SQLTools connects an agent to a database. Point it at a read-only connection and the agent can introspect the schema and run queries.
db and the SQLTools connection are separate. db stores the agent’s own sessions and learnings. SQLTools points at the warehouse you are answering questions about. Keep them distinct.
Introspect before generating
A data agent that guesses column names is wrong confidently.SQLTools ships list_tables and describe_table so the agent grounds SQL in the real schema. The instruction to introspect first is what makes it reliable.
Scope the connection
The cleanest boundary is the connection itself. Thereadonly Postgres role has no write grant, so the connection physically cannot write, regardless of what the model is prompted to do. For the full read vs write split, see Safe data access.