Skip to main content
Connect CockroachDB to let Tony inspect schemas, query bounded data, and review SQL activity. Separate read and write connection strings keep row changes approval-gated.

​
Prerequisites

  • A CockroachDB SQL endpoint reachable from CloudThinker.
  • Administrator access to create two dedicated SQL users.
  • Two password-based connection strings using sslmode=require, verify-ca, or verify-full. Use verify-full when possible.

​
Setup

1

Create separate SQL users

Connect to the target database as an administrator, then create one user for reads and one for approved writes:
Store both passwords securely.
2

Grant the minimum table privileges

Run these grants in each schema CloudThinker should reach. This example uses public:
Reapply the grants for new tables, or configure default privileges for the role that creates them.
3

Allow current activity reads (optional)

Grant the read user VIEWACTIVITY only when Tony should inspect statements from other sessions:
Without it, schema and data reads still work.
4

Build two encrypted connection strings

In the CockroachDB Cloud console, copy the general connection string. Use the same cluster and database with both users:
URL-encode special characters in each password. Remove local certificate paths that CloudThinker cannot access.
5

Add CockroachDB in CloudThinker

Go to Connections → CockroachDB and enter:
  • Connection string: the cloudthinker_read URL
  • Write connection string: the distinct cloudthinker_write URL
Click Connect. CloudThinker shows Connected after verification.

​
Connection details

The connection rejects sslmode=disable, allow, and prefer. It also rejects identical read and write URLs.

​
Required permissions

Neither user needs admin, DDL privileges, or unsafe internals. Grant table privileges only where the workspace should operate.

​
Agent capabilities

Once connected, Tony can: Queries stop after 30 seconds and return at most 1,000 rows. EXPLAIN ANALYZE is unavailable because it executes the statement.

​
Verify the connection

​
Example prompts

​
Write access

CloudThinker exposes only row inserts, updates, and deletes. Each call pauses for approval and uses the write connection string only for that call.
  • An UPDATE or DELETE without a WHERE clause is refused.
  • The retained tools cannot create, alter, drop, or truncate databases, tables, or indexes.
  • Mutation receipts report the action, table, and affected-row count.
  • Approval for one mutation does not approve another mutation.

​
Troubleshooting

Use sslmode=require, verify-ca, or verify-full. The connection refuses disable, allow, and prefer because they permit an unencrypted or downgraded database socket.
Confirm the username, URL-encoded password, host, port, and database. Copy the CockroachDB Cloud connection string again after a password reset.
Grant schema USAGE and the required table privilege. New tables need grants or configured default privileges.
Confirm that the write URL differs from the read URL, the write user holds the exact table privilege, and you approved this specific call. Add a WHERE clause to every update or delete.
This is an expected CockroachDB v26 boundary. The connection reports the gap instead of inferring a node count, cluster ID, or user list.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Separate credential lanes — keep SELECT on the read user and row-mutation privileges on the write user. Never grant both sets to one connection string.
  • Verified TLS — prefer sslmode=verify-full and a hostname that matches the server certificate.

PostgreSQL Connection

Connect another PostgreSQL-compatible database with a dedicated user

Approval

Control how agent write tools request approval