# Let AI agents query your production database, read-only

Levirge DevOps gives Claude and other MCP agents read-only access to
PostgreSQL, MySQL, SQLite, MongoDB, InfluxDB and Redis behind your firewall.
Writes need a role you grant, checked at two points; a connection can be set
read-only; passwords stay on the host; and every agent change is audited.

**Status: private testing.** devops-client has no public download yet.
[Join the waitlist](/devops#cta).

## Read-only is layers, not one switch

| Layer | What it does |
| --- | --- |
| Role | A caller with no role is read-only. Writes need a writer role, checked at Levirge DevOps and again at devops-client. |
| Connection | A connection can be set read-only, for example for a replica. devops-client then refuses writes. |
| Statement | `run_query` flags any statement that changed data. MongoDB treats `$where`, `$function` and `$accumulator` as writes; Redis refuses commands such as `MULTI` and `MONITOR`. |
| Credentials | Passwords stay in devops-client's environment on your machine. |
| Network | devops-client connects outward. No inbound port or VPN to the database. |
| Audit | Changes an agent makes are recorded as assistant actions. |

Good practice still applies: point the connection at a replica or a database
user with read permissions only, so the database enforces it too.

## What the agent can do

- **PostgreSQL, MySQL, SQLite:** `get_sql_schema`, `run_query` (paged),
  `list_saved_queries`, and the `explain_query` prompt for `EXPLAIN ANALYZE`.
- **MongoDB:** `mongo_list_collections`, `run_mongo_query` (find or aggregate).
- **InfluxDB:** `influx_schema`, `influx_query` (Flux).
- **Redis / Valkey:** `get_redis_schema`, `redis_command`, and the
  `redis_memory_analysis` prompt.

`find_connection` turns a name like "orders" into the connection to use.

## An example

Illustrative, with made-up names and results:

| Step | The agent calls | What it learns |
| --- | --- | --- |
| 1 | `find_connection` "orders" | The orders replica, set read-only |
| 2 | `get_sql_schema` | Tables and columns, no guessing |
| 3 | `run_query` SELECT … GROUP BY status | 41 orders stuck in "pending" since 09:40 |
| 4 | `run_query` UPDATE … | Refused: the connection is read-only |

## FAQ

### Can I let an AI agent query my production database safely?

Yes, read-only by default. With Levirge DevOps the agent reads what it is
granted; writes need a writer role, checked at Levirge DevOps and again at
devops-client. You can also set a connection read-only, and devops-client then
refuses writes on it.

### Does the agent get my database password?

No. Passwords stay in devops-client's environment on your machine and are not
sent over the message bus. The agent only sees query results.

### Which databases are supported?

PostgreSQL, MySQL and MariaDB, SQLite, MongoDB, InfluxDB 2.x and Redis or
Valkey. Each plugin page lists its MCP tools and limits.

### How do I know if an agent changed data?

The `run_query` reply flags any statement that changed data, and changes an
agent makes are recorded in the audit log as assistant actions, apart from
what people did.

### Should I still use a read-only database user or a replica?

Yes, it is good practice. Point a read-only connection at a replica or a
database user with read permissions only, so the database enforces it too.
Levirge DevOps' role and connection checks sit in front of that.

### Do I need to open a port or a VPN to the database?

No. devops-client runs next to the database and connects outward through a
message bus, so the database needs no inbound port or VPN.

### Can I install it today?

Not yet. Levirge DevOps is in private testing and devops-client has no public
download. [Join the waitlist](/devops#cta) for one email when it is ready to
install.

See also: [Give AI agents the ability to monitor your infrastructure](/devops/ai-agent-infrastructure-monitoring.md).