codeDB Lens

[codeDB Lens]

See what your database isn't showing you.
Free, read-only health check for SQL Server and PostgreSQL.

Website · English · Português (Brasil)

[Latest release] [License: Apache-2.0] [Read-only] [No telemetry] [CI status] [Listed on mcpservers.org]

[codeDB Lens demo: running check, the A-F report with evidence and next actions, and the record timeline]
_{Real run against a test SQL Server (host renamed). Open a demo report.}

v0.8: check (with an executive summary and --redact for sharing), compare, and record + report to watch an instance for up to 24 hours (how). 26 rules plus 8 for recordings. FAQ and more on the website.

codeDB Lens connects to your instance with a read-only login, runs a catalog of evidence-based rules and writes a self-contained HTML + JSON report with an A–F grade and a coverage seal (the share of rules that could actually run). Nothing about your database leaves your machine.

Install

The Windows binaries are open source but not code-signed yet, so SmartScreen may show a warning. Why, and how to verify the download.

Why another tool?

• Evidence, not opinions. Every finding shows the collected values, the query that produced them and when.
• Honest confidence. Each finding is Confirmed, Hint or No data. A rule that lacks permission never shows up as a false "OK"; it lowers the coverage instead.
• Read-only, always. No DDL, no DML, no agent, no installation on the server.
• Rules are data. Each rule is a YAML file plus a SQL query. Contributions don't touch the engine.
• English and Portuguese (Brazil), in the app, the CLI and the report.

What it checks

Each rule has a documentation page with what it checks, why it matters, what to do and its limits.

Quick start

On Windows, open codeDB Lens from the Start menu. Pick the engine, enter the server and run the diagnosis. Connection profiles are saved; passwords go to the Windows Credential Manager.

Command line (Windows and Linux):

codedb-lens check --engine mssql --server prod01 --auth windowscodedb-lens check --engine pg --dsn-env PG_DSN

Passwords are never accepted as command-line arguments. Use integrated auth, an environment variable or a saved profile.

Use with AI (MCP)

[Claude using codeDB Lens over MCP: a health check with three findings, then a revenue question answered with one read-only SELECT]
_{Real Claude Code sessions against test databases; answers shortened.}

Ask Claude, GitHub Copilot or Cursor about your database. codedb-lens mcp is a read-only MCP server that your AI client starts on your computer, with your saved profiles:

• Diagnosis: with the Lens's minimal login, the AI runs the health check, reads recordings and explains what to fix, without reading business data.
• Data: with a login that reads the tables you choose, the AI lists and describes them and answers questions with one SELECT at a time, within row and time limits.

codedb-lens mcp install --client claude-desktop --profile prod   # or vscode, cursor, claude-code

The app's AI (MCP) screen has the commands ready to copy. Guide: lens.codedb.com.br/mcp.

Minimum permissions

-- SQL ServerCREATE LOGIN codedb_lens WITH PASSWORD = '<strong password>';GRANT VIEW SERVER STATE TO codedb_lens;GRANT VIEW ANY DEFINITION TO codedb_lens;GRANT CONNECT ANY DATABASE TO codedb_lens;   -- per-database rules (indexes); no data accessUSE msdb;CREATE USER codedb_lens FOR LOGIN codedb_lens;ALTER ROLE db_datareader ADD MEMBER codedb_lens;ALTER ROLE SQLAgentReaderRole ADD MEMBER codedb_lens;

-- PostgreSQL (repeat GRANT CONNECT for each database)CREATE ROLE codedb_lens LOGIN PASSWORD '<strong password>';GRANT pg_monitor TO codedb_lens;GRANT CONNECT ON DATABASE app TO codedb_lens;

Supported versions

Privacy

No telemetry. Lens makes two kinds of network calls: an optional, once-a-day version check against GitHub Releases that sends no data (--no-update-check or CODEDB_LENS_NO_UPDATE=1 turns it off), and, only when you ask for the free key, one registration request with the name and e-mail you type (or, when renewing, only the current key). See SECURITY.md.

Need continuous monitoring?

Lens shows a snapshot. codeDB watches your SQL Server and PostgreSQL instances around the clock, with history, baselines and alerts on Teams, Slack and e-mail.

Windows code signing

Windows binaries are built by GitHub Actions from this repository and are not code-signed yet (certificates are paid and this is a free project). Details, how to verify a download and warning-free alternatives: Why Windows shows a warning.

Contributing

New rules are especially welcome. A rule is a YAML file plus a SQL query, so you don't need to touch the Go code: see CONTRIBUTING.md, or just open an issue with a rule idea.

License

Apache 2.0. The codeDB SaaS and its API are separate, closed-source products.