Automate your Postgres reporting with an AI agent

What can a companion run against Postgres?

Open the Postgres entry under `strawberry://settings/integrations`.

The Available tools list names every tool the app exposes and marks the read-only ones. Forty seconds of reading replaces every assumption you would otherwise carry into a session on a live database.

Underneath it sits the Permissions block, where each action is set to Ask every time, Always allow, or switched off. Switching one off is a stronger statement than remembering to read an approval card carefully at 17:50 on a Friday.

Grant the role before you write the prompt

Approvals are the last line.

The role you connect with is the first, and it decides everything a companion can touch.

Create a role for the connection. CONNECT on one database, USAGE on the schemas it needs, SELECT on the tables it should see, nothing else. Point it at a read replica. Set `statement_timeout` so a badly shaped join dies at thirty seconds instead of pinning a core through lunch.

That is how you would provision access for a new analyst, and it takes about as long. Point the connection at staging instead and you get the same schema answers with production out of the picture.

• One dedicated role, not the application user and definitely not a superuser.
• SELECT-only unless you have a specific reason, then grant the specific reason.
• A read replica if one exists, so a runaway query cannot slow the checkout path.
• `statement_timeout` and `idle_in_transaction_session_timeout` set on the role itself.

Where is a connected Postgres worth it?

In the joins Postgres cannot see.

The row says the subscription is active. Whether the customer is happy is in a support thread, and why the plan changed is in a billing dashboard. A companion reads all three and comes back with one paragraph.

The recurring version pays most. A Monday pass over the same eight questions, written up the same way, is the weekly reporting that gets skipped in a busy sprint. Turning a query result into something a non-engineer can act on is ordinary data work, and if it ends in a spreadsheet, see extracting data into a spreadsheet.

How the connection works

You connect the account once and see the exact permissions before you approve them.

Strawberry never receives the credential you enter, and the connection belongs to one Strawberry profile rather than your whole machine. Disconnecting removes the managed account.

One note that saves a support ticket: a list action that succeeds and returns nothing is not a broken connection. Reconnect when Strawberry marks the account unhealthy, not when a query comes back empty. Is it safe to let AI use my browser covers the approval model, and the security page has the rest.

Frequently asked questions