hafen is a self-hosted migration platform. Download the Docker image, run it inside your VPC, point it at your Oracle and Postgres. Nothing phones home. AI conversion uses your own Anthropic API key.
Air-gap friendly. Audit-safe. Open source at the core.
But the tools to get there are old. Ora2Pg caps at 4 billion rows per table and needs ~25% manual PL/SQL correction. EDB Migration Portallocks you into EDB Postgres Advanced Server. AWS SCT locks you into AWS. Ispirer won't show you pricing.
Single Docker image (or OVA, or tarball). Everything — UI, parser, AI gateway, runner — inside your firewall. Air-gapped installs supported. No telemetry by default. We cannot see your DDL, your data, or even know you're running it.
Bring your own Anthropic API key (or OpenAI, or a local model). The key lives in your local config. Claude calls go from your server to theirs — we are not in that path. Every conversion shows a diff with reasoning before anything gets applied.
Postgres is Postgres. No upsell to EDB Advanced Server, no lock-in to AWS. Works against RDS, Aurora, Azure Database, Cloud SQL, Crunchy Bridge, Supabase, self-hosted — whatever you already run.
docker compose up on your own host or Kubernetes cluster. The UI and API come up locally (ports 3000 and 8000). No accounts, no cloud signup, no outbound calls. Takes about 2 minutes on a fresh host.
Point hafen at a read-only Oracle account. It introspects the schema, scores complexity, flags risky constructs (MERGE, CONNECT BY, autonomous txns), and generates a table-by-table load plan — parents first, cycles with deferred constraints, sequence catch-up, rollback points.
The runner streams rows via keyset-paginated COPY while Merkle verification runs behind it. Checkpointed and resumable — if a batch dies, --migration-id <id> picks up from the last verified keyset cursor. When it finishes, every row is hash-verified on both sides.
Migrations are capex events and enterprises want to own their tools. We ship signed license files that run offline. No subscription, no phone-home, no vendor lock-in.
Pro + Enterprise ship as signed offline license files (JWT). Verified locally, valid for the stated term, no network check required. A single successful migration typically recoups its license cost in Oracle savings within 90 days.
| hafen | Ora2Pg | EDB Portal | AWS SCT | |
|---|---|---|---|---|
| Fully self-hosted install | ✓ | ✓ | K8s only | — |
| Air-gap friendly | ✓ | ✓ | — | — |
| Open source core | ✓ | ✓ | — | — |
| AI-assisted PL/SQL conversion | ✓ | — | Limited | — |
| Bring your own AI key (BYOK) | ✓ | — | — | — |
| Merkle row verification | ✓ | — | — | — |
| Target-neutral (any Postgres) | ✓ | ✓ | EDB only | AWS only |
| Transparent pricing | ✓ | free | free | AWS metering |
No. Reading your own Oracle schema via ALL_* views is something your DBA does every day. We don't decompile Oracle binaries, bypass licensing, or ship any Oracle IP.
Ora2Pg is a Perl script that dumps schema. We have a parser that builds an IR, an AI that fixes what the parser flags, a runner that verifies every row, and a dashboard you can hand to your CTO. We also don't have a 4-billion-row table limit.
No. hafen targets any Postgres 13+. Plain RDS, Aurora, CloudSQL, Crunchy, Supabase, self-hosted — all equivalent.
Every generated conversion is shown as a diff against the original with reasoning. You approve each change. Nothing runs unreviewed. The AI call goes from your server to Anthropic (or whichever provider you choose) using your API key — we are not in that path.
No phone-home. The product image runs entirely inside your network; license verification is offline (signed JWT checked locally). Air-gap installs work — we ship a separate installer bundle with all dependencies vendored.
The parser falls back to a permissive scanner and logs the unsupported construct. The runbook flags it as "manual." You can also open an issue — our ANTLR grammar is open source, and we merge grammar PRs from the community.
When you buy a Pro license we send you a signed JWT with the project ID, seat count, and expiry. hafen verifies the signature against our public key bundled with the image. No network call. If your license expires, AI conversion and PDF generation stop working — the OSS core (parser, runner) keeps running forever.
Yes. Run the Community tier forever if you only need assessment + the open-source runner. Drop a Pro license file into the install directory when you're ready for AI conversion and the runbook PDF — no reinstall needed.
Two commands. The whole platform runs on your laptop or a VM in your VPC.
git clone https://github.com/davidnhg74/hafen cd hafen && docker compose up