Add a PostgreSQL or MySQL database to your project

Create a dedicated PostgreSQL or MySQL database, connect it to a project so its own account owns the tables, and create tables from Claude Code or Codex.

The quickest way: let the deploy create it#

If your code reads a database connection variable such as DATABASE_URL, POSTGRES_URL, MYSQL_URL or DB_HOST and DB_PASSWORD, and the project has no value for it yet, deploying from an AI tool or uploading in the console creates a size S database and connects it before the build starts. It is PostgreSQL, or MySQL when the code reads MYSQL_ names. Nothing else to do: ask your AI tool to deploy.

Deploy this folder to Agent Lab. It uses PostgreSQL through DATABASE_URL.

When this happens, when it doesn't, and what the AI tool sees while it waits: Databases and caches the code needs. The rest of this page is for creating and managing a database yourself.

What you get#

Each database is its own dedicated Google Cloud SQL instance, with its own public address. Nothing is shared with other organizations.

Inside one instance you can keep several databases, for example one per project. Each database belongs to one environment, and a project connects only to databases in its own environment.

What your plan includes#

• Free: the database isn't charged; it counts toward the free quota. It needs a card on file first (nothing is charged), and it stops by itself after 7 days without use. Start it again from its page.
• Paid plans: billing starts when the database is created. A stopped database pays only for its storage. Prices are on the pricing page.
• Only organization owners and admins can create a database, because it is billed.

Create a database#

Create an Agent Lab PostgreSQL database named orders, size S, in Taiwan, that my Agent Lab projects can connect to.

Creating a database usually takes 10–15 minutes. MySQL on size S can take longer.

Connect a project#

Connecting gives the project its own database account, with a strong password Agent Lab generates, and writes the connection into the project's secrets. Nobody sees the password, not you and not the AI tool.

Connect my orders-api project to the orders database. Read the code to see which variables it uses.

{
  "database": "orders",
  "site": "<project id from sites_list>",
  "variables": { "DATABASE_URL": "url" }
}

What connecting does:

• The project's account owns its own database. It can create and change tables, so migrations that an ORM runs at start-up (Prisma, Drizzle, Django, Rails, Laravel, TypeORM and the like) work. It reaches no other database on the instance, and it can't create accounts or databases. Ask for write (read and write data, no schema changes) or read if the project needs less.
• A database is created inside the instance when the project has none yet. It is named after the project's address label, with hyphens turned into underscores, unless you name it: a lowercase letter first, then lowercase letters, digits and underscores, at most 50 characters on PostgreSQL and 64 on MySQL.
• The allowlist is opened to Agent Lab if it wasn't: Allow services running on Agent Lab is turned on.
• Encryption: the url part uses sslmode=require on PostgreSQL. On MySQL it carries no TLS setting, because each driver spells it differently: turn TLS on in your driver.
• A database that requires client certificates can't be connected this way yet. Connect the project by hand, or change its encryption to Allow only SSL connections.

To disconnect, databases_disconnect_app removes the account and the variables it wrote; the data stays. databases_rotate_app_password gives the project a new password and restarts it.

Create tables and query data from an AI tool#

From Claude Code, Codex or another MCP client connected to Agent Lab, you don't need a database password or a SQL client:

In the orders database, create a notes table with an id, a body and a created_at timestamp, then show me the tables.

• list_tables shows the tables, apply_migration runs a named migration (a transaction on PostgreSQL; statement by statement on MySQL), and execute_sql runs one query. The assistant shows you the SQL before it runs.
• Every migration is recorded with its name and SQL, in the database's own agentlab_data_control.migrations table.
• Owners, admins, the database's creator and its database admins can already write. Other members need Reader or Writer access, given on the database's Data access section or with databases_grant.

Arguments, limits and examples: MCP tools › Database data tools.

Connect from your computer or another host#

Add your IPv4 address under Authorized networks on the database's Settings tab, then connect to the address on its Overview tab with a user from Users and databases. Download server-ca.pem from the Certificates tab.

psql "host=<address> port=5432 dbname=orders user=<user> sslmode=verify-ca sslrootcert=server-ca.pem"

mysql --host=<address> --port=3306 --user=<user> --password \
  --ssl-mode=VERIFY_CA --ssl-ca=server-ca.pem orders

Use verify-ca (PostgreSQL) or VERIFY_CA (MySQL): verify-full and VERIFY_IDENTITY don't work with an IP address. MySQL 9.7 accepts only caching_sha2_password, so use the MySQL 8.0 client or later, Connector/J 8.0 or later, or PHP 7.4 or later. The Overview tab has examples for Node.js, Python, Go, Java and PHP.

Connection security#

Client certificates are issued on the Certificates tab with Issue certificate. The private key is shown once: download client-key.pem before you close the dialog. Issue the new certificate before revoking the old one, so clients can switch without downtime. On MySQL, revoking a certificate ends every current connection; clients with a valid certificate reconnect.

With certificates, add them to the connection:

psql "host=<address> port=5432 dbname=orders user=<user> sslmode=verify-ca sslrootcert=server-ca.pem sslcert=client-cert.pem sslkey=client-key.pem"

A MySQL database that requires a certificate answers Access denied without one, exactly as for a wrong password: check the certificate first.

The Connections section lists who connected in the last 30 days, from which address, and why a failed sign-in was refused. databases_connections answers the same.

Move an existing database in#

Make a dump with pg_dump or mysqldump, then use Import data on the database's row, or ask the AI tool, which uses databases_import. Agent Lab checks every statement before anything runs and lists what it refuses, with line numbers. The dump commands and what is skipped: MCP tools › Moving a database in.

Stop, start and delete#

• Stop keeps the data and the address; every connection drops. On a paid plan the storage is still billed. Start brings it back at the same address within a few minutes.
• Delete database asks you to type its name. Choose Take a final backup before deleting to keep a last backup; a stopped database is started first for it.
• From an AI tool: databases_stop and databases_start.

Restore to a point in time#

On the Business plan, turn on Point-in-time recovery (PITR) in the database's Settings. You can then use Restore to a point in time to pick any moment in the last 7 days after it was turned on.

• A restore creates a new database with the data as of that moment. The original isn't changed. The new database counts toward your plan and is billed on its own, and starts with point-in-time recovery off.
• On MySQL, turning point-in-time recovery on or off restarts the database: connections drop for several minutes, up to about 20 on size S.
• Only owners and admins can start a restore.