Redis

Connect a Redis server, such as self-hosted Redis, Upstash, or Redis Cloud, to let CloudThinker agents inspect memory and eviction, find the largest keys and keys with no TTL, list clients, and read command latency. You give CloudThinker one connection URL (REDIS_URL): agents can run the commands that user’s ACL allows, and the connection’s write tools go through Approvals first.

Prerequisites

A Redis endpoint CloudThinker can reach from the internet. Agents connect from CloudThinker Cloud, so localhost and private addresses resolve there, not on your network. There’s no private-link option, so VPC-only services such as Amazon ElastiCache and MemoryDB can’t connect. See Reaching private services.
Redis 6 or later if you want a dedicated ACL user. Older versions only support a single shared password.
Admin access to run ACL SETUSER, or to create users in your managed provider’s console.

Setup

Create a read-only user

Self-hosted Redis
Managed Redis

Create a user that can read keys and run the diagnostic commands agents use, and nothing else:

redis-cli --askpass ACL SETUSER cloudthinker-readonly on \
  '><readonly-password>' '~*' \
  -@all +@read +info +ping +select '+client|list' -keys

Part	Meaning
`'><readonly-password>'`	Sets the password. The `>` is ACL syntax
`'~*'`	Allows all keys. Narrow it to a prefix, such as `'~app:*'`
`-@all +@read`	Starts from nothing, then allows read commands such as `GET`, `SCAN`, `TYPE`, and `TTL`
`+info +ping +select '+client\|list'`	Allows server stats, health checks, picking a database index, and listing clients
`-keys`	Blocks `KEYS`, which can stall a large instance. Agents use `SCAN` instead

--askpass prompts for the admin password, so it stays out of your shell history. Add --user <admin-user> if you don’t sign in as default. Keep the quotes around '+client|list': without them the shell reads | as a pipe.Save it so it survives a restart: run ACL SAVE if you use an aclfile, or CONFIG REWRITE if your users live in redis.conf.

Every provider takes the same ACL rule. Paste it without quotes into a console field, and keep the quotes around '+client|list' in a shell:

~* -@all +@read +info +ping +select +client|list -keys

Redis Cloud: go to Data Access Control. Add a Redis ACL with the rule above, create a role that applies it to your database, then create a user with that role.
Azure Cache for Redis: use the TLS port 6380 with rediss://, and allow CloudThinker’s egress IPs in the cache’s firewall rules.

Then copy the TCP or Redis CLI connection URL for that user. Don’t use a REST or SDK URL: CloudThinker speaks the Redis protocol.

Check the user is read-only

redis-cli -u 'rediss://cloudthinker-readonly@redis.example.com:6379' --askpass SET probe 1
redis-cli -u 'rediss://cloudthinker-readonly@redis.example.com:6379' --askpass INFO memory

Use redis:// only if your server doesn’t use TLS. A scheme that doesn’t match the server fails with a connection error, not NOPERM.Success state: SET fails with NOPERM, and INFO memory prints memory stats.

Open network access

Allow inbound connections on the Redis port from CloudThinker’s egress IPs in your firewall, security group, or provider allowlist. These docs don’t publish CloudThinker’s egress IP list: ask your CloudThinker contact, or contact us. The port is 6379 by default, 6380 for Azure TLS, and assigned per database on Redis Cloud. On self-hosted Redis, make sure bind in redis.conf isn’t only 127.0.0.1.

Add the connection in CloudThinker

Open More → Workspace settings → Connections, select Redis, and click Connect on its detail panel. In the dialog, optionally change the Alias and Description. Paste the URL into REDIS_URL and click Connect:

rediss://cloudthinker-readonly:<readonly-password>@redis.example.com:6379/0

Success state: the connection shows Connecting and Verifying, then Connected. CloudThinker then runs Discovery once: a read-only look at the server whose results show in the Discovery section of the connection’s detail panel.

Connection details

Field	Required	Description	Example
Alias	No	Short name for this server. Prefilled with the next free alias, such as `redis-1`	`prod-cache`
Description	No	What this server is. Agents read it to choose between instances	`Production session cache`
REDIS_URL	Yes	Full URL: scheme, user, password, host, port, and optional database index	`rediss://cloudthinker-readonly:<password>@redis.example.com:6379/0`

URL part	Values
Scheme	`rediss://` for TLS (required by Upstash), `redis://` for plain TCP
User	Your ACL user. On Upstash and on Redis with only a password, use `default`
Port	`6379` by default, `6380` for Azure TLS. Redis Cloud assigns a port per database, so copy it from the console
Database index	`/0` to `/15` at the end. Leave it off for `0`

URL-encode special characters in the password (@ becomes %40).

Required permissions

You want agents to	Allow
Read keys, types, TTLs, sizes, and key counts	`+@read` and a key pattern such as `~*`
Read memory, eviction, hit rate, replication, and command stats	`+info`
See connected clients	`+client\|list`
Use a database index other than `0`	`+select`
Change keys	Write categories such as `+@write`. Not recommended. See Write access

Keep the user read-only. A read-only ACL stops every write at Redis, whatever is approved.

Agent capabilities

Capability	What agents can do
Memory and eviction	Read used memory, fragmentation ratio, `maxmemory` policy, evictions, and hit rate
Keyspace	Count keys per database, sample keys with `SCAN`, and read type, size, and TTL
Expiration audit	Compare keys with and without a TTL in each database, and check the `maxmemory` policy against them
Largest keys	Rank sampled keys by size: string length, or element count for lists, hashes, sets, and sorted sets. The default sample is 100 keys from `SCAN`, so results are estimates, and the answer says when the scan didn’t cover every key
Clients and latency	List connected clients and read per-command call counts and latency from `INFO commandstats`
Replication	Read role, connected replicas, and replication offset
Modules	Read RediSearch indexes and RedisJSON documents, when the server has those modules loaded

Verify the connection

Summarize Redis memory usage, connected clients, eviction policy, and key counts per database

Expect used memory and peak, the client count, the maxmemory policy, and a key count for each database index. A NOPERM error names the missing command. Add it with ACL SETUSER cloudthinker-readonly, then ask again.

Example prompts

Which sampled keys are the largest, and what share of keys in each database has no TTL?
Is Redis evicting keys? Show the eviction policy, evictions, and hit rate
Which commands have the highest average latency according to commandstats?

Write access

The Redis connection has write tools. If the ACL allows writes, each one goes through Approvals first, and a rule can ask first or refuse them. Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself.

Class	Tools
Write	Set, expire, rename, publish, pop from lists, and add to hashes, lists, sets, sorted sets, streams, and JSON documents
Destructive	Delete a key, or remove items from a hash, list, set, sorted set, stream, or JSON document
Depends on the command	A raw Redis command: reads like `GET` run without asking, `DEL` or `FLUSHALL` count as destructive, anything else counts as a write

Troubleshooting

NOAUTH or WRONGPASS

The user or password is wrong or missing. Check both in REDIS_URL, including URL-encoding. On Upstash, use default as the user and the database token as the password. On self-hosted Redis, run ACL LIST to confirm the user exists and is on.

Connection closed, or the connection never reaches Connected

Usually a malformed URL. Check the scheme (rediss:// for a TLS endpoint, which Upstash requires), the host, the port, and that a password is present. A REST or SDK URL from your provider won’t work: use the TCP or Redis CLI one.

Connection refused or timed out

CloudThinker can’t reach the server. Check your firewall, security group, or provider allowlist, and that bind in redis.conf isn’t only 127.0.0.1. A server on a private network needs a reachable endpoint first.

NOPERM on INFO, CLIENT LIST, or a read command

The ACL is missing a command. Add +info, '+client|list', or the category the error names with ACL SETUSER cloudthinker-readonly ..., then ask again. NOPERM on a write command is expected for a read-only user.

Command is not available: FT.* or JSON.*

The server doesn’t have the RediSearch or RedisJSON module loaded. Many hosted tiers don’t ship them. Everything else keeps working.

Security

Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

Use rediss://: plain redis:// sends the password and every value unencrypted. Use TLS whenever your server or provider supports it.
Scope keys: replace ~* with the prefixes agents need, such as ~cache:*, so session tokens or other sensitive keys stay out of reach.

MongoDB

Connect MongoDB or Atlas in read-only mode.

Approvals

Decide which Redis writes run, wait for a person, or are refused.

Connections

Customize

Approvals

Workspace settings

Admin Settings

Artifacts and sharing

Prerequisites

Setup

Connection details

Required permissions

Agent capabilities

Verify the connection

Example prompts

Write access

Troubleshooting

Security

MongoDB

Approvals

​Prerequisites

​Setup

​Connection details

​Required permissions

​Agent capabilities

​Verify the connection

​Example prompts

​Write access

​Troubleshooting

​Security

​Related

MongoDB

Approvals

Prerequisites

Setup

Connection details

Required permissions

Agent capabilities

Verify the connection

Example prompts

Write access

Troubleshooting

Security

Related