Supported platforms
| Platform | Support |
|---|---|
| Self-hosted Redis | 6.x, 7.x (vanilla and Redis Stack) |
| Upstash Redis | All plan tiers |
| Redis Cloud | All plan tiers |
Prerequisites
- A Redis instance reachable from CloudThinker over the network.
- Admin access to create an ACL user (self-hosted) or RBAC user (Upstash/Redis Cloud).
- A
REDIS_URLconnection string with credentials.
Setup
Select your Redis platform for specific connection instructions.- Self-hosted Redis
- Upstash Redis
- Redis Cloud
Two common deployment shapes are supported:
- Vanilla Redis — minimal image, no modules. Use when you only need core Redis commands.
- Redis Stack — bundles RediSearch, RedisJSON, RedisTimeSeries, and Bloom. Use when Tony needs
FT.*,JSON.*,TS.*, orBF.*commands. Vanilla soft-fails those.
Start Redis
Vanilla Redis (no modules):The admin password is set via the Verify the instance:
--requirepass server flag. --appendonly yes enables AOF for durability across restarts.Redis Stack (with modules and RedisInsight UI on port 8001):Create a read-only ACL user
Create a dedicated user for CloudThinker. Redis ACL usernames allow
[A-Za-z0-9_-]; use cloudthinker-readonly.on— enable the user><readonly-password>— set the password (the>prefix is ACL syntax)~*— match all keys; narrow to~app:*for stricter scoping+@read -@write -@dangerous -@admin— reads only; blocks writes,FLUSHALL/CONFIG/DEBUG/SHUTDOWN, and replication- Optional: append
-@slowto blockKEYS,SMEMBERS,HGETALLon large collections
Persist ACLs across restart
Mount a Start Redis with the file mounted:and add
users.acl file so ACLs survive container restarts:--aclfile /data/users.acl to the server command.Configure network access
Ensure CloudThinker can reach your database:
- Add CloudThinker IPs to your firewall or security group
- Ensure Redis is bound to an accessible interface (avoid
bind 127.0.0.1only)
Connection details
| Field | Description | Example |
|---|---|---|
| REDIS_URL | Redis connection URI including credentials | redis://cloudthinker-readonly:pass@host:6379 |
| TLS/SSL | Use rediss:// scheme to require TLS | rediss:// for Upstash; optional elsewhere |
| Port | Redis port | 6379 (self-hosted, Upstash); 13xxx (Redis Cloud) |
| Database index | Logical DB index | 0 |
Required permissions
Recommended ACL categories for the CloudThinker user:| Category | Setting | Why |
|---|---|---|
+@read | Allow | Read keys, run INFO, CLIENT LIST, etc. |
-@write | Deny | Block SET, DEL, and other mutating commands |
-@dangerous | Deny | Block FLUSHALL, CONFIG, DEBUG, SHUTDOWN, replication |
-@admin | Deny | Block administrative commands |
-@slow (optional) | Deny | Block KEYS, SMEMBERS, HGETALL on large collections |
Agent capabilities
Once connected, Tony can:| Capability | Description |
|---|---|
| Keyspace analysis | Inspect key patterns, sizes, and TTL distributions |
| Command stats | Review command latency and throughput via INFO commandstats |
| Performance metrics | Monitor memory, connections, eviction, and replication lag |
| Module insights | Inspect RediSearch indexes, RedisJSON documents, and TimeSeries (Redis Stack only) |
Verify the connection
Example prompts
Troubleshooting
Authentication failed (NOAUTH / WRONGPASS)
Authentication failed (NOAUTH / WRONGPASS)
- Verify the username and password in the connection URL
- For self-hosted, confirm the user is enabled with
ACL WHOAMIandACL LIST - For Upstash and Redis Cloud, make sure you copied the TCP/Redis CLI URL, not the REST or SDK URL
NOPERM — no permissions to run the command
NOPERM — no permissions to run the command
- The read-only user is working as intended for write commands
- If reads are also blocked, re-check the ACL rules —
+@readmust be granted
Connection refused or timeout
Connection refused or timeout
- Verify host and port are reachable from CloudThinker
- For self-hosted, ensure Redis is not bound only to
127.0.0.1 - Add CloudThinker IPs to your firewall or cloud provider allowlist
Module commands fail (FT.*, JSON.*, TS.*, BF.*)
Module commands fail (FT.*, JSON.*, TS.*, BF.*)
- Vanilla Redis does not include modules. Run Redis Stack (
redis/redis-stack) or a managed equivalent that bundles the required modules.
Security
- Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
- Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
- Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
- Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
- Use rediss:// for TLS — use the
rediss://scheme whenever your deployment supports TLS to encrypt data in transit. - Persist ACLs — use
aclfilefor self-hosted deployments so the read-only user survives restarts.
Related
Tony Agent
Database-focused optimization agent
MongoDB Connection
Setup instructions for MongoDB databases