Connect a live MySQL database

What a live MySQL connection does

A live connection lets Loam and permitted AI tools inspect and query your current MySQL data. It does not copy, synchronize, or modify the source database. Each connection appears beneath a workspace-owned path such as integrations.production_reporting.

A workspace can contain several MySQL connections, including connections to the same server with different credentials and access policies.

Prepare a least-privilege MySQL account

Create a dedicated account rather than reusing an application or administrator login. Grant only SELECT and SHOW VIEW on the databases Loam should discover:

CREATE USER 'loam_reader'@'%'\n  IDENTIFIED BY 'replace_with_a_long_random_password'\n  REQUIRE SSL;\nGRANT SELECT, SHOW VIEW ON `analytics`.* TO 'loam_reader'@'%';

Repeat the GRANT for another database only when that whole database should be visible. Do not grant global privileges, mutation privileges, FILE, PROCESS, or administrative roles. MySQL permissions are the first security boundary. Loam policy can narrow them, but cannot grant access the account does not have.

Require verify-identity TLS

1. Require encrypted transport on MySQL, for example with require_secure_transport=ON.
2. Use a server certificate whose subject alternative name matches the public DNS hostname you will enter in Loam.
3. Make that DNS hostname reachable from the public Internet. Private networks, SSH tunnels, and fixed Loam egress IPs are not supported yet.
4. If a private certificate authority signed the server certificate, keep its CA certificate ready in PEM format.

Loam uses verify-identity behavior: it validates both the certificate chain and the original DNS hostname. It does not accept an IP-literal endpoint or downgrade to unverified TLS. A custom CA extends trust for that connection; it does not disable hostname verification.

Connect the database

1. Open Settings > Integrations (sign in to open this page).
2. Choose Add database, then select MySQL.
3. Enter a display name and a lowercase integrations alias.
4. Enter the DNS hostname, port, initial database, read-only username, and password as separate fields. The default MySQL port is 3306. Do not paste a connection URL.
5. If needed, paste the private CA certificate, then choose Test and Connect database.

The password and optional CA certificate are encrypted in the workspace's regional data plane. Loam never returns the password or CA certificate through the API and cannot show either value again.

Browse MySQL databases and exact names

Choose Browse structure to inspect cached databases, tables, views, and columns allowed by both the MySQL account and Loam policy. Choose Rescan after an upstream schema change. A MySQL database is one namespace segment below the connection mount, so a catalog path can look like integrations.production_reporting.analytics.orders.

The catalog preserves exact MySQL names. Quote reserved words, spaces, hyphens, and other awkward identifiers with backticks in remote SQL, for example `archive-2025`.`Quarterly Sales`. The connection selection identifies the server; the database and relation remain part of the remote name.

Run a bounded read-only query

In Read-only query, choose the connection, enter one MySQL SELECT or read-only CTE, and choose Run query. The query runs against MySQL live and may see newer rows than the last structure scan. It does not query a copied Loam Table.

Loam rejects writes, DDL, session changes, locking reads, multiple statements, and unsafe functions. Every query has row, byte, concurrency, statement, and total-time limits. Cancellation reaches MySQL and discards the physical session so later work cannot inherit uncertain session state.

Query from Database

1. Call list_database_connections and keep the returned connectionId.
2. Call search_database_schema to find a relation, or describe_database_relation when you know its database and exact name.
3. Call query_database with that stable connection ID and one selective, read-only MySQL query.

These tools belong to the separate Database connection. The ordinary Loam execute_sql_query tool queries stored Loam Tables; it is not the live MySQL query tool. Do not substitute a display name, integrations alias, or catalog path for the stable connection ID.

Replace credentials or change the endpoint

Replace credentials requires a complete new username and password. Loam validates them before draining sessions that used the old secret. Editing the endpoint similarly requires the complete hostname, port, and initial database because saved values are redacted. Leave the CA field empty to preserve the current private CA, or supply a new PEM certificate to rotate it.

Pause or delete

Pausing stops new live queries and drains active pools without deleting configuration. Deleting removes the encrypted secret and the corresponding integrations mount. Neither action changes the external MySQL databases.