# PostgreSQL

Подключение к базе PostgreSQL (Supabase, Neon, Yandex Managed PostgreSQL, RDS) — аналитический read-only SQL по данным клиента.

## Scenarios

### A question to the database without SQL
The agent works out the schema itself — tables, columns and relations — and answers your question about the data without a single line of SQL from you.

### Metrics straight inside the database
The agent calculates revenue, average order value and conversion with a query to your database and shows which tables and columns the numbers came from.

### A recurring data digest
On a schedule the agent runs the same query — yesterday sales or a spike in failures — and sends the result.

### Reconciliation with external services
The agent matches the rows of your database against data from connected services and shows discrepancies in orders or payments.

## How to connect

### Create a read-only role
In your database SQL console (Supabase and Neon have a “SQL Editor”, otherwise psql as the owner) run CREATE ROLE analytics_ro LOGIN PASSWORD '…'. The password you set here is the connection password.

### Grant the role read access
GRANT pg_read_all_data TO analytics_ro — this built-in role exists from PostgreSQL 14. On older versions: GRANT USAGE ON SCHEMA public, GRANT SELECT ON ALL TABLES IN SCHEMA public, plus ALTER DEFAULT PRIVILEGES for future tables.

### Check row-level security
pg_read_all_data does not bypass row-level security, and in Supabase RLS is on almost everywhere: without a SELECT policy for the role such tables return zero rows even though the connection succeeds.

### Open the database to outside connections
The host must be reachable from the internet: in Yandex Managed PostgreSQL enable public access for the host and allow TCP 6432 in the security group; in RDS set “Publicly accessible: Yes” and open 5432. Supabase and Neon are open already.

### Collect the connection parameters
Host, port and database name: Supabase — the “Connect” button at the top of the dashboard, Neon — “Connect” on the project dashboard, Yandex — the host FQDN and port 6432. User and password come from your CREATE ROLE, SSL mode — require.

## FAQ

### How do I connect PostgreSQL?
With connection parameters rather than a sign-in through the service: host, port, database name, user, password and SSL mode. Create a read-only role — CREATE ROLE analytics_ro LOGIN PASSWORD and GRANT pg_read_all_data — and it is that login and password you enter in the form.

### What does the agent see in the database?
The list of tables, the columns and types and the results of SELECT within the permissions of the role. The pg_read_all_data role does not bypass row-level security: tables under RLS with no SELECT policy return zero rows.

### Does the agent write to the database?
No. Only SELECT, WITH, SHOW and EXPLAIN are allowed, one statement per call and with a row limit — INSERT, UPDATE and any DDL are rejected by the connector.

### What is needed on the database side?
The host must be reachable from the internet: in Yandex Managed PostgreSQL enable public access and open TCP 6432, in RDS set publicly accessible and a rule on 5432. Supabase and Neon are open right away.

[Open PostgreSQL](https://www.postgresql.org/docs/current/sql-createrole.html)