MySQL & MariaDB

Connect Datost to a MySQL or MariaDB database for Slack-native analytics.

Datost connects directly to MySQL 5.7+ and MariaDB 10.3+ so your team can ask questions in Slack and get answers grounded in live data.

What you'll need

Hostname, port (default 3306), and database name
A username and password for a read-only user
Whether the instance is public (reachable from the internet) or private (VPC / on-prem)

Create a read-only user

Datost is built around safety. We strongly recommend a dedicated analyst user with SELECT-only access to the schemas you want exposed.

CREATE USER 'datost'@'%' IDENTIFIED BY 'strong-password-here';
GRANT SELECT ON your_database.* TO 'datost'@'%';
GRANT SHOW VIEW ON your_database.* TO 'datost'@'%';
FLUSH PRIVILEGES;

GRANT SELECT, SHOW VIEW ON your_database.*
  TO 'datost'@'%' IDENTIFIED BY 'strong-password-here';
FLUSH PRIVILEGES;

CREATE USER 'datost'@'%' IDENTIFIED BY 'strong-password-here';
GRANT SELECT, SHOW VIEW ON your_database.* TO 'datost'@'%';
FLUSH PRIVILEGES;

Connect in the admin panel

Open Data Sources

In the Datost web app, go to Settings → Data Sources and click Add data source.

Pick MySQL

Select MySQL from the connector grid. Use the same option for MariaDB.

Enter credentials

Fill in host, port (3306 by default), database, username, and password. You can also paste a mysql://user:pass@host:3306/db connection string and we'll parse it.

Configure SSL

Toggle Require SSL if your server enforces TLS. Managed providers (PlanetScale, Aiven, AWS RDS with SSL, DigitalOcean) require this.

Test and save

Click Test connection. Datost runs a version check (SELECT VERSION()) and verifies it can list tables. On success, save — schema introspection starts immediately.

Public vs. private instances

Public instances

If your database accepts connections from the public internet, allowlist Datost's outbound IPs (contact support for the current list) and connect directly.

Private instances

For databases inside a VPC, behind a bastion, or on-prem, install the Tunnel Agent — a small container that runs in your network and brokers encrypted connections outbound to Datost. No inbound firewall rules required.

Install the Tunnel Agent

Follow the Tunnel Agent setup guide to deploy the agent in your VPC.

Select the tunnel

When adding the MySQL source, choose Connect via Tunnel Agent and pick the agent you just installed. Host/port are resolved from inside your network.

Supported features

Schema introspection across all accessible databases
Query planning with EXPLAIN and EXPLAIN ANALYZE (MySQL 8.0.18+)
Read-only SQL execution with automatic LIMIT guards
Table-level exclusions to hide sensitive data from the AI

Troubleshooting

Access denied for user: verify the user host portion ('datost'@'%') allows connections from Datost's IPs or the Tunnel Agent.
SSL connection error: switch the SSL toggle to match your server's require_secure_transport setting.
Unknown database: the user must have SELECT on the specific schema — grants on *.* are fine too.