MySQL

What it coversCopy Anchor Link

Use MySQL only after other evidence points to a query or table. The client can verify session safety, show active and slow sessions, show InnoDB engine state, explain a query and inspect replica status.

ConnectCopy Anchor Link

reckon connect mysql-prod --org acme --provider mysql --for-env prod

Fill in ~/.reckon/orgs/acme/secrets/mysql-prod.env with a read-only user:

MYSQL_HOST=db.example.com
MYSQL_TCP_PORT=3306
MYSQL_USER=readonly
MYSQL_PWD=replace_me
MYSQL_DATABASE=app

MYSQL_HOST and MYSQL_USER are required. There is no reckon login for databases.

reckon verify mysql-prod runs mysql -e "SELECT 1".

Read-only contractCopy Anchor Link

MySQL is an approval connection: the agent must ask you before each run, and Claude Code's settings in the org folder mark every reckon run mysql-prod or reckon run mysql as ask. Read each query before you allow it.

• The user is the real barrier. MYSQL_USER must be a true read-only account; it is the only layer that denies writes on every path.
• Reckon applies session read-only. It writes an option file for the connection with the user, the database and init-command=SET SESSION TRANSACTION READ ONLY, and passes it to every run with --defaults-extra-file. This stops accidents, not a determined write.
• Reckon refuses -h, --host, -u, --user, -p, --password, -P, --port, -S, --socket, --defaults-file, --defaults-extra-file, --no-defaults and --init-command.
• EXPLAIN before any non-trivial query and put LIMIT on every SELECT (default 100).

Key commandsCopy Anchor Link

reckon run mysql -- -e "SELECT @@transaction_read_only;"
reckon run mysql -- -e "SELECT id, user, host, db, command, time, state, LEFT(info, 200) AS query FROM information_schema.processlist WHERE command != 'Sleep' ORDER BY time DESC LIMIT 20;"
reckon run mysql -- -e "SHOW ENGINE INNODB STATUS\G"
reckon run mysql -- -e "EXPLAIN <query>;"
reckon run mysql -- -e "SHOW REPLICA STATUS\G"

The first command must report 1.

LinksCopy Anchor Link

• MySQL client documentation