> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Neon

> Connect Neon Postgres to CloudThinker with OAuth-powered MCP for project discovery, schema inspection, and database operations

Connect your Neon account to let CloudThinker agents inspect Neon projects, review database schemas, analyze slow queries, and assist with approved database operations through Neon's hosted MCP server.

Neon uses **OAuth**, so you do not need to create a Neon API key or paste credentials into CloudThinker.

***

## Prerequisites

* A **Neon account** with access to the projects you want CloudThinker to inspect.
* Permission to authorize CloudThinker through Neon's OAuth flow.
* A CloudThinker workspace where Neon is not already connected.

<Info>
  CloudThinker supports one Neon connection per workspace. To switch accounts, remove the existing Neon connection and reconnect.
</Info>

***

## Setup

<Steps>
  <Step title="Open CloudThinker">
    Navigate to **Connections → Neon** in your CloudThinker workspace.
  </Step>

  <Step title="Start the OAuth flow">
    Click **Connect** to open Neon's authorization page.
  </Step>

  <Step title="Authorize CloudThinker">
    Sign in to the Neon account that owns or can access the projects you want CloudThinker to use, then approve access.
  </Step>

  <Step title="Return to CloudThinker">
    After authorization, CloudThinker stores the OAuth tokens and shows a **Connected** status.
  </Step>
</Steps>

***

## Connection details

Neon uses OAuth — there are no connection fields to enter manually. CloudThinker stores the OAuth access and refresh tokens automatically after the authorization flow completes.

| Field            | Description                                                       |
| ---------------- | ----------------------------------------------------------------- |
| **OAuth tokens** | Issued by Neon and stored automatically; no manual entry required |

***

## Required permissions

CloudThinker inherits the Neon access granted during OAuth.

* **Read operations** include listing projects, inspecting schemas, reviewing metadata, and analyzing slow queries.
* **Write operations** such as SQL execution, branch changes, migrations, Neon Auth changes, and Data API provisioning require matching Neon access **and** explicit [approval](/guide/approval) in CloudThinker.

***

## Agent capabilities

Once connected, agents can:

| Capability            | Description                                                                  |
| --------------------- | ---------------------------------------------------------------------------- |
| **Project discovery** | Discover Neon projects, shared projects, organizations, computes, and tables |
| **Schema inspection** | Inspect schemas and table metadata                                           |
| **Query analysis**    | Review slow queries and suggest optimizations                                |
| **SQL execution**     | Run SQL or transactions only after explicit user approval                    |
| **Branch management** | Manage branches, migrations, and Neon Auth — each requires approval          |

### Verify the connection

```text theme={null}
@tony list my Neon projects and summarize their schemas
```

### Example prompts

```text theme={null}
@tony review slow queries on the production-db project and #recommend optimizations
@tony inspect the schema for the users table in the main branch
@tony list all available tables and branches on the analytics project
```

***

## Troubleshooting

<Accordion title="OAuth flow does not complete">
  You may be signed in to the wrong Neon account, or your browser session may not be signed in to Neon. Sign in to the intended Neon account and retry the CloudThinker Neon connection flow.
</Accordion>

<Accordion title="CloudThinker says Neon is already connected">
  Only one OAuth Neon connection is allowed per workspace. Use the existing Neon connection or remove it before reconnecting.
</Accordion>

<Accordion title="Agent cannot find expected Neon projects">
  The OAuth flow may have been completed with a Neon account that lacks access to those projects. Reconnect using the Neon account that owns or has access to the projects.
</Accordion>

***

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **Approval for writes** — keep SQL, branches, migrations, Auth, and Data API changes approval-gated in CloudThinker
- **Reconnect carefully** — remove the existing workspace connection before switching Neon accounts

***

## Related

<CardGroup cols={2}>
  <Card title="MCP Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/mcp.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=c89b6087a9d233901dea5e354452eff6" href="/guide/connections/mcp" width="24" height="24" data-path="images/icons/mcp.svg">
    Connect custom tools and services with MCP
  </Card>

  <Card title="Tony Agent" icon="database" href="/guide/agents/tony">
    Database analysis and optimization
  </Card>
</CardGroup>