Connect PostgreSQL to AI, keep every query as a skill

1. 1

   Create a read-only Postgres role

   In your database, grant only what Chion needs:

   CREATE ROLE chion_read LOGIN PASSWORD '<strong-password>';
   GRANT CONNECT ON DATABASE <dbname> TO chion_read;
   GRANT USAGE  ON SCHEMA public       TO chion_read;
   GRANT SELECT ON ALL TABLES IN SCHEMA public TO chion_read;
   ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO chion_read;

2. 2

   Grab the six connection fields

   From your provider's dashboard, collect Host, Port (5432 for direct connections, 6543 for the Supabase transaction pooler, 6432 for the Azure PgBouncer pooler), Database, Schema (default public), User, and Password.

3. 3

   Paste into Chion

   Open Chion, click Connect PostgreSQL, paste the six fields. Credentials are wrapped in an AES-256-GCM envelope in Supabase Vault, never logged, never shown to the language model, and only unsealed inside the edge function for the duration of one query.

4. 4

   Chion profiles your schema

   Chion reads table and column metadata (names, types, cardinality) but never samples row data. The schema profile is what the language model sees; rows stay inside your database.

5. 5

   Ask in plain English

   Type a question. Chion generates SQL, passes it through the multi-stage validator (L1 read-only SELECT check, L2 mode-based validator), executes it read-only with a capped LIMIT of 1,000 rows or 12,000 cells, and renders the result as an interactive D3.js chart. See how conversational analytics works.

Universal defaults

Standard PostgreSQL connection parameters.

Most text-to-SQL tools accept a database connection and generate queries. Chion goes further: every generated query passes through a multi-stage SQL validator (L1 enforces read-only SELECT at the syntax level, L2 applies mode-based restrictions) before execution. Credentials never leave the AES-256-GCM vault except inside the edge function for a single query's duration. Result sets are capped at 1,000 rows or 12,000 cells. Row-level security policies are honored on every query, and the language model never sees raw row data, only schema metadata and aggregated results. These are architectural constraints, not configuration options.

Read-only SELECT. AES-256-GCM credential vault. 1,000-row cap. Immutable audit log.

If you were planning to wire up a Postgres MCP server for Claude instead, that route is free and gives you full control of the tooling layer. What you build yourself, though, is only as safe as the role you grant it: there is no query validator, no credential vault, and no result cap unless you write them. Chion ships those constraints by default, and every verified query still exports as a portable skill you can run in Claude Code, Cursor, or Codex.

Connection string reference

Where each field lives in a standard Postgres connection string.

postgres://<user>:<password>@<host>:<port>/<database>?sslmode=require

postgres://neondb_owner:REDACTED@ep-cool-forest-123456.us-east-2.aws.neon.tech/neondb?sslmode=require

postgres://postgres:REDACTED@db.abcdefghijklmnop.supabase.co:5432/postgres?sslmode=require

postgres://postgres.abcdefghijklmnop:REDACTED@aws-0-us-east-1.pooler.supabase.com:6543/postgres?sslmode=require

postgres://postgres:REDACTED@my-db.c9akciq32.us-east-1.rds.amazonaws.com:5432/postgres?sslmode=require

All passwords above are redacted. Chion stores your password encrypted in Supabase Vault (AES-256-GCM); it is never logged, never shown in the UI after save, and never sent to the language model.

Schema discovery query

List all available schemas after connecting.

SELECT schema_name 
FROM information_schema.schemata 
WHERE schema_name NOT IN ('pg_catalog', 'information_schema', 'pg_toast')
ORDER BY schema_name;

Troubleshooting common PostgreSQL connection errors

Solutions for the most frequent connection issues.

GRANT SELECT ON TABLE schema.relation TO chion_read;
ALTER DEFAULT PRIVILEGES IN SCHEMA schema
  GRANT SELECT ON TABLES TO chion_read;

Official provider documentation

Authoritative references for each managed PostgreSQL service. All open in a new tab.

• Amazon RDS PostgreSQL

  Connection guide, endpoints, and Multi-AZ behavior.

• Azure PostgreSQL Flexible Server

  Networking, PgBouncer, and TLS configuration.

• Google Cloud SQL for PostgreSQL

  Public IP setup, authorized networks, and read replicas.

• Neon connection docs

  Branches, pooled vs direct endpoints, and cold-start behavior.

• Supabase database connection guide

  Direct vs Supavisor pooler ports and the auth schema.

• PostgreSQL CREATE ROLE

  Reference for the read-only role pattern Chion uses.

Frequently asked questions