PostgreSQL

Where to find these

Worclaude queries Postgres live and read-only — nothing is copied into the app, and every statement it writes is a single SELECT.

1. Host, port and database

From whoever runs the database, or from your connection string:

postgres://user:[email protected]:5432/appdb
                         └────────host────────┘ └po┘ └ db ┘

Port is 5432 unless someone changed it. On a managed service the host is in the console: RDS → Databases → your instance → Endpoint; Neon, Supabase and Render each show a full connection string you can read the parts out of.

2. A read-only user

Do not use your application's database user. It can write, and a question typed into a chat box should never be able to. Ask for a read-only role, or make one:

CREATE USER worclaude_ro PASSWORD 'a-long-random-string';
GRANT CONNECT ON DATABASE appdb TO worclaude_ro;
GRANT USAGE ON SCHEMA public TO worclaude_ro;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO worclaude_ro;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT ON TABLES TO worclaude_ro;

That last statement is the one people forget — without it the user cannot read tables created after today, and the source quietly goes stale.

3. Network access

Worclaude connects from this deployment's egress address, so the database has to accept connections from it: a security group rule on RDS, an IP allowlist on Neon or Supabase, a pg_hba.conf line if you host it yourself. A connection that hangs rather than being refused is almost always this.

4. SSL mode

Leave it on require. Managed providers insist on it, and disable sends the password in the clear.