Connect sources

Keel reads your databases through a read-only principal you create for it. Each page below has the script for one engine — the same script Sources › Connect source › Copy read-only role script copies — and what Keel needs from the engine to harvest metadata, profile columns and answer semantic queries.

Engine	Page	How the script is verified
PostgreSQL	PostgreSQL	Run against PostgreSQL 17 in the connector integration suite
SQL Server / Azure SQL	SQL Server	Run against SQL Server 2022 (CI) and Azure SQL Edge (arm64)
MySQL / MariaDB	MySQL	Run against MySQL 8.4
Oracle	Oracle	Run against Oracle Database 23ai Free (the optional v$sqlarea grant needs SYS: not run)
Amazon Redshift	Redshift	Run against PostgreSQL 17 as Redshift's compatible subset; SYSLOG ACCESS is Redshift-only (not run)
Snowflake	Snowflake	Syntax and privilege lint only — no Snowflake engine in CI
Google BigQuery	BigQuery	Syntax and privilege lint only — the emulator has no IAM
Databricks SQL	Databricks	Syntax and privilege lint only — no Databricks engine in CI

What "verified" means

For every engine with a runnable engine in CI, the connector suite runs the published script as an administrator, then proves with the new principal that:

1. Test connection passes authentication, metadata access and the least-privilege check;
2. Keel harvests the schema (tables, keys, foreign keys) and profiles a table;
3. the principal cannot write: an INSERT into a table in scope and a CREATE TABLE are both refused by the engine.

Every script — including the three cloud warehouses — also passes a lint on each docs build: only statements that create a principal or grant read access (SELECT, USAGE, CONNECT, view definitions, statistics) may appear; any write, ownership or administrative privilege fails the build. A unit test keeps each published script identical to the one the product copies.

Before you connect

• Replace the placeholder names — database, schema, warehouse, project — and choose your own password.
• Keep Keel on the schemas it should see. You can narrow further with Schemas in scope and Exclude in the connect sheet; see Connect a source.
• Keel warns — it does not fail — when a connection can write, and never writes through a source connection. The only writes Keel ever makes are the licensed Keel Migrate module's, to a migration target, through your private agent with a separate credential (Run and cut over).
• Behaviour per engine (sampling, timeouts, what is read) is in the connector reference.