A MySQL client for production that runs queries in read-only transactions

Browse MySQL databases, tables, columns, indexes and DDL, and run SQL inside server-side read-only transactions. Connect directly or through an SSH tunnel.

Transport: ego-component/egorm with the MySQL driver (port 3306 by default)

A MySQL query tab marked Read-only session, with a SELECT on the orders table and a sortable results grid capped at 500 rows.
A MySQL query tab marked Read-only session, with a SELECT on the orders table and a sortable results grid capped at 500 rows.

What you can do today

  • Test authentication before saving the profile
  • Switch databases per query tab without closing other tabs
  • Browse tables, then inspect columns, indexes and the server's DDL
  • Run SQL inside a server-side read-only transaction
  • Sort, filter, page and export results to CSV
  • Values keep their full precision (no float rounding of DECIMAL or BIGINT)
  • TLS with certificate verification, and SSH tunnels (password, private key or agent)

Not supported yet

  • Editing rows in the results grid
  • Schema changes and table design
  • Import, backup and restore
  • Custom CA and client certificates

A MySQL GUI that is safe to point at production

Most MySQL clients are built around editing: a results grid you can type into, a schema designer, a one-click “drop table”. That is what you want on your laptop database and the opposite of what you want when you are debugging production at 2 a.m.

DevOpsPad opens every MySQL query in a server-side read-only transaction. The editor header says Read-only session, and MySQL itself refuses data changes inside it, so a stray UPDATE without a WHERE clause fails instead of committing. Queries time out after 20 seconds, and the result preview stops at 500 rows or 8 MiB, whichever comes first.

Browse structure before you query

The Explorer lists databases and tables for the connection. Pick a table to open its structure: columns with types, nullability and defaults, the index list, and the DDL returned by SHOW CREATE TABLE. Each query tab keeps its own database scope, so you can keep orders in one tab and billing in another without reconnecting.

SELECT id, customer, total, status, created_at
FROM orders
ORDER BY created_at DESC
LIMIT 100;

Press Cmd+Enter (or Ctrl+Enter) to run. The results grid can be sorted, filtered and paged, a row opens in an inspector on double-click, and Export CSV saves what you see.

Private networks and credentials

If MySQL only listens on a private network, turn on an SSH tunnel. DevOpsPad dials MySQL through the SSH connection itself, with host-key verification against known_hosts or a pinned SHA256: fingerprint. The database password, the SSH password and the key passphrase are each stored in the macOS keychain, never in the profile file.

Pair it with a read-only account

The read-only transaction catches the most common mistakes in the editor, but it is not a complete boundary: MySQL commits implicitly before DDL such as DROP, ALTER or TRUNCATE, so those statements are not reliably blocked by it. The real protection is a SELECT-only MySQL user. Use one for any shared or production database.

Other engines work the same way: see the ClickHouse connector for analytics tables, or the full connector list.

Help articles

Frequently asked questions

Can DevOpsPad change data in my MySQL database?

DevOpsPad has no data editing features, and every query runs inside a server-side read-only transaction, so MySQL rejects INSERT, UPDATE and DELETE. DDL statements cause an implicit commit in MySQL and are not reliably blocked by the transaction, so connect with a SELECT-only account for real protection.

How many rows does a MySQL query return?

Up to 500 rows per query, with an 8 MiB budget for the encoded result. DevOpsPad tells you when a result is partial, so add a LIMIT or a narrower WHERE clause for large tables.

Can I connect to a MySQL server that is only reachable from a bastion host?

Yes. Enable Connect through SSH tunnel, enter the bastion's address, and set the MySQL host as it is seen from the bastion. There is no local port to manage.