To chart SQL Server data in Claude, ChatGPT or another AI client, connect it here, then create an app on it. Bonnard reads Microsoft SQL Server through a read-only login, so your apps query only what you grant.

Requirements

The Admin role in your Bonnard workspace.
A SQL Server login that can create logins and database users.
SQL Server authentication turned on, which on Azure SQL means Microsoft Entra-only authentication is off.

Bonnard connects as this login. Agents can query only the tables it can read.

SQL

-- In master: the login Bonnard connects as
CREATE LOGIN mcp_reader WITH PASSWORD = '<password>';

-- In your database. On Azure SQL Database, connect to it directly:
-- USE does not switch databases there.
CREATE USER mcp_reader FOR LOGIN mcp_reader;

-- Run this line once for each schema apps should query. Grant SELECT and nothing more:
-- Bonnard adds no read-only check on SQL Server, so this grant is the limit
GRANT SELECT ON SCHEMA::<schema> TO mcp_reader;

Replace <password> and <schema> with your own. The grant covers tables you add to the schema later.

2. Allow Bonnard’s IP addresses

If your database limits who can connect, allow Bonnard’s IP addresses on port 1433. The connect form lists them under Allow our IP addresses. Bonnard cannot reach databases on a private network. On Azure SQL Database, add them as server-level IP firewall rules.

3. Add the connection

In the console at app.bonnard.ai, select Data, then MSSQL.
Enter a Connection name and the login’s details from the table below.
Select Test & connect. Bonnard connects as the login and reads the tables it can see.

Microsoft SQL Server connection fields
Field	Enter
Connection name	A name for this database in Bonnard, such as `Production`.
Host	The server’s public hostname or IP address, such as `<server>.database.windows.net` on Azure SQL Database.
Port	`1433`, unless your server listens on another port. For a named instance, enter the fixed port it listens on.
Database	The database to read.
User and Password	The read-only login from step 1, such as `mcp_reader`.
SSL mode	Keep `verify-full`. For a private CA, such as Amazon RDS, paste its bundle into CA certificate (PEM).

4. Choose the tenancy

Choose how callers see the data, then select Save & continue.

Tenancy options
Option	Use it when
No tenancy	Every caller should see the same data.
Multi-tenant (RLS)	Your row-level security policies decide each caller’s rows. They read the caller’s tenant (the customer they belong to) from `SESSION_CONTEXT(N'tenant_id')`.
Database per tenant	Each tenant’s tables sit in their own database, named by a pattern such as `customer_{tenant}`.

Connection saved shows the number of tables discovered.

Troubleshooting

Host resolves to a private or reserved address. Use the public hostname. Bonnard cannot reach private networks.
The test times out. Check that Bonnard’s IP addresses are allowed (step 2).
Connected, but introspect failed: <message> The login cannot read the table list. Fix what the message names.
A table is missing. Grant SELECT on its schema, then select Re-introspect on the database’s Tables tab.
tenant_not_routable under Multi-tenant (RLS). Check the tenant ID: on SQL Server, Bonnard accepts up to 128 characters.
Any other error is SQL Server’s own message. Check the field it names, then select Test & connect again.

Charts in your AI client

Create an app on this database, so AI clients such as Claude and ChatGPT can query it and draw charts.