This guide connects a MySQL database to Klairr with a dedicated read-only user. Klairr enforces session-level read-only and never has write access to your data.
Prerequisites
- A reachable MySQL host (5.7+ or 8.0+)
- A database admin who can create users and grant
SELECT
Step 1: Create a read-only user
CREATE USER 'klairr_reader'@'%' IDENTIFIED BY '...';
GRANT SELECT ON analytics.* TO 'klairr_reader'@'%';
GRANT SHOW VIEW ON analytics.* TO 'klairr_reader'@'%';
FLUSH PRIVILEGES;Klairr only needs SELECT and SHOW VIEW. We never request INSERT, UPDATE, DELETE, CREATE, DROP, ALTER, GRANT, or FILE.
Step 2: Add the connector
In Klairr, open Settings → Connectors → Add connector, pick MySQL, and enter:
| Field | Example |
|---|---|
| Host | db.example.com |
| Port | 3306 |
| Database | analytics |
| Username | klairr_reader |
| Password | … |
| TLS | Required (recommended) |
Klairr forces SET SESSION TRANSACTION READ ONLY and attempts a no-op write probe at connect time. A read-only user rejects the probe; over-permissioned users are rejected by Klairr.
Notes
- Multi-statement payloads are disabled in the driver. Klairr submits one
SELECTat a time. - Row-count estimates come from
information_schema.TABLES.TABLE_ROWS. They are stable enough for prompt grounding; not used for billing. - For self-hosted databases on a private network, contact support to enable a private-network exception.