Windows, Linux, Docker.
A bundled installer registers it as a Windows service, a systemd unit covers Linux, and there is a Docker image with a documented compose file.
Foundation · On-prem agent
Runs where the database lives.
A small service you install on Windows or Linux, holding the real connection string locally and opening an outbound TLS channel to the cloud. It runs the documentation scans, the queries somebody types, and the exports that go out on a schedule. Nothing ever comes back the other way.
Outbound TLS only.
It holds a persistent connection over HTTPS and never listens on anything, so the only firewall rule involved is the outbound 443 you already have.
Sealed envelope.
The browser seals the connection string with the agent public key before it leaves, the cloud only ever stores that sealed envelope, and the agent is the one thing able to open it.
What the agent does
Three jobs, all read-only.
Schema scans
Read information schema and provider catalogs to feed the documentation and the change history.
Ad hoc queries
Execute saved or freeform SELECT statements you authored, under read-only role and timeout.
Scheduled exports
Run a saved query on schedule, format as CSV or Excel, push it to the cloud for delivery to Slack or email.
Capacity
One agent, many connections.
A team that runs three databases does not need three agents. Concurrency caps protect the agent host and the customer database from spikes during scheduled run windows.
Per agent
32 concurrent runs
Default cap on a 4 vCPU host. Tunable.
Per connection key
8 concurrent runs
Avoid hammering one database with parallel diagnostics.
Schedules
Hourly cadence on Pro
Per-connection schedule. Run-now button when you do not want to wait.
FAQ
On-prem agent for private databases
What ports does the agent need? +
Outbound 443 to the control plane. Nothing inbound. The agent opens a long-lived SignalR connection and keeps it warm with heartbeats.
Can the agent run on the same host as the database? +
Yes. Many teams run it as a sidecar on the database host or on a small jump host with network access to the database.
How is the agent updated? +
Replace the binary, restart the service. The agent reports its version on connect; the cloud blocks versions below MinAgentVersion.
Can I run multiple agents for redundancy? +
Yes. Multiple agents can be enrolled. The cloud picks one for each scheduled run via a lease. Two agents racing to scan the same database will not duplicate work.
Install it
Drop the agent on a host. Start documenting in minutes.
Windows, Linux or Docker, outbound on 443, and the first scan finishes in under ten minutes.