Skip to main content
The Redis connector works with anything that speaks the Redis protocol on a single endpoint: self-hosted Redis, Redis Cloud, Amazon ElastiCache and MemoryDB, Upstash, Valkey and Dragonfly. It talks to one endpoint at a time: a standalone server, a replica, or the primary endpoint of a cache with cluster mode off. In cluster mode a key on another shard answers MOVED, which the connector reports as bad_request.

​
Tools

​
Safety

  • Read-only by default, enforced in the client. Redis has no read-only transaction, so every read tool sends only commands from a fixed allowlist (GET, SCAN, TYPE, XRANGE, INFO, …). Anything else, including KEYS, FLUSHDB, EVAL and every write, is refused before a byte is sent. Scan Keys walks the keyspace with SCAN and never calls KEYS, so it cannot block the server.
  • Enforced by Redis too, with an ACL user. Connect with a user that holds read commands only (below). Then even a write tool on a read_write connection gets permission_denied from Redis itself. Test Connection warns when the user can run write commands.
  • Limits on every call. Calls time out after 15 s (up to 55 s with timeout_seconds). Results stop at 500 keys, fields, items or entries (up to 5,000 with max_rows) and 1 MB, and each value is cut at 64 KB. A cut result has truncated: true. Scan Keys also stops after 1,000 SCAN calls.
  • Writes are separate tools. Set, Delete and Expire only run on a connection stored with mode read_write, and every call returns a confirm_token first that the agent must show you and send back. Delete takes key names, never a pattern.
  • No secrets in results. Passwords and connection strings are removed from every error message. SlowLog redacts every argument after AUTH, ACL SETUSER password rules and CONFIG SET password values.
  • Values are safe to read. Text comes back as UTF-8; binary values come back as {"encoding": "base64", "data": "..."}.

​
Create a read-only ACL user

On Redis 6 and later (and Valkey), create a user that can read and nothing else:
Run ACL SAVE (or CONFIG REWRITE) if your server keeps users in a file. Narrow ~* to a key prefix such as ~app:* to limit what agents see. Managed services have their own screens for this: ElastiCache and MemoryDB use user groups with an access string (the part after the password above), Redis Cloud uses roles with ACL rules, and Upstash offers a read-only token. Test Connection reports write_access: "unknown" for this user: the check uses ACL DRYRUN, which needs @admin, and a read-only user should not hold it.

​
Connect

Open Redis in the dashboard’s tool catalog and click Connect, or let the agent call store_credential. Fill in host, port, user (leave it empty for the default user), password and database index, or paste a redis:// or rediss:// URL as the connection string. Mode stays Read only unless you want Set, Delete and Expire to work. TLS is on by default for a public host and verifies the certificate against the public CAs. Paste your provider’s CA certificate when it uses its own (Redis Cloud does), or pick On, skip certificate check to encrypt without verifying. A rediss:// URL turns TLS on and redis:// turns it off. How Danube reaches Redis depends on where it lives:
Services with a public endpoint (Upstash, Redis Cloud, a server with a public address) connect directly with TLS. Allow Danube’s egress addresses in the firewall or security group: see Connect your production database safely.
Run Test Connection after saving. It tells you which of these failed: the credentials (auth_required), the network (connection_error, destination_blocked) or TLS (tls_error). A TLS handshake that gets no answer usually means the server listens without TLS.

​
Example prompts

  • “How much memory is Redis using, and has it evicted any keys today?”
  • “Find the session:* keys that never expire.”
  • “Is the billing consumer group on the events stream falling behind? How many entries are pending?”
  • “Show me the last 20 entries of the orders stream.”
  • “What are the slowest commands in the slow log right now?”
  • “What’s stored in the order:1234 hash?”