> ## Documentation Index > Fetch the complete documentation index at: https://docs.danubeai.com/llms.txt > Use this file to discover all available pages before exploring further. # Redis > Let agents scan keys, read strings, hashes, lists and streams, check consumer group lag and read INFO and the slow log in your Redis The Redis connector works with anything that speaks the Redis protocol on a single endpoint: self-hosted Redis, Redis Cloud, Amazon ElastiCache and MemoryDB, Upstash, Valkey and Dragonfly. It talks to one endpoint at a time: a standalone server, a replica, or the primary endpoint of a cache with cluster mode off. In cluster mode a key on another shard answers `MOVED`, which the connector reports as `bad_request`. ## Tools | Tool | What it returns | | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Test Connection** | Server (Redis or Valkey) and version, mode, replication role, the ACL user, whether that user can run write commands, whether TLS is on and verified, the database's key count, and warnings | | **Get** | One string value, its size, and `truncated` above 64 KB. A key of another type returns its type and which tool reads it | | **MGet** | Up to 100 string keys in one round trip, each with value, size and type | | **Scan Keys** | Keys matching a glob pattern (optionally one type) with type and TTL, found with `SCAN`, plus `next_cursor` to continue | | **Type and TTL** | For up to 100 keys: existence, type, TTL, memory used and length | | **HGetAll** | The fields of a hash; large hashes are read with `HSCAN` up to `max_rows` fields, with `truncated` when some were left out | | **LRange** | Items of a list by index, with the list length and the range read | | **Stream Range** | Stream entries between two ids, oldest or newest first, with `next_start` to continue | | **Stream Info** | Stream length, first and last entry, and each consumer group's consumers, pending count, last delivered id and lag | | **Info** | `INFO` for one section (memory, clients, stats, replication, keyspace, ...) as an object | | **SlowLog** | Recent slow commands with duration in microseconds, time, client and arguments (passwords redacted) | | **Set** | Sets a string key, with an optional TTL and `nx` / `xx`. Needs a `read_write` connection and a confirmation on every call | | **Delete** | Deletes up to 100 keys by name. Needs a `read_write` connection and a confirmation | | **Expire** | Sets a key's expiry in seconds, or removes it with `persist`. Needs a `read_write` connection and a confirmation | ## Safety * **Read-only by default, enforced in the client.** Redis has no read-only transaction, so every read tool sends only commands from a fixed allowlist (`GET`, `SCAN`, `TYPE`, `XRANGE`, `INFO`, ...). Anything else, including `KEYS`, `FLUSHDB`, `EVAL` and every write, is refused before a byte is sent. Scan Keys walks the keyspace with `SCAN` and never calls `KEYS`, so it cannot block the server. * **Enforced by Redis too, with an ACL user.** Connect with a user that holds read commands only (below). Then even a write tool on a `read_write` connection gets `permission_denied` from Redis itself. Test Connection warns when the user can run write commands. * **Limits on every call.** Calls time out after 15 s (up to 55 s with `timeout_seconds`). Results stop at 500 keys, fields, items or entries (up to 5,000 with `max_rows`) and 1 MB, and each value is cut at 64 KB. A cut result has `truncated: true`. Scan Keys also stops after 1,000 `SCAN` calls. * **Writes are separate tools.** Set, Delete and Expire only run on a connection stored with mode `read_write`, and every call returns a `confirm_token` first that the agent must show you and send back. Delete takes key names, never a pattern. * **No secrets in results.** Passwords and connection strings are removed from every error message. SlowLog redacts every argument after `AUTH`, `ACL SETUSER` password rules and `CONFIG SET` password values. * **Values are safe to read.** Text comes back as UTF-8; binary values come back as `{"encoding": "base64", "data": "..."}`. ## Create a read-only ACL user On Redis 6 and later (and Valkey), create a user that can read and nothing else: ```text theme={null} ACL SETUSER danube on >choose-a-long-password ~* &* -@all +@read +@connection +info +slowlog|get +memory|usage +xinfo +scan +ping +type +ttl +acl|whoami ``` Run `ACL SAVE` (or `CONFIG REWRITE`) if your server keeps users in a file. Narrow `~*` to a key prefix such as `~app:*` to limit what agents see. Managed services have their own screens for this: ElastiCache and MemoryDB use user groups with an access string (the part after the password above), Redis Cloud uses roles with ACL rules, and Upstash offers a read-only token. Test Connection reports `write_access: "unknown"` for this user: the check uses `ACL DRYRUN`, which needs `@admin`, and a read-only user should not hold it. ## Connect Open **Redis** in the dashboard's tool catalog and click **Connect**, or let the agent call `store_credential`. Fill in host, port, user (leave it empty for the default user), password and database index, or paste a `redis://` or `rediss://` URL as the connection string. Mode stays **Read only** unless you want Set, Delete and Expire to work. TLS is on by default for a public host and verifies the certificate against the public CAs. Paste your provider's CA certificate when it uses its own (Redis Cloud does), or pick **On, skip certificate check** to encrypt without verifying. A `rediss://` URL turns TLS on and `redis://` turns it off. How Danube reaches Redis depends on where it lives: Services with a public endpoint (Upstash, Redis Cloud, a server with a public address) connect directly with TLS. Allow Danube's egress addresses in the firewall or security group: see [Connect your production database safely](/connectors/production-database#allowlist-danubes-addresses). ElastiCache and MemoryDB only listen inside the VPC. Fill in the **SSH bastion** fields: the bastion's public host, user, private key and host key fingerprint, and set **Host** to the Redis endpoint as the bastion sees it. Danube verifies the bastion's host key against the fingerprint you stored and never trusts a new key on first use. Leave the fingerprint empty once and Test Connection prints the key the bastion presented, so you can check it and paste it in. TLS defaults to off through a tunnel; set it to **On** when in-transit encryption is enabled on the cache. Run the [data-plane agent](/organizations/data-plane) inside the network and store the password as a reference, for example `env://REDIS_PASSWORD`. The call then runs on the agent, which resolves the reference locally. Nothing inbound is opened, and the password never reaches Danube. Build the agent image with `DANUBE_DB_ENGINES=redis`. Run **Test Connection** after saving. It tells you which of these failed: the credentials (`auth_required`), the network (`connection_error`, `destination_blocked`) or TLS (`tls_error`). A TLS handshake that gets no answer usually means the server listens without TLS. ## Example prompts * "How much memory is Redis using, and has it evicted any keys today?" * "Find the `session:*` keys that never expire." * "Is the `billing` consumer group on the `events` stream falling behind? How many entries are pending?" * "Show me the last 20 entries of the `orders` stream." * "What are the slowest commands in the slow log right now?" * "What's stored in the `order:1234` hash?"