---
title: "Read only data sources for an AI coding agent"
description: "CoderHelm checks your GraphQL API, CloudWatch Logs, PostgreSQL and Redshift while it plans, writes and reviews, with every lookup read only, enforced in code and recorded."
url: https://coderhelm.com/data-sources/
updated: 2026-11-05
---

# It looks before it guesses. Read only.

> Connect your API, logs and databases. While CoderHelm plans, writes code and reviews, it checks what the running system really has: whether a field exists, what a setting is, what the service logged.

*Product view: A bug ticket investigated with a database lookup and a log search, both read only and recorded, before any code is planned.*

## What it can look up

- Your GraphQL API, your CloudWatch Logs, your PostgreSQL databases and your Redshift warehouse
- Bug tickets come with evidence: the record, the error and the code that raised it
- Reviews confirm a field or table really exists before flagging it
- Setup takes minutes: paste one script into AWS CloudShell
- Your own tools: named lookups your engineers write once, run only after a second admin approves each exact version

## Read only, enforced in code at every step

Not a promise in a prompt. Each lock below stops a write on its own.

- **One read at a time:** Each lookup is checked before it is sent: one SELECT, one GraphQL query or one log search. Anything that could change data is refused.
- **Rolled back, every time:** Database lookups run in a read only transaction that is always rolled back.
- **A user that can only read:** CoderHelm signs in as a database user that cannot change any table, checked when you connect and again before use.
- **A role tied to your team:** Access goes through a role in your AWS account that only works with your team's external ID. Delete the role and access ends.
- **Hidden stays hidden:** Fields you hide are refused wherever they appear. Secrets, email addresses and card numbers are scrubbed from results, and only the log groups you choose can be searched.
- **Every lookup on the record:** Each lookup is logged with who asked, what they asked and for which pull request. Follow it live, and switch any source off.

## Related

- [Security and data handling](https://coderhelm.com/security.md): How CoderHelm handles your code and data: changes on its own branch, builds in a sandbox with no credentials, read only data access, KMS encrypted secrets, signed webhooks and team roles.
- [CloudWatch alarm to pull request](https://coderhelm.com/alerts.md): Route CloudWatch alarms and EventBridge events to CoderHelm through SNS. Matching alerts become analyzed pull requests in the right repository, and recoveries are paired with the alert that raised them.
- [Team skills, agent briefs and MCP servers](https://coderhelm.com/skills.md): CoderHelm works your way: it reads your AGENTS.md, the skills and agent briefs your team keeps in a repository, the MCP servers you connect and what it learned on past runs.

---

Source: https://coderhelm.com/data-sources/ · Markdown: https://coderhelm.com/data-sources.md · Updated 2026-11-05 · Get started: https://app.coderhelm.com