> ## Documentation Index > Fetch the complete documentation index at: https://docs.danubeai.com/llms.txt > Use this file to discover all available pages before exploring further. # Connect Your Production Database Safely > Give coding agents read-only access to production data, logs and infrastructure without handing them credentials Coding agents get stuck the moment a bug needs something outside the repo: the rows behind a failing request, the logs around an error, the lag on a queue. Danube gives your team's agents (Claude Code, Cursor, Codex and anything that speaks MCP) one governed connection to those systems. Agents never see a password, can only read unless you say otherwise, and every call lands in your audit log. This page covers the controls that apply to every infrastructure connector: [PostgreSQL](/connectors/postgres), [MySQL](/connectors/mysql), [ClickHouse](/connectors/clickhouse), [Redis](/connectors/redis), [Kafka](/connectors/kafka), [Kubernetes](/connectors/kubernetes), [AWS](/connectors/aws) (CloudWatch, DynamoDB, Lambda, SQS, S3, Redshift), [Grafana](/connectors/grafana), [Prometheus](/connectors/prometheus), [New Relic](/connectors/newrelic), [Firebase](/connectors/firebase) and [Salesforce](/connectors/salesforce). ## What agents can and cannot do | Control | How it works | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Read-only by default** | A connection is `read_only` unless you store it as `read_write`. Read tools are enforced by the system itself where it can: Postgres and MySQL run every read in a `READ ONLY` transaction, ClickHouse with `readonly=1`, and Kubernetes and AWS by the permissions of the identity you connect. | | **Writes are separate tools** | Execute Statement, Set Key, Produce Message, Restart Rollout and the other write tools are their own tools. They refuse to run on a read-only connection, and on a read-write one every call returns a `confirm_token` that the agent must show you and send back. | | **One statement, no tricks** | SQL tools reject comments, a second statement and write keywords before anything is sent. | | **Hard limits** | Every call has a timeout (15 s by default), a row cap (500 by default) and a 1 MB response cap. A result that was cut says `truncated: true`. | | **No secrets in results** | Passwords, tokens, keys and connection strings are removed from every error and masked in every result. Agents never receive the connection's credentials. | | **Audit log** | Each call records who ran it, from which agent or key, the connection, the tool, a SHA-256 of the statement (never the text), the row count, the duration and the outcome. See [Audit Log](/organizations/audit-log). | ## Use a read-only identity The strongest guarantee is an identity that cannot write. Each connector page has the exact role to create: * **Postgres:** a role with `SELECT` only and `default_transaction_read_only = on` ([SQL](/connectors/postgres#create-a-read-only-role)). * **MySQL:** a user with `SELECT, SHOW VIEW, PROCESS` ([SQL](/connectors/mysql)). * **Redis:** an ACL user limited to `+@read` ([ACL line](/connectors/redis)). * **Kafka:** `Read` and `Describe` ACLs, or `DeveloperRead` on Confluent Cloud ([ACLs](/connectors/kafka)). * **Kubernetes:** a ServiceAccount bound to a read-only ClusterRole that excludes Secrets ([YAML](/connectors/kubernetes)). * **AWS:** an IAM role Danube assumes with an external id, with only `Describe`, `List`, `Get` and `Query` actions ([policies](/connectors/aws)). **Test Connection** on every connector reports the identity it connected as and warns when it holds more privileges than it needs. ## Choose how Danube reaches the system Most production systems live in a private network. There are three ways in, and you can mix them per connection. ### Allowlist Danube's addresses For a system with a public endpoint (Supabase, Neon, Confluent Cloud, a managed database with public access), Danube connects directly and requires TLS. Allow Danube's egress addresses in the firewall or security group: ```bash theme={null} curl https://api.danubeai.com/v1/infra-connectors/egress ``` The connection form in the dashboard shows the same list. A direct connection only reaches public addresses: a host that resolves to a private, loopback or cloud-metadata address is refused (`destination_blocked`). ### Go through an SSH bastion If you already run a bastion, add it to the connection: its public host, a user, a private key and the host key's SHA256 fingerprint. Danube verifies the bastion's key against that fingerprint on every call and never trusts a new key on first use. The database host can then be a private address that the bastion reaches. Available for Postgres, MySQL, ClickHouse, Redis, Kubernetes, Grafana and Prometheus. ### Run the data-plane agent For systems that should never be reachable from outside, run the [data-plane agent](/organizations/data-plane) inside the network. It connects **outbound only** to Danube, so nothing inbound is opened. Store the connection's secrets as references instead of values (`env://PG_PASSWORD` or `vault://secret/db#password`). The agent resolves them locally and runs the call there, so the password never reaches Danube. An admin can also require this path for the whole organization: turn off **Direct infrastructure connections** under Organization > Settings. ## Connect in five minutes Use the SQL, ACL or policy from the connector's page. Open the connector in the dashboard's tool catalog and click **Connect**, or have your agent call `store_credential`. Leave the mode on **Read only**. Allowlist Danube's addresses, fill in the SSH bastion fields, or run the data-plane agent with the secrets as references. Ask your agent to "test the Postgres connection". The answer names the identity, the TLS state and any over-privilege warning, or says exactly which of authentication, network or TLS failed. ## Example prompts * "Pull the last 50 errors from the checkout service in CloudWatch and find the matching orders in Postgres." * "What's the consumer lag for payments-worker, and are its pods restarting?" * "Why is this query slow? Explain it and suggest an index." * "Tail the logs of the api pods since ten minutes ago and summarize the errors."