Bonnard
Get started

Connect data

Connect PostgreSQL to your AI client

Updated

To chart Postgres data in Claude, ChatGPT or another AI client, connect it here, then create an app on it. Bonnard reads PostgreSQL through a read-only user, so your apps query only what you grant.

PostgreSQL at a glance
FactPostgreSQL
CredentialA read-only user
Port5432 by default
SSLverify-full by default
NetworkA public hostname or IP address, reached from Bonnard’s IP addresses
TenancyNo tenancy, Multi-tenant (RLS) or Schema per tenant

Requirements

  • The Admin role in your Bonnard workspace.
  • A PostgreSQL login that can create roles.

1. Create a read-only user

Bonnard connects as this user. Agents can query only the tables that the user can read.

SQL

-- A user that can log in and read, nothing more
CREATE ROLE mcp_reader LOGIN PASSWORD '<password>'
  NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;

-- Run these two lines once for each schema apps should query
GRANT USAGE ON SCHEMA <schema> TO mcp_reader;
GRANT SELECT ON <schema>.<table_1>, <schema>.<table_2> TO mcp_reader;

Replace <password>, <schema> and the table names with your values. Grant tables that you add later the same way.

2. Allow Bonnard’s IP addresses

If your database has an IP allowlist, add Bonnard’s IP addresses to it for port 5432. The connect form shows them under Allow our IP addresses. Bonnard cannot reach databases on a private network.

3. Add the connection

  1. In the console at app.bonnard.ai, select Data, then PostgreSQL.
  2. Enter a Connection name. Then enter the user’s details from the table below.
  3. If you have a connection string, paste it into Import from connection string (optional). Then select Fill fields.
  4. Select Test & connect. Bonnard signs in as the user and reads the tables that the user can read.
PostgreSQL connection fields
FieldEnter
Connection nameA name for this database in Bonnard, for example Production.
HostThe server’s public hostname or IP address.
Port5432, unless your server listens on another port.
DatabaseThe database to read.
User and PasswordThe read-only user from step 1, for example mcp_reader.
SSL modeKeep verify-full. If your server uses a private CA, for example Amazon RDS, paste its bundle into CA certificate (PEM).

4. Choose the tenancy

Select how callers get the data. Then select Save & continue.

Tenancy options
OptionUse it when
No tenancyAll callers get the same data.
Multi-tenant (RLS)Your row-level security policies decide each caller’s rows. The policies read the caller’s tenant (the customer that the caller belongs to) from current_setting('app.tenant_id').
Schema per tenantEach tenant’s tables sit in their own schema, named by a pattern, for example customer_{tenant}.

Connection saved shows the number of tables discovered.

Troubleshooting

Host resolves to a private or reserved address.

Use the public hostname. Bonnard cannot reach private networks.

The test times out

Make sure that Bonnard’s IP addresses are on your allowlist (step 2).

Connected, but introspect failed: <message>

The user cannot read the table list. Fix what the message names.

A table is missing

Grant SELECT on it. Then select Re-introspect on the database’s Tables tab.

Any other error

Any other error is PostgreSQL’s own message. Examine the field that the message names. Then select Test & connect again.

Charts in your AI client

Create an app on this database, so that Claude, ChatGPT, Cursor, Microsoft Copilot, Gemini and other MCP clients can query it and draw charts.