StrataDocs
↑↓ navigate ↵ open esc close

SQL Server extension

The SQL Server extension connects Strata to a Microsoft SQL Server database — on-prem, hosted, or Azure SQL — so the AI can run live queries against your schema, generate charts and Excel exports from real results, and power the database pages in the sidebar.

Add your first connection

  1. Open Settings, then click the Extensions tab. Find the Microsoft SQL Server tile and click it.
  2. On the extension detail page, click + Add connection.
  3. In the New Connection form, fill in:
    • Connection name — a short label like Production DB. Names are unique per user; an inline availability check shows Name is available or You already have a connection with that name as you type.
    • Server — the hostname, e.g. myserver.database.windows.net.
    • Database — the database name, e.g. AdventureWorks.
    • Port — defaults to 1433.
    • Username and Password — SQL authentication credentials. Use the eye icon next to Password to reveal what you typed.
    • Trust server certificate — checked by default; uncheck if your server uses a CA-signed certificate that Strata should validate.
  4. Click Save & activate. The button cycles through Saving credentials… and Connecting to server… as Strata persists the credentials and opens a connection pool, then finishes once the live connection is confirmed. Stored procedures are indexed in the background — the connection is usable immediately, so you don't wait on a procedure-heavy database.

When the form closes you land back on the extension page with your new connection marked Active. The sidebar now shows a Data group with the database pages — Dashboard, Tables, Procedures, Explorer, and Schema map.

Note

If activation fails (wrong password, blocked port, TLS mismatch), Strata rolls back the just-saved connection so a failed attempt never leaves an orphan you'd have to clean up — fix the details and click Save & activate again.

How credentials are stored

Passwords are encrypted at rest with AES-256-GCM using a platform-managed key (DB_ENCRYPTION_KEY). The plaintext password is never written to the platform database and never returned by any API. Strata holds connection pools in memory only; pools are closed after 30 minutes of idle time and re-opened on the next query.

Strata also enforces an SSRF guard on every save and activate: hostnames that resolve to loopback, link-local, private RFC1918, carrier-grade NAT, multicast, or cloud-metadata addresses (169.254.169.254, 169.254.170.2) are rejected with Connections to private/internal addresses are not allowed. Use a public endpoint or a properly configured firewall pinhole, or ask your admin about a private connector.

Managing multiple connections

The Saved connections block on the SQL Server detail page lists every connection you've saved, with a dot to the left of the active one. Click any row to open its detail view.

On a connection's detail page you can:

  • Activate — switch the active connection to this one. The previous connection's pool is left open and idle (it gets cleaned up after 30 minutes); the database pages refresh against the new connection.
  • Rename — click the name in the page header to edit it inline. Press Enter to save, Esc to cancel.
  • Edit the description — type into the description textarea; it auto-saves when you click out of the field.
  • Delete connection — under Remove connection. You're asked to type the connection name to confirm. Deleting removes Strata's saved credentials only; the underlying database is untouched. Past chats that referenced the connection keep their history but lose live access.

If you have Org connections (databases your admin provisioned for the whole organization), they appear in the same list with an Added by your org pill. You can activate them and view their details, but you can't rename, edit, or delete them — see /docs/integrations/sql-server/org-connections.

Disconnecting

Use Disconnect in the SQL Server tile header to clear the active connection without deleting it. The connection pool closes immediately and the database pages disappear from the sidebar. Your saved credentials remain — click any connection in Saved connections to activate it again later.

What gets unlocked

With at least one SQL Server connection active, a Data group appears in the sidebar with these pages:

  • Dashboard — a database analytics overview (largest tables, schema health, object distribution).
  • Tables — browse every table with row counts and column previews.
  • Procedures — list stored procedures; enable / disable individual procedures from Strata's routing in the Procedures tab of the SQL Server extension (Settings > Extensions > Microsoft SQL Server), which appears once a database is connected.
  • Explorer — ad-hoc data exploration.
  • Schema map — visual schema relationships.

The AI now has the run_sql tool available. Ask any question about your data — "show me the 10 largest tables", "what's the trend in monthly orders by region", "build me a dashboard of last quarter's revenue" — and the AI plans the SQL, executes it, and renders results as tables, charts, Excel exports, or full dashboards depending on what you asked for.

Permissions and write queries

Whether the AI can write to your database is controlled by your SQL permission tier:

  • Viewer (default) — read-only. INSERT, UPDATE, DELETE, and DDL statements are blocked.
  • Editor — writes are allowed with a per-query confirmation card.
  • Admin — full DDL access.

Your admin sets the default tier per role under Admin > Roles. For org-managed connections, the tier is your role's default unless an admin overrides it for you on that specific connection. On your own personal connections the tier comes from your account's SQL permission setting (seeded from your role's default; your admin can lock it). See /docs/admin/roles for the tier definitions.

What can go wrong

  • You already have a connection with that name. — connection names are unique per user (case-insensitive). Pick a different name, or rename / delete the conflicting connection first.
  • Connections to private/internal addresses are not allowed. — the server you entered resolves to a private or loopback IP. The SSRF guard blocks these for safety. Use a public hostname or have your network team expose the database on a routable address, or ask your admin about a private connector.
  • Could not activate connection — check server, port, and credentials. — the credentials saved but the connection probe failed. Most often this is a wrong password, a firewall blocking port 1433, or a TLS trust mismatch (try toggling Trust server certificate).
  • SQL Server access is disabled by your organization administrator. — the sql_server extension has been removed from your org's allowed extensions. Contact your admin.
  • Session invalid — please log out and log back in on a connection action — your auth session has lost its user ID. Sign out and sign back in, then retry.
  • Database pages don't appear in the sidebar — no connection is currently active. Open Settings > Extensions > Microsoft SQL Server and activate one of your saved connections.
  • Schema cache feels stale after a database change — Strata invalidates the cache automatically on connection edit and delete. To force a fresh scan of your stored procedures specifically, open the Procedures tab of the SQL Server extension (Settings > Extensions > Microsoft SQL Server) and click the refresh icon next to the section header.

Related