Recern
Download
Recern Workspace · Documentation

Microsoft SQL Server

Workspace 1.0.0 adds SQL Server diagnostics and a bounded, always-read-only T-SQL console. The live integration fixture is SQL Server 2022 Developer 16.0.4305.5, with SQL authentication, private-CA TLS and direct TCP or SSH. The adapter accepts SQL Server 2019+, but 2019 and 2025 are not yet verified.

Connect

  1. Choose Microsoft SQL Server in the connection dialog.
  2. Enter a fixed hostname and TCP port (1433 by default), database, SQL username and password. The password is kept in the system password store.
  3. Keep TLS required. For a private certificate authority, choose the local PEM CA bundle. The server hostname is verified, including through an SSH tunnel.
  4. Test the connection, then save and connect.

Windows integrated authentication, Entra tokens, SQL Browser named-instance discovery and Azure SQL are not included. Azure SQL is a separate roadmap item; a successful SQL Server connection does not establish Azure compatibility.

Views and diagnostic permissions

  • Overview shows available diagnostics and client-measured SELECT 1 probe latency. This chart is not server CPU or workload throughput.
  • Sessions and Locks show activity visible to the login. A restricted login may see only its own session; unavailable diagnostics are identified.
  • Queries shows database-scoped query-cache statistics, not complete query history. Diagnostic grants depend on the SQL Server version and server policy.
  • Tables, Columns and Indexes show account-visible schema metadata. Partition row counts are estimates.
  • Access & limits reports visible broad write/admin grants. Missing evidence is marked unverified, never proof that the login cannot write.

Ask your administrator to choose the minimum monitoring grants needed. Reconnect after changing grants. Workspace does not grant permissions or change server configuration for you.

Read-only console

The console accepts one supported SELECT/CTE even when Safe Mode is off. For example, inspect account-visible table names:

SELECT TOP (25) name, type_desc FROM sys.tables ORDER BY name;

History, named saved queries and CSV/JSON export work as for other SQL consoles. Bigint and decimal values remain exact strings; duplicate column names, Unicode and nulls are preserved. Exports contain only the displayed results.

Writes, direct UDF/CLR calls, external rowsets, query hints and explicit cross-database names are refused. Only the supported built-in function/type subset is accepted; unsupported T-SQL fails closed.

Request and result limits

  • Query input: 64 KiB, 2,048 tokens, 16 syntax-nesting levels and 64 expression levels.
  • Displayed results: at most 1,000 rows, 128 columns and 8 MiB of encoded JSON. Catalog lists use limits of 200 or 1,000 rows.
  • Each data connection sets ROWCOUNT 1001, TEXTSIZE 65536, LOCK_TIMEOUT 3000, low deadlock priority and estimated query-cost limit 10. TEXTSIZE can truncate supported string/binary LOB values, but does not bound XML. A 10 MiB socket-read budget also bounds decoded data.
  • Requests have a 10-second connection/query deadline. At most two data requests and one health probe run per session. Overview makes two bounded requests sequentially.
  • Cancel or deadline expiry requests TDS Attention, waits up to two additional seconds for acknowledgement and closes that connection. The driver can miss acknowledgement before metadata arrives; Workspace reports this explicitly. Current fixtures do not establish every execution/transfer phase, network-loss or server-restart case.

The cost governor uses an estimate, not measured wall-clock execution time. A small result can still require an expensive scan.

Production use

SQL Server has no read-only transaction mode. Application syntax guards do not replace database authorization. Views, synonyms, computed columns, ownership chains and object/schema grants can involve other objects or databases.

Use a dedicated read-only login, review effective grants and dependencies with your administrator, and prefer a read-only replica or separate analytics capacity where appropriate. Test the connector with restricted accounts and synthetic data first. See Safe Mode and connections and private TLS certificates.