# Connect PostgreSQL to your AI client

> Connect PostgreSQL to Bonnard through a read-only user and an IP allowlist, the first step to querying it from Claude, ChatGPT or another AI client.

Updated: 2026-10-12

To chart Postgres data in Claude, ChatGPT or another AI client, connect it here, then create an app on it.
Bonnard reads PostgreSQL through a read-only user, so your apps query only what you grant.

[Video: Connecting PostgreSQL: the Data page, the PostgreSQL form, Test & connect, the tenancy choice, and Connection saved]

## Requirements

- The Admin role in your Bonnard workspace.
- A PostgreSQL login that can create roles.

## 1. Create a read-only user

Bonnard connects as this user. Agents can query only the tables it can read.

```sql
-- A user that can log in and read, nothing more
CREATE ROLE mcp_reader LOGIN PASSWORD '<password>'
  NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;

-- Run these two lines once for each schema apps should query
GRANT USAGE ON SCHEMA <schema> TO mcp_reader;
GRANT SELECT ON <schema>.<table_1>, <schema>.<table_2> TO mcp_reader;
```

Replace `<password>`, `<schema>` and the table names with your own. Grant tables you add later the same way.

## 2. Allow Bonnard's IP addresses

If your database limits who can connect, allow Bonnard's IP addresses on port `5432`. The connect form lists them
under **Allow our IP addresses**. Bonnard cannot reach databases on a private network.

## 3. Add the connection

1. In the console at `app.bonnard.ai`, select **Data**, then **PostgreSQL**.
   [Image: The Data page with PostgreSQL under Databases]
2. Enter a **Connection name** and the user's details from the table below. To fill them from a URL, paste it into
   **Import from connection string (optional)** and select **Fill fields**.
   [Image: The PostgreSQL connection form]
3. Select **Test & connect**. Bonnard logs in as the user and reads the tables it can see.

Table: PostgreSQL connection fields

| Field | Enter |
| --- | --- |
| **Connection name** | A name for this database in Bonnard, such as `Production`. |
| **Host** | The server's public hostname or IP address. |
| **Port** | `5432`, unless your server listens on another port. |
| **Database** | The database to read. |
| **User** and **Password** | The read-only user from step 1, such as `mcp_reader`. |
| **SSL mode** | Keep `verify-full`. For a private CA, such as Amazon RDS, paste its bundle into **CA certificate (PEM)**. |

## 4. Choose the tenancy

Choose how callers see the data, then select **Save & continue**.

Table: Tenancy options

| Option | Use it when |
| --- | --- |
| **No tenancy** | Every caller should see the same data. |
| **Multi-tenant (RLS)** | Your row-level security policies decide each caller's rows. They read the caller's tenant (the customer they belong to) from `current_setting('app.tenant_id')`. |
| **Schema per tenant** | Each tenant's tables sit in their own schema, named by a pattern such as `customer_{tenant}`. |

[Image: The tenancy step for PostgreSQL]

**Connection saved** shows the number of tables discovered.

[Image: Connection saved, with the tables discovered]

## Troubleshooting

- `Host resolves to a private or reserved address.` Use the public hostname. Bonnard cannot reach private networks.
- The test times out. Check that Bonnard's IP addresses are allowed (step 2).
- `Connected, but introspect failed: <message>` The user cannot read the table list. Fix what the message names.
- A table is missing. Grant `SELECT` on it, then select **Re-introspect** on the database's **Tables** tab.
- Any other error is PostgreSQL's own message. Check the field it names, then select **Test & connect** again.

## Charts in your AI client

[Create an app](https://bonnard.ai/docs/apps/create-an-app.md) on this database, so AI clients such as Claude and ChatGPT can query it and draw charts.