Connecting your database

SQL Server

Give us a standard connection string — point it at a read replica if you have one, but it's not required. We add ApplicationIntent=ReadOnly before connecting.

Server=your-server.database.windows.net;Database=yourdb;User Id=codepanion_reader;Password=...;

Create a dedicated user with only SELECT on the tables the agent needs:

CREATE USER codepanion_reader WITH PASSWORD = '...';
GRANT SELECT ON SCHEMA::dbo TO codepanion_reader;

PostgreSQL

Same idea. Give us a standard connection string; we set default_transaction_read_only=on at the session level. A read replica is ideal but not mandatory.

Host=your-server.example.com;Database=yourdb;Username=codepanion_reader;Password=...;

Create a dedicated role with only SELECT on the schemas the agent should see:

CREATE ROLE codepanion_reader WITH LOGIN PASSWORD '...';
GRANT USAGE ON SCHEMA public TO codepanion_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO codepanion_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT ON TABLES TO codepanion_reader;

Where to configure

Open Settings in the Codepanion app and enter your connection string. It's encrypted at rest in Azure Key Vault and only accessed by the agent at query time. Test the connection before saving to confirm it works.

Query plans for slow lookups

When the agent runs a query it can also capture the database's actual execution plan (SHOWPLAN_XML on SQL Server, EXPLAIN on PostgreSQL) — handy when an investigation is about a slow query. Plan capture is best-effort and never blocks the result: queries run under a short timeout with a single polite retry, so the agent always gets its rows even if the plan can't be fetched.