Neon

Connect Neon to let CloudThinker agents list your projects, branches, and computes, inspect table schemas, and find slow queries, plus run SQL, change branches, and apply migrations through your workspace’s Approvals. Neon connects with OAuth through Neon’s hosted MCP server (MCP is the protocol agents use to call a service’s tools), so you don’t create or paste an API key.

Neon’s authorization page has an Allow writes checkbox. Leave it checked and, under the default Approval mode, AI can approve a write on its own, such as a branch delete or reset. For an account with production projects, uncheck Allow writes when you authorize, or choose Manual so every write waits for a person. An Ask first or Deny Rule adds to that once CloudThinker turns on Rule enforcement for your workspace.

Prerequisites

A Neon account that can see the projects you want to investigate.
The workspace Admin role in CloudThinker to add the connection. See How access works.
Optional: the pg_stat_statements extension on the databases where you want slow-query analysis. Run CREATE EXTENSION IF NOT EXISTS pg_stat_statements; in the Neon Console SQL Editor (or any Postgres client), once on each database you want analyzed.

Setup

Open the Neon connection

In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for Neon and click Connect.

Authorize CloudThinker in Neon

CloudThinker opens Neon in a new window. Sign in with the Neon account that owns or can access your projects, then approve access. To connect read-only, uncheck Allow writes on Neon’s authorization page. Agents can then list projects, read schemas, and list slow queries, while branch changes, migrations, and other writes aren’t offered. SQL is different: CloudThinker treats every statement through Neon’s SQL tool as a change, SELECT included, so each one goes through your Approvals whichever way you set the checkbox. See Write access. With Allow writes checked, CloudThinker gets the same access as that account.If the window doesn’t open, your browser blocked the pop-up. CloudThinker shows a dialog instead: click Open Neon in it.

Return to CloudThinker

Switch back to the CloudThinker tab. If you used the Open Neon dialog, it closes on its own once the connection is ready.Success state: Neon shows a Connected status.

Run the verify prompt

Run the verify prompt to confirm the authorized account sees the projects you expect.Success state: CloudThinker lists your Neon organizations and projects with their branches and computes.

Connection details

Neon has no fields to fill in. Neon issues OAuth tokens during authorization and CloudThinker stores them for you. A workspace holds one Neon connection. To use a different Neon account, click Disconnect on the Neon connection, then click Connect and sign in with the other account.

Required permissions

CloudThinker gets the access of the Neon account you authorize, limited to reads if you unchecked Allow writes on Neon’s authorization page. Pick the account deliberately either way.

Agents can	Needs
List projects, branches, computes, and tables; read schemas	Access to the project in Neon
Analyze slow queries	Access to the project, plus `pg_stat_statements` enabled on the database
Run SQL, `SELECT` and `EXPLAIN` included	Access to the project, plus a pass through approvals for each statement. Statements that change schema or data also need write access in Neon and Allow writes checked when you authorized
Create or delete branches, reset a branch, apply migrations, tune queries, set up Neon Auth or the Data API	Write access in Neon, Allow writes checked when you authorized, plus a pass through approvals

Every Neon organization member sees every project in that organization. To limit what agents reach, authorize with a separate Neon account that isn’t in the organization, and share only the projects agents need with it. Those appear as shared projects. For production, that’s the safe default: a dedicated account shared only on the projects agents need, plus Manual chosen before you connect so a person approves every statement.

Agent capabilities

Capability	Description
Project discovery	List organizations, your projects and shared projects, branch computes, and database tables
Schema audit	Describe a project and the schemas of its tables
Slow query audit	List the slowest queries, then run `EXPLAIN` on a `SELECT` statement. Listing needs no approval. `EXPLAIN` runs through Neon’s SQL tools, so it can ask for approval like any statement
SQL	Run a statement or a transaction. CloudThinker shows the exact SQL first and says whether it changes schema or data.
Branches	Create, delete, or reset a branch from its parent
Migrations and tuning	Prepare a migration or query tuning, show you the result, then complete it as a separate approved step
Neon Auth and Data API	Provision and configure Neon Auth (managed sign-in for your app’s users, stored in your database), and provision the Data API (an HTTP API over your database tables). Both are writes that change how your app’s users sign in or reach data, so they go through approvals

Running SQL or EXPLAIN on a compute that has scaled to zero wakes it, and Neon bills the compute time while it runs. CloudThinker never completes a migration in the same step that prepared it. You see what will change before anything is applied.

Neon Auth and the Data API change what your app’s users can reach. Choose Manual so a person approves each one, rather than leaving it to AI judgment. Once CloudThinker turns on Rule enforcement for your workspace, an Ask first Rule can single out just those two.

Verify the connection

Check my Neon connection: list my organizations and projects with their branches and computes

Success state: CloudThinker lists your Neon organizations and projects with their branches and computes.

Example prompts

Find the slowest queries on my production-db Neon project and suggest indexes
Describe the schema of the users table on the main branch of production-db
Prepare a migration on production-db that adds a last_login_at column to users, and show me the plan first

Write access

Neon’s read-only option is the Allow writes checkbox on its authorization page. To change it later, click Disconnect, then Connect again and set the checkbox. With writes allowed, each SQL statement, branch change, and migration counts as a change. Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself. See The two modes for what each choice does.

Approve every production write today: choose Manual so a person approves every SQL statement, branch change, and migration. That holds whether or not Rule enforcement is on.
Limit what the Neon account itself can change: reconnect with Allow writes unchecked. SELECT still runs once approved, and listing projects, branches, and tables, schema reads, and the slow-query list keep working.

Once CloudThinker turns on Rule enforcement for your workspace, a Rule can narrow that:

Approve production writes with a Rule: add an Ask first Rule on the Neon connection so a person approves every SQL statement and migration.
Make it effectively read-only after connecting: add a Deny Rule on the Neon connection that covers every operation. Every statement through Neon’s SQL tool counts as a change, a SELECT included, so Deny stops all SQL — which unchecking Allow writes does not.

To build either Rule once enforcement is on:

Ask for the Rule

In a chat, type /create-policy Ask first for every write on the Neon connection. To block instead, ask for a Deny Rule.

Check the proposal

Open Approvals in the sidebar, then Rules → Needs review, and open the Rule. Check that Effect is Ask first (or Deny), the Rule carries the Every operation badge, and Connections names your Neon connection. What would change should show recent Neon writes as asking first (or refused).

Accept it

Select the Rule and click Accept.Success state: a toast confirms the accepted Rule, and it moves to the Active tab.

Troubleshooting

The authorization window closes but Neon never shows Connected

Your browser may be signed in to a different Neon account, or the pop-up was blocked. Sign in to the right Neon account in the same browser, then click Connect again.

Agents can't find a project you expect

You authorized a Neon account without access to that project. Click Disconnect, then Connect with an account that can see it. Projects shared with you appear as shared projects.

Slow query analysis returns nothing or fails

The database doesn’t have pg_stat_statements enabled. Run CREATE EXTENSION IF NOT EXISTS pg_stat_statements;, run some traffic, and ask again. Schema inspection and SQL still work without it.

Slow query results are empty after a quiet period

Neon doesn’t keep pg_stat_statements data when a compute scales to zero, so the history starts over each time it wakes. If you need longer history, turn off scale to zero on the compute you investigate.

Neon shows an error after it worked before

The OAuth authorization expired or was revoked in Neon. Click Connect in the error alert on the connection to authorize again.

Security

Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

No connection strings by default: agents don’t fetch a database connection string unless you ask for one. A connection string includes the database password, and it shows in the chat, so anyone who can read the conversation can read it.
Data path: agents call Neon’s hosted MCP server at https://mcp.neon.tech/mcp. SQL, branch, and migration requests and their results pass through it, and the results show in the chat, so they’re kept with the conversation. CloudThinker stores the OAuth tokens.
Cutting access: click Disconnect on the Neon connection. If the grant is revoked on the Neon side instead, the connection shows an error until someone authorizes again.
Rejection is final: if you decline a SQL statement or migration, CloudThinker doesn’t retry it. It asks how you want to proceed.

Supabase Connection

OAuth-connected Postgres projects, migrations, and logs

PostgreSQL Connection

Connect any Postgres database directly

Connections

Customize

Approvals

Workspace settings

Admin Settings

Artifacts and sharing

Prerequisites

Setup

Connection details

Required permissions

Agent capabilities

Verify the connection

Example prompts

Write access

Troubleshooting

Security

Supabase Connection

PostgreSQL Connection

​Prerequisites

​Setup

​Connection details

​Required permissions

​Agent capabilities

​Verify the connection

​Example prompts

​Write access

​Troubleshooting

​Security

​Related

Supabase Connection

PostgreSQL Connection

Prerequisites

Setup

Connection details

Required permissions

Agent capabilities

Verify the connection

Example prompts

Write access

Troubleshooting

Security

Related