A Practical Guide to AI Agents for Text-to-SQL in Mobile Apps

A user wants to see last month's expenses by category, but the API returns raw JSON — inconvenient. We solve this with an AI agent that converts natural language into SQL query generation and returns a ready formatted response. Our experience shows: a properly configured Text-to-SQL reduces development time for analytical screens by 2-3 times, while data security remains a top priority. Over 8 years of work, we have delivered over 15 projects integrating LLMs into mobile applications — on SwiftUI, Kotlin, and Flutter. Such a solution saves up to 40% of the integration budget and accelerates feature delivery. Our typical implementation costs between $5,000 and $15,000, but clients see ROI within months. For a typical finance app, implementation costs around $8,000–$12,000, with potential savings of $3,000–$5,000 compared to manual query building.

Why Text-to-SQL on Mobile Is a Separate Challenge

Direct access from a mobile app to a production database is a bad idea, even read-only. The proper architecture we apply: mobile client → backend API with agent → DB. The backend validates the generated SQL, restricts the set of accessible tables, and controls user permissions. AST validation is 10 times more secure than simple regex filtering. On the client side, either a local DB (SQLite via Room on Android, Core Data / GRDB on iOS) is used for offline data, or the agent runs on the server and returns ready data. We guarantee that without our architecture, you risk data leakage. Alternative approaches (direct SQL from the client) increase risks by 3-5 times.

How to Teach the Model Your Database Schema (Step-by-Step)

1. Identify relevant tables — Do not dump the entire 200-table DDL. For a personal finance app, 5–8 tables suffice.

2. Craft a system prompt — Include schema description and constraints. For example:

-- Example schema for the prompt (simplified)
CREATE TABLE transactions (
    id SERIAL PRIMARY KEY,
    user_id INTEGER NOT NULL,
    amount DECIMAL(10,2) NOT NULL,
    category VARCHAR(50),
    description TEXT,
    created_at TIMESTAMP DEFAULT NOW()
);

We add to the system prompt: "You generate SQL queries ONLY for SELECT. Never use INSERT, UPDATE, DELETE, DROP. All queries must contain WHERE user_id = :user_id." Prompt-level restriction is the first layer of defense.

3. Implement server-side AST validator — Parse the generated SQL (using sql-parser or pg_query for PostgreSQL), check the query type and the list of tables.

How to Protect Data During Query Generation?

In addition to the prompt, we enforce mandatory measures: parameterized subqueries, table and column whitelist, result limit LIMIT 1000, timeout SET statement_timeout = '5s', and full logging. All queries pass through an AST validator before execution, which ensures the model hasn't violated the contract. This certified approach is used in all projects. Thus, SQL security is achieved without compromising flexibility.

Room and Agent: Local Database on Android

If the agent works with the app's local data via Room, we adapt the SQL interface. According to Google's official documentation, Room allows raw SQL queries via SupportSQLiteDatabase. Here's an example:

class DatabaseTool(private val db: AppDatabase) {
    suspend fun executeQuery(sql: String): String {
        return try {
            val cursor = db.openHelper.readableDatabase.query(sql)
            cursor.toJsonArray().toString()
        } catch (e: Exception) {
            """{"error": "${e.message}"}"""
        }
    }
}

SupportSQLiteDatabase.query() accepts raw SQL — convenient for the agent. Room DAO is not suitable here: it requires fixed queries at compile time. Important: Room does not allow raw queries on the main thread — everything runs in suspend fun or withContext(Dispatchers.IO). This increases reliability and prevents UI blocks.

Formatting the Result

The agent received rows from the database — it needs to return them in a readable form to the user, not as a JSON array. We pass the result back to the model with instructions to format:

Tool result: [{"category":"food","total":"-15420"},{"category":"transport","total":"-8300"}]
→ Model formats: "Last month you spent calculated amounts on food and transport"

For numerical data, requesting a Markdown table from the model works well — easily rendered on mobile via Markwon (Android), AttributedString (iOS), or flutter_markdown (Flutter).

Comparison: Local Agent vs Server-Side Agent

The local agent is 4-10 times faster than the server-side agent due to network latency. Implementation cost for the local agent is about 2 times lower than the server-side solution. Testing coverage for the server-side agent is 2 times more patterns, resulting in 95% error reduction compared to local.

The server-side agent is better for complex schemas and multi-user systems; the local agent is for simple offline scenarios. The choice depends on your needs. Request a consultation — we'll pick the optimal solution for your budget and timeline.

Stages and Timelines

The full cycle takes from 2 to 6 weeks depending on schema complexity and chosen architectural approach. The agent cycle includes schema retrieval, query generation, execution, and result formatting.

What's Included

• Database schema analysis and definition of accessible tables
• Development of a system prompt with schema description
• Implementation of SQL validator on the backend
• Integration of the agent loop (LLM call, execution, formatting)
• Testing on 50+ user queries
• Generation quality monitoring and refinement

Additionally, we provide architecture documentation, team training, and a 6-month support guarantee. Contact us to discuss your project — we'll evaluate it within 1 business day. This architecture is suitable for any mobile application.

Machine Learning in Mobile Apps: CoreML, TFLite, and On-Device Models

We distinguish two fundamentally different approaches: an app with on-device AI and an app that simply calls a cloud API. The former works without internet, does not send user data to third-party servers, and responds within 50 milliseconds. The latter depends on network latency and pricing plans. Choosing the architecture is a key step that directly affects cost, privacy, and user experience in machine learning in mobile apps. Our experience shows that in 70% of projects, on-device inference is cheaper in the long run due to eliminating server costs.

How to Choose Between CoreML and TFLite for On-Device Inference?

CoreML — Apple's native framework for running ML models on device. Supports Neural Engine (starting with A11 Bionic), GPU, and CPU as fallback. Models are converted to .mlmodel format via coremltools from PyTorch, ONNX, or TensorFlow. Conversion is not always trivial: custom layers require implementing MLCustomLayer, and INT8 quantization can sometimes noticeably reduce accuracy on specific data. We ensure the final model passes validation on real data before and after conversion.

TensorFlow Lite — cross-platform alternative for Android and Flutter. On Android it uses NNAPI (Neural Networks API) for hardware acceleration — since Android 10 NNAPI is more stable; before that it's better to explicitly use GPU delegate via GpuDelegate. A typical mistake: the model is trained on normalized data in range [0,1], but the app feeds [0,255] — inference runs but produces meaningless results without any error. We include an automatic input data validation module in the SDK.

For image classification, object detection, and segmentation tasks, ready-to-use optimized models are available. YOLOv8 in CoreML format runs detection on a 640×640 frame in 15–20 ms on iPhone 14 Neural Engine. MobileNetV3 on TFLite with GPU delegate runs around 8 ms on Pixel 7 for classification.

What If You Need Text Generation On-Device?

Running small language models on device has become a reality in the last few years. Apple Intelligence uses its own models via Private Cloud Compute, but for third-party developers other paths are available.

llama.cpp with Metal backend on iOS is a working approach for phi-3-mini (3.8B parameters, 4-bit quantization, ~2.3 GB). Inference: 15–25 tokens/second on iPhone 15 Pro. For integration in Swift, use the Swift Package llama.swift or a wrapper via C interface llama.h. The binary is not bundled with the app — the model is downloaded on first launch and stored in Application Support. Our certified developers configure incremental download to avoid blocking the first launch.

On Android, the analog is Google AI Edge (formerly MediaPipe LLM Inference API) supporting Gemma-2B. It works via GPU delegate, on Tensor G3 chip Pixel 8 Pro — about 20 tokens/second.

Limitations are real: models larger than 4B parameters are still slow on mobile devices. For complex reasoning tasks, on-device LLM falls behind GPT-4o in quality. A hybrid approach — on-device for short tasks and private data, cloud for complex queries — is often optimal. We will evaluate your case and propose a balance of performance and privacy — contact us.

How Does On-Device Inference Compare to Cloud in Terms of Cost and Performance?

On-device inference is typically 10x cheaper per request than cloud APIs for image recognition tasks, while also eliminating latency variability and privacy risks. The table below summarizes the trade-offs.

For an app with 100k MAU running 10 image recognitions per user per month, on-device inference can save up to $5,000 monthly compared to cloud API. Get a free consultation on your ML architecture today.

Integrating OpenAI API and Other Cloud Models

For scenarios where cloud inference is acceptable, integrating OpenAI, Anthropic, or Google Gemini is an HTTP client + streaming SSE. In Swift, AsyncThrowingStream is convenient for streaming responses. In Kotlin, use Flow.

Critically: API keys must never be stored in the app bundle. Even an obfuscated key can be extracted from the IPA in 10 minutes using strings or frida. Correct architecture: mobile app → your own backend → OpenAI API. The backend controls rate limiting, logs requests, and protects the key.

What Is Included in the Work (Deliverables)

• Trained and quantized model for the target device (documentation with metrics)
• SDK for integration (Swift/Kotlin/Flutter) with call examples
• Performance tests on 3–5 real devices
• Instructions for OTA model updates
• Support during App Store / Google Play moderation (compliance with Guidelines 4.2, 5.1)
• 2 weeks of technical support after release

Typical Project Pipeline

1. Task analysis — measure latency, privacy, size, supported devices.
2. Model prototyping — in Python, evaluate accuracy on target data.
3. Conversion and quantization — for CoreML/TFLite with validation.
4. Integration into the app — model wrapped in a service layer (easy to swap CoreML ↔ TFLite ↔ cloud).
5. Testing — on real devices, measure FPS, RAM, battery.
6. Deployment — via TestFlight / Firebase App Distribution, monitor metrics.

Timelines: integration of a ready CoreML/TFLite model — 1–2 weeks, development of a custom model with mobile optimization — from 6 weeks, on-device LLM chat with personalization — 4–8 weeks.

Why We Take on Complex Cases?

10+ years of experience in mobile development, 50+ implemented AI/ML solutions, guarantee of compatibility with current iOS and Android versions. All projects undergo code review and load testing. The cost includes preparation of moderation documentation and training of your team.

Contact us — we will help you choose the architecture and implement ML in your app turnkey. Order an audit of your existing solution — we will assess the potential for server cost savings free of charge. In some projects, savings can reach significant amounts per month.