Database · PostgreSQL
An AI agent for your Neon Postgres database
Neon is serverless PostgreSQL, so Caterfli connects with the same guarded PostgreSQL connector it uses everywhere else. Paste the connection details, choose the tables, and the agent gets a read tool and a count tool for each — with writes off until you turn them on.
What you get
Neon capabilities, under your rules
- ✓ Tables, columns, types and foreign keys are read directly
- ✓ A read tool and a count tool for every visible table
- ✓ Choose which tables an agent can see; a table added later is picked up automatically
- ✓ Read-only until you turn on write operations
- ✓ Schema changes, and an UPDATE or DELETE with no WHERE clause, are always refused
- ✓ Values are always bound parameters, never pasted into the SQL text
- ✓ Reads capped by row count and payload size, with a timeout set on the session
What you need to connect it
- Host, database, role and password from your project’s connection details
- The direct host, rather than the pooled one with -pooler in its name
- Nothing extra for TLS — Neon requires it, and the connection negotiates it
Discovered tools
What a Neon connection turns into
discovery · Neon
ready- list_customers read
- count_customers read
- create_orders create
- update_orders update
- delete_customers delete Approval
Illustrative table names. A new connection is read-only, so only the list and count tools exist until you allow writes.
Human approval
Destructive work waits for a person
approval
waiting- Tool
- delete_customers
- Operation
- DELETE
- Runs against
- Production Neon
- Agent
- Support Agent
Exactly these values
{
"filters": {
"id": 100
}
}
Your decision applies to these values only. If anything about the call changes, it stops for approval again.
A delete stops for a person. The approval covers this call with these arguments, once.
Should I use Neon’s pooled or direct connection?
The direct connection. The connector sets a statement timeout on its session, and a pooled connection in transaction mode does not keep session settings between statements.
Does it work with Neon branches?
Yes. Each branch has its own connection host, so a connection points at exactly one branch. Connecting a development branch first is a good way to try an agent on realistic data without touching production.
Can the agent change or delete data in my Neon database?
Not unless you allow it. A new connection is read-only, so only list and count tools exist. When you turn writes on, schema changes and any UPDATE or DELETE without a WHERE clause are still refused, and a destructive tool waits for a person to approve each call by default.
Does the database have to be reachable from the internet?
No. Either allow-list Caterfli’s outbound IP address in your firewall or database access rules, or keep the database private and reach it through an SSH tunnel via a bastion host you control.
Can I limit which tables and rows the agent sees?
Yes. Untick a table to put it out of reach. Row filters limit a table to matching rows — for example orders where user_id = 5 — and rows outside a filter cannot be read, counted, updated or deleted.
Can the agent write its own SQL?
Only if you turn on ad-hoc SQL, which is off by default. The agent then gets one tool that runs a single validated statement: one statement only, an allow-listed verb, no schema changes. Ad-hoc SQL is switched off while any row filter is set.
Can the AI model see my database password?
No. The password is encrypted before it is stored and injected by the connector at the moment of a call. The model only ever sees tool names and argument schemas.
Connect Neon to your first agent
Connect one system and read the agent Caterfli writes from it. There is a demo connection too, if you would rather look before you wire anything up.