dsh-connect

Many organizations keep their business data in MySQL, PostgreSQL, or ClickHouse and wrap services like weather, logistics, or ticketing into fixed HTTP APIs, yet handing those assets to an AI assistant raises real concerns: credentials must never appear in chat, the model must not compose arbitrary SQL or fire off uncontrolled requests, and sample rows must not leak into a prompt. dsh-connect is the DSH connector plugin built for exactly this scenario.

Its approach is discover, constrain, then invoke. After scanning a database it captures tables, columns, primary and foreign keys, native DDL, and optional sample rows, and can optionally run AI semantic enrichment via the current DSH default model to assign business names, synonyms, tags, and field roles. In a conversation the user simply describes what they need in plain language; the Agent retrieves the relevant semantic metadata first and then executes a tightly scoped read-only query: one SELECT or WITH statement, no DML or DDL, bounded row count, sensitive columns masked. For HTTP APIs, an administrator pre-declares the method, host, path template, and parameters; the plugin registers each enabled endpoint as a fixed tool so the model can only fill in declared values and cannot change the domain, hop across origins, or invent new request shapes.

It is aimed at data engineers who want to expose internal databases to business colleagues without compromising security, product or ops teams that already maintain a set of business APIs and want the AI assistant to call them on behalf of users, and anyone in a DSH workspace who prefers to ask questions in natural language rather than memorize tool names and parameter schemas.