabase and WrenAI are the only ones whose free builds include natural language querying, and WrenAI’s free build has no UI.

Metabase

Best for: business teams that want to click through data or ask questions in plain English, with a self-hosted instance running in minutes.

• License: AGPL v3 for the core; code in the enterprise directory is under the Metabase Commercial License (license).
• Pricing (verified September 2026): open source free; Starter $100 per month with 5 users, then $6 per user; Pro $575 per month with 10 users, then $12 per user; Enterprise from $20,000 per year (pricing).
• Deployment: Metabase Cloud or self-hosted as a JAR file or Docker container (JAR docs). Metabase recommends moving from the built-in H2 application database to Postgres for production (docs).
• Databases: 20+ data sources, including Postgres, MySQL, Snowflake, BigQuery, Redshift, and ClickHouse (databases).
• Query model: live queries against your database, with caching controls on Pro.
• Security: Google Sign-In and basic LDAP in the free edition; SAML and JWT SSO, row and column permissions, and usage auditing on Pro and Enterprise (SAML docs).
• AI: Metabot answers natural language questions, builds charts in the query builder, generates and fixes SQL, and answers in Slack (Metabot docs). The pricing page lists “Ask questions with AI” on the open source plan. Most teams bring their own model API key; Metabase’s AI service costs $3.75 per million tokens after 1 million included tokens. Metabase also ships an MCP server for AI clients.
• Embedding: JWT-signed guest embeds on every plan, including open source; multi-tenant embedding with row and column security on paid plans.
• Not ideal for: teams that need SAML or row-level security without paying, or complex semantic modeling across many teams.

Metabase is the easiest open source BI tool to start with, and the only one where a non-technical user can ask a question in plain English without a paid add-on. The tradeoff is that governance features are in paid plans, so a self-hosted free instance works best for a single team with shared data access. If you are weighing Metabase against a commercial AI tool, our Basedash vs Metabase comparison covers the differences in detail.

Apache Superset

Best for: larger organizations that want a self-hosted BI platform with row-level security, broad database coverage, and no license fee.

• License: Apache 2.0 (repository). Latest minor release: 6.1.0, May 2026.
• Pricing (verified September 2026): open source free. Preset, the managed Superset service, has a free Starter plan for up to 5 users, Professional at $20 per user per month billed annually ($25 monthly), and custom Enterprise. Embedded viewer licenses start at $500 per month for 50 viewers (Preset pricing).
• Deployment: self-hosted with Docker or Kubernetes; alerts, reports, and async queries need Celery workers and a message broker such as Redis (alerts and reports docs).
• Databases: any database with a SQLAlchemy driver, including Snowflake, BigQuery, Postgres, ClickHouse, Trino, and Druid (database docs).
• Query model: live queries with a configurable results cache.
• Security: row-level security filters assigned to datasets and users, groups, or roles in the open source build (security docs); OAuth login through Flask AppBuilder (configuration). Preset adds SSO and SCIM on Enterprise.
• AI: Superset 6.1 added an opt-in MCP service that lets AI clients such as Claude or ChatGPT list dashboards, run SQL, and create charts, with JWT authentication and RBAC checks (MCP docs). There is no built-in chat UI in the open source build; Preset builds a chatbot on top.
• Embedding: embedded dashboards SDK in open source; Preset sells embedded viewer licenses.
• Not ideal for: small teams without someone to run Celery, Redis, and upgrades, or business users who expect a guided no-SQL experience.

Superset is the strongest free option for governed, multi-team self-hosting because row-level security is in the core product. Expect more infrastructure than Metabase and a steeper learning curve for chart authors.

Lightdash

Best for: analytics engineers whose metrics and dimensions already live in dbt and who want BI to read them directly.

• License: MIT for the core; code under packages/backend/src/ee has a separate enterprise license (license).
• Pricing (verified September 2026): open source free; Cloud Pro $3,000 per month with unlimited users; Enterprise custom; 21-day free trial (pricing).
• Deployment: Lightdash Cloud, or self-hosted with Docker Compose or the official Helm chart (self-hosting docs). Results caching needs an Enterprise license key.
• Databases: BigQuery, Snowflake, Redshift, Databricks, Postgres, Trino, ClickHouse, Athena, and DuckDB, through your dbt project.
• Query model: live queries against dbt models in your warehouse.
• Security: row-level filtering with sql_filter and user attributes (docs); Google, Okta, OneLogin, and Azure AD SSO configurable on self-hosted instances (environment variables); SAML, SCIM 2.0, and custom roles on Enterprise.
• AI: AI agents answer questions through the dbt semantic layer and respect project permissions; Lightdash sells them as an add-on (AI agents docs). Cloud Pro also lists an MCP server.
• Embedding: iframe and React SDK as a paid add-on: pay as you go (first 1,000 loads free, then $0.05 per load) or $790 per month for 100,000 loads.
• Not ideal for: teams without dbt. Lightdash’s own FAQ says it builds on your existing dbt project.

Lightdash solves the “two sources of truth” problem for dbt teams, since metrics are defined once in YAML. Our guide to BI tools for dbt compares it with commercial dbt-aware options, and Lightdash vs Metabase covers the most common open source head-to-head.

Grafana

Best for: engineering-led teams that already run Grafana for monitoring and want business metrics on the same dashboards.

• License: AGPL v3 (repository).
• Pricing (verified September 2026): open source free; Grafana Cloud has a free tier, Pro at a $19 per month platform fee plus usage, and Enterprise with a $25,000 per year minimum commit (pricing).
• Deployment: self-hosted with Docker, Kubernetes, or native packages; or Grafana Cloud.
• Databases: Postgres, MySQL, and SQL Server are built in (data sources). The BigQuery plugin is free; the Snowflake plugin is an Enterprise plugin that needs Grafana Enterprise or Cloud.
• Query model: live queries on each dashboard refresh; query caching is an Enterprise and Cloud feature.
• Security: OAuth (generic, GitHub, Entra ID, and others) and LDAP in open source; SAML, team sync, and data source permissions need Grafana Enterprise or Cloud (authentication docs). In open source, any user in an organization can query any data source in it.
• AI: Grafana Assistant builds dashboards and queries from plain English in Grafana Cloud, billed per active AI user. It is not part of the open source build.
• Not ideal for: business reporting with joins, semantic models, or non-technical authors.

Grafana is excellent for time-series dashboards and alerting, and a poor fit as a company-wide BI tool. If business users need to explore data without SQL, pair it with a BI tool rather than stretching it.

Redash

Best for: SQL-fluent analysts who want a lightweight query editor with parameterized, shareable dashboards and alerts.

• License: BSD 2-Clause (repository).
• Pricing (verified September 2026): free to self-host. There is no official managed service; the hosted Redash product was shut down after Databricks acquired Redash, which we cover in our guide to hosted Redash alternatives.
• Deployment: self-hosted with Docker.
• Databases: dozens of SQL, NoSQL, and API query runners, including Postgres, MySQL, Snowflake, BigQuery, and ClickHouse (integrations). Version 26.9.0 added Cloudflare D1.
• Query model: queries run live or on a refresh schedule, with cached results for dashboards.
• Security: Google OAuth and SAML login (authentication options) and data source permissions by group; no row-level security.
• AI: none built in.
• Release cadence: community maintained, with releases in January 2025, August 2025, March 2026, and September 2026. Version 26.9.0 (September 24, 2026) fixed 13 security advisories, so upgrade older installs (release notes).
• Not ideal for: non-SQL users, AI querying, or teams that want a vendor SLA.

Redash is still the simplest SQL-to-dashboard tool in this list, and it is maintained again. The trade is slower development and no managed option.

Evidence

Best for: analysts who want reports defined as SQL and Markdown files in Git, with branch previews and code review.

• License: MIT (repository).
• Pricing (verified September 2026): open source free to self-host. Evidence Studio Team is $2,500 per month with unlimited users, the analytics agent, page-level access control, and 20,000 AI credits; Enterprise adds SSO, SCIM, row-level access rules, embedding, and deployment on your infrastructure; 30-day trial (pricing).
• Deployment: the open source CLI builds a site you can host on Vercel, Render, Fly.io, or Railway (self-hosting docs).
• Databases: direct connectors for Snowflake, BigQuery, Postgres, ClickHouse, Databricks, Microsoft Fabric, and MotherDuck.
• Query model: direct connectors query the source without syncing data; other sources, such as MySQL and MongoDB, sync into the managed Evidence Warehouse (docs).
• Security: a self-hosted deployment gets SSO by putting an authenticating reverse proxy in front of it (authentication docs); row-level rules are an Enterprise feature.
• AI: Evidence Studio includes an analytics agent, a Slack bot, and an MCP server. The open source path lets you write reports with your own coding agent.
• Not ideal for: business users who expect drag-and-drop exploration.

Evidence is the best answer to “open source BI as code.” It fits teams that already review analytics in pull requests. Our guide to BI as code compares it with other version-controlled approaches.

Rill

Best for: engineers who want metrics-first, very fast exploration dashboards defined in SQL and YAML on DuckDB or ClickHouse.

• License: Apache 2.0 (repository).
• Pricing (verified September 2026): Rill Developer is free. Rill Cloud Starter is $20 per seat per month for up to 20 seats, and Growth is $30 per seat per month for up to 100 seats. Compute for hosted projects is billed separately, and every plan includes a $250 usage credit (pricing).
• Deployment: Rill Developer runs on your machine. Rill’s docs say it is meant to be used with Rill Cloud, where teammates view dashboards, set alerts, and use AI chat (Rill Cloud vs Rill Developer).
• Databases: connectors for S3, GCS, BigQuery, Snowflake, ClickHouse, and more, with DuckDB or ClickHouse as the query engine.
• Security: SSO and row-level security are Rill Cloud features; SAML and Okta are on Enterprise.
• AI: agentic analytics in Rill Cloud, with 1 million tokens per seat per month on Starter.
• Not ideal for: teams that want a fully self-hosted, multi-user BI server for free.

Rill is open source at the development layer, not at the sharing layer. Pick it for speed on event-scale data, not for a zero-cost team deployment.

WrenAI

Best for: developers who want an open source text-to-SQL engine with a semantic model (MDL) to power their own agents or MCP clients.

• License: Apache 2.0 for the engine, SDK, and skills (license).
• Pricing (verified September 2026): open source free. Wren AI Cloud has a free tier with 20 monthly credits, Essential Cloud at $179 per month billed annually, and Enterprise Cloud at $559 per month billed annually. Self-hosted Enterprise Plus is quoted and licensed by concurrent sessions (pricing).
• What is open: the context engine, MDL modeling, text-to-SQL pipeline, CLI, MCP server, and 20+ connectors. The UI, dashboards, access control, row- and column-level security, and embedding are commercial (open core).
• Databases: BigQuery, Snowflake, Postgres, ClickHouse, Redshift, Databricks, and others.
• Not ideal for: business users. The open source build has no UI, so it is a component for builders rather than a BI tool.

WrenAI answers a common question directly: yes, there is open source text-to-SQL. But a governed, multi-user AI analytics experience from WrenAI means paying for the commercial platform.

Which open source BI tools have native AI features?

As of September 2026, only two tools here include natural language querying in the free build. Metabase’s Metabot answers questions, builds charts, and writes SQL in the open source edition, usually with your own model API key. WrenAI’s open source engine turns questions into SQL through a CLI or MCP server, without a UI.

Superset 6.1 takes a different route. Its opt-in MCP server lets an external AI client query data and create charts under Superset’s own permissions, but there is no chat window inside Superset itself. Lightdash, Evidence, Rill, and Grafana all offer AI agents or assistants, but only in paid cloud plans or as add-ons. Redash has no AI features.

If plain-English questions for business users are the main requirement, Metabase is the only free option with a UI. If you also need SSO, audit logs, and row-level security around that AI, every option in this category becomes a paid plan.

What does it cost to self-host open source BI versus a managed plan?

Self-hosting removes the license fee, not the cost. The recurring cost is infrastructure plus the engineer hours for upgrades, backups, security patches, and on-call. Setups differ a lot. Metabase is one application plus a Postgres application database. Superset adds Celery workers and a broker for alerts, reports, and async queries. Evidence can be a static site behind an authenticating proxy. Estimate hours with your own rates: Redash’s September 2026 release alone fixed 13 security advisories, the kind of upgrade a self-hosted team has to apply.

For comparison, here is what the managed or paid versions cost for 25 users at list price as of September 2026:

For a small team, a managed plan often costs less than an engineer’s time on upgrades. Self-hosting wins when data residency rules require it, or when you already run the infrastructure and have many viewers. Our BI total cost of ownership breakdown walks through the full calculation.

Which open source BI tool should you choose?

If most users don’t write SQL: Metabase. It is the only open source tool here with a visual query builder and free AI questions. Plan for Pro if you need SAML or row permissions.

If you need row-level security without a license fee: Apache Superset, or Lightdash if you use dbt. They are the only two with RLS in the free build.

If your metrics live in dbt: Lightdash for interactive BI, or Evidence if you prefer reports as code.

If you want Git-based, code-first dashboards: Evidence for SQL and Markdown reports, Rill for metrics-first exploration, or Lightdash for dashboards as code on dbt.

If you are replacing Tableau with open source: Superset is the closest match for chart variety and governed multi-team use. Metabase is easier for business users. Neither matches Tableau’s depth of visual formatting.

If you want to avoid vendor pricing lock-in: Superset (Apache 2.0) and Redash (BSD) are fully permissive with no enterprise-only code in the repository. Metabase, Lightdash, and WrenAI are open core, so some features stay commercial.

If your dashboards are mostly time series and alerts: Grafana, especially if engineering already runs it.

If you are building your own AI analytics agent: WrenAI’s engine or Superset’s MCP server.

When should you evaluate a commercial alternative like Basedash?

If your actual goal is AI-assisted self-serve analytics with less operational work, rather than open source licensing, it is worth running a separate commercial evaluation next to your open source shortlist. Basedash is one of those options. It is not open source.

Basedash fact card (verified September 2026):

• Best for: teams that want AI chat and dashboards on their existing databases and SaaS data, with no BI infrastructure to run.
• Not ideal for: teams that require open source code, free self-hosting, or a permanent free tier.
• Pricing: Startup $1,000 per month plus AI usage for up to 25 users, including $1,000 per month in AI credits; Enterprise custom; 14-day free trial with no credit card (pricing). Flat team pricing, not per seat.
• Deployment: cloud, or self-hosted on Enterprise with Docker, Kubernetes and Helm, and bring-your-own AI model keys.
• Data sources: 750+ sources. Connect Postgres, MySQL, Snowflake, BigQuery, or ClickHouse directly, or sync SaaS data into the managed Basedash Warehouse.
• AI: the AI data analyst answers questions in plain English and generates dashboards; the MCP server is on every plan.
• Security: SAML and OIDC SSO (docs) and SCIM on Enterprise; row-level security through PostgreSQL policies using a basedash.groups session variable, Postgres only today (docs); SOC 2 Type II.
• Embedding: on Enterprise (embedding).

Open source tools win when you need source access, free self-hosting, or deep customization. Superset and Metabase are more mature for large self-hosted estates. Basedash fits better when a lean team wants AI answers on live data without running BI servers. For the most common pairing, see Basedash vs Metabase.

Frequently asked questions

Are there open source BI tools with native AI features?

Yes, but fewer than vendor marketing suggests. As of September 2026, Metabase’s free open source edition includes Metabot, which answers natural language questions, builds charts, and generates SQL. Most teams connect it to their own OpenAI or Anthropic key. WrenAI’s Apache 2.0 engine provides text-to-SQL through a CLI and MCP server but has no UI in the free build. Apache Superset 6.1 ships an opt-in MCP server so external AI clients can query data under Superset permissions. Lightdash, Evidence, Rill, and Grafana keep their AI agents in paid plans or add-ons.

Are there any AI-native BI tools that allow self-hosting?

Several, but the self-hosted AI tier is usually paid. Metabase can be self-hosted for free with Metabot enabled, using your own model API key. Lightdash Enterprise, Evidence Enterprise, and Wren AI Enterprise Plus offer self-hosted or on-premises deployments with their AI agents under a commercial contract. Basedash, which is not open source, offers self-hosting on its Enterprise plan with Docker, Kubernetes, or Helm and bring-your-own model keys. If a free license is required, Metabase is the only option with a built-in AI chat UI.

Which open source BI tools support dbt models?

Lightdash is built on dbt: it reads models, metrics, and dimensions from your dbt project YAML, and its FAQ says a dbt project is required. Evidence queries dbt-built tables in your warehouse and keeps reports in Git next to your dbt code. Superset, Metabase, Redash, and Grafana can query tables that dbt produces, but they do not read dbt metric definitions, so you redefine metrics in the BI layer. WrenAI uses its own MDL modeling files rather than dbt metrics.

What is the best free open source alternative to Tableau?

Apache Superset is the closest free alternative for teams that need many chart types, SQL exploration, row-level security, and multi-team dashboards under an Apache 2.0 license. Metabase is the better alternative when most users are non-technical, because its query builder and Metabot need no SQL. If you want a code-first Tableau replacement with Git versioning, Evidence covers reports written in SQL and Markdown. Row-level security for embedded dashboards needs Superset (Preset for managed embedding) or a paid Metabase or Evidence plan.

Which open source dashboard tool avoids vendor pricing lock-in?

Apache Superset (Apache 2.0) and Redash (BSD 2-Clause) have permissive licenses and no enterprise-only directory in the repository, so every feature in the code is yours to run. Grafana is AGPL v3, but SAML, data source permissions, and some plugins such as Snowflake need Grafana Enterprise. Metabase, Lightdash, and WrenAI are open core: the core is free, but features such as SAML, row permissions, results caching, or the UI sit behind commercial licenses.

Is open source BI cheaper than a managed AI analytics platform?

Not always. Self-hosting has no license fee, but you pay for servers, a production database, and the engineer time to upgrade and patch. Redash’s September 2026 release alone fixed 13 security advisories. At 25 users, list prices as of September 2026 range from $220 per month (Metabase Starter) to $755 per month (Metabase Pro with SSO and row permissions) and $3,000 per month (Lightdash Cloud Pro). Compare those with your own hourly rate for maintenance before assuming self-hosting is cheaper.

Which open source BI tools have row-level security in the free version?

Apache Superset and Lightdash. Superset’s open source build lets admins create row-level security filters on datasets and assign them to users, groups, or roles. Lightdash applies sql_filter rules based on user attributes defined in the dbt model. Metabase reserves row and column permissions for Pro and Enterprise. Evidence reserves row-level rules for Enterprise. Grafana, Redash, and Rill have no row-level security in their free builds.

Which open source BI tool is easiest to self-host?

Metabase has the shortest path. It runs as a single JAR file or Docker container. Metabase recommends switching its built-in H2 application database to Postgres before production use. Evidence can be even lighter because the CLI produces a site you deploy to Vercel, Render, Fly.io, or Railway, but you add SSO through a reverse proxy yourself. Superset needs the most moving parts: a metadata database, Celery workers, and a broker such as Redis for alerts and async queries.