Docs / Investigation guides

How it works

Verbiqo reads your databases, clusters, metrics and logs while it answers, and never changes them. Set each one up once, then attach it to a conversation and ask in plain words.

What it can read

How it stays read-only

• The account. Database, Redis, Elasticsearch and Kubernetes connectors check for write or administrative privileges and refuse those they detect. Create the monitoring account described on each set-up page. For Splunk, configure a least-privilege search role: the connection test checks access, not every role capability. Prometheus needs read-only API access through your proxy or token policy.
• Every request, checked before it is sent, in the way that fits the system. PostgreSQL and MySQL run each statement in a read-only transaction. SQL Server plans each statement first and refuses one that would reach application tables. All three have short time and lock limits. Redis, Elasticsearch, Kubernetes, Prometheus and Splunk accept only commands, requests or searches on a read-only list. Each set-up page lists its own controls under At a glance.
• Your data. Database investigations read statistics and metadata rather than application rows. Elasticsearch and OpenSearch cluster questions read monitoring APIs rather than documents; permitted security-log searches can read log documents, masked as they are read. Values encountered in statement text are masked before display or model use.
• The model. While investigating, the model can only ask Verbiqo for more reads through these checks. It has no shell, no file access and no other tools on this path.
• Fixes. Every change it suggests is a statement for you to review and run.

Verbiqo sends what it read (host names, measurements, statement shapes) to the AI service you chose, so the model can interpret it. Check that your policy allows this.

This page is about investigating systems. The writing actions work differently: they replace the text you selected, once the result has been checked, and a document summary reads the file you choose. Work with selected text.

Add a connection

1. Turn it on

   In Settings, check Let Verbiqo read databases and other systems.

2. Open Extensions

   Choose Extensions… from the menu bar icon, then the system.

3. Fill the form and test

   Press Test Connection. It says what it found (version, role, TLS in use) or what to fix. Then Save Connection.

From a terminal, each system has add, test, list and remove. The password is piped in, never typed on the command line:

verbiqo pg add orders --host db1 --port 5432 --database orders --user verbiqo --password-stdin
verbiqo pg test orders

Encrypted connections (TLS)

Each system offers the choices its own tools use, so the names differ. The questions behind them are the same: is the connection encrypted, and is the server’s certificate checked against a CA and against the host name.

Unreleased change for 0.1.26: a new PostgreSQL or MySQL connection starts on Require, so a server without TLS is refused instead of reached unencrypted. The current download, 0.1.25, starts on Prefer; choose Verify full for production. Connections saved earlier keep their explicit mode. A legacy connection with no stored mode still uses Prefer for compatibility; edit it explicitly to strengthen protection.

What the modes mean

For PostgreSQL, MySQL and Redis:

• Insecure tick. Insecure: don't check the server's certificate encrypts without checking. On a database form it switches the mode to Require. Unticking it switches to Verify full. SQL Server’s equivalent is Trust server certificate. Elasticsearch’s and Kubernetes’ is Verification None.
• CA certificate. For a private CA, choose its .pem file. It is added to the CAs your computer already trusts.
• Client certificate and key. For servers that ask for one (mutual TLS, certificate login): PostgreSQL, MySQL, Redis, Elasticsearch and OpenSearch, and a Kubernetes kubeconfig. A certificate login needs no password.
• Key passphrase (PostgreSQL and MySQL). For a key protected by one. Kept in the Keychain or Credential Manager like a password, and never sent to the server: it only opens the key on your computer. From a terminal: --ssl-key-passphrase-env VAR, or --ssl-key-passphrase-stdin to pipe it in. Other systems need a key without a passphrase.
• One CA for everything. Settings › Trusted CA (below Endpoint) names a CA every connection trusts, Prometheus and Splunk included. A terminal on the same computer trusts it too, along with everything in the computer’s trust store. Without the app, VERBIQO_TLS_CA names it for every connection.

From a terminal, for example:

verbiqo pg add orders --host db1.example.com --database orders --user verbiqo --password-stdin \
  --ssl-mode verify-full --ssl-ca /etc/ssl/company-ca.pem
verbiqo redis add cache --host cache1 --port 6380 --password-stdin --ssl-mode verify-full --ssl-ca /etc/ssl/company-ca.pem
verbiqo mssql add sales --host sql01 --user verbiqo_monitor --password-stdin --encrypt mandatory --ssl-ca /etc/ssl/company-ca.pem
verbiqo es add logs --url https://es.example.com:9200 --auth apikey --secret-stdin --ca /etc/ssl/company-ca.pem --verification full

test shows the TLS in use, for example TLS 1.3, certificate and host name verified. When TLS fails, it says what to change: a CA to add, a server name to correct, or a client certificate to give. Keep Verify full for production. See also Troubleshooting.

Where sign-in details are kept

Attach and ask

/pg orders
/mssql sales
/redis cache
/k8s prod
/es logs
/prom prod
/splunk prod
/security all

Up to three at once. Verbiqo asks each and shows the answers together. /sources lists what is attached, /pg off detaches. How to phrase questions: Ask about your systems.

Reading findings

After the answer, Verbiqo adds what its own checks found, always in the same shape:

Verbiqo and MCP

MCP (Model Context Protocol) is a standard for connecting AI applications to tools and data. Verbiqo packages supported investigations, checks, controls and evidence presentation into an application. The two answer different questions: MCP is how a tool is plugged into an assistant. Verbiqo is a tool for investigating systems, with its own interface.

Some MCP-based products also ship these controls ready-made. With general-purpose servers, a team assembles them: choosing and configuring servers, credentials, a gateway, audit and validation, and maintaining them. Verbiqo is one way to have them ready-made for the systems above.

LLM gateways and MCP gateways

An LLM gateway carries model calls: prompts and answers between an app and a model. Verbiqo can use one today, through its OpenAI-compatible endpoint setting (gateways). An MCP gateway controls MCP tool calls. Verbiqo makes no MCP tool calls, so connecting it to an LLM gateway does not make it MCP-compatible.

Planned, not available: Verbiqo as an MCP server, so that other assistants could call its checks and receive its findings, never direct access to your systems.