Database · AWS
An AI agent for your Amazon RDS database
RDS runs ordinary PostgreSQL, MySQL and MariaDB, so Caterfli connects with the matching guarded connector. Most RDS instances live in a private subnet; Caterfli reaches those through an SSH tunnel via a bastion host you control, so nothing has to be made public.
What you get
Amazon RDS capabilities, under your rules
- ✓ Tables, columns, types and foreign keys are read directly
- ✓ A read tool and a count tool for every visible table
- ✓ Choose which tables an agent can see; a table added later is picked up automatically
- ✓ Read-only until you turn on write operations
- ✓ Schema changes, and an UPDATE or DELETE with no WHERE clause, are always refused
- ✓ Values are always bound parameters, never pasted into the SQL text
- ✓ Reads capped by row count and payload size, with a timeout set on the session
What you need to connect it
- The instance endpoint and port from the RDS console — 5432 for PostgreSQL, 3306 for MySQL and MariaDB
- For a private instance: a bastion host Caterfli can reach over SSH, and a key for it
- For a publicly accessible instance: Caterfli’s outbound IP address allowed in its security group
- A database user with only the grants the agent needs
Discovered tools
What a Amazon RDS connection turns into
discovery · Amazon RDS
ready- list_customers read
- count_customers read
- create_orders create
- update_orders update
- delete_customers delete Approval
Illustrative table names. A new connection is read-only, so only the list and count tools exist until you allow writes.
Human approval
Destructive work waits for a person
approval
waiting- Tool
- delete_customers
- Operation
- DELETE
- Runs against
- Production Amazon RDS
- Agent
- Support Agent
Exactly these values
{
"filters": {
"id": 100
}
}
Your decision applies to these values only. If anything about the call changes, it stops for approval again.
A delete stops for a person. The approval covers this call with these arguments, once.
My RDS instance is in a private subnet. Can Caterfli reach it?
Yes, through an SSH tunnel. Give Caterfli a bastion host in the same VPC; the host and port you enter are then the RDS endpoint as the bastion sees it. Pinning the bastion’s host key stops an impostor intercepting the tunnel.
Does Caterfli need AWS credentials?
No. It connects with a database username and password and, for a private instance, an SSH key for the bastion. It never asks for AWS access keys and cannot touch anything else in your account.
Does it work with Aurora?
Aurora’s PostgreSQL- and MySQL-compatible editions speak the same protocols, so connect them with the PostgreSQL or MySQL connector. Pointing a read-only agent at the reader endpoint keeps its queries off the writer.
Can the agent change or delete data in my RDS database?
Not unless you allow it. A new connection is read-only, so only list and count tools exist. When you turn writes on, schema changes and any UPDATE or DELETE without a WHERE clause are still refused, and a destructive tool waits for a person to approve each call by default.
Does the database have to be reachable from the internet?
No. Either allow-list Caterfli’s outbound IP address in your firewall or database access rules, or keep the database private and reach it through an SSH tunnel via a bastion host you control.
Can I limit which tables and rows the agent sees?
Yes. Untick a table to put it out of reach. Row filters limit a table to matching rows — for example orders where user_id = 5 — and rows outside a filter cannot be read, counted, updated or deleted.
Can the agent write its own SQL?
Only if you turn on ad-hoc SQL, which is off by default. The agent then gets one tool that runs a single validated statement: one statement only, an allow-listed verb, no schema changes. Ad-hoc SQL is switched off while any row filter is set.
Can the AI model see my database password?
No. The password is encrypted before it is stored and injected by the connector at the moment of a call. The model only ever sees tool names and argument schemas.
Connect Amazon RDS to your first agent
Connect one system and read the agent Caterfli writes from it. There is a demo connection too, if you would rather look before you wire anything up.