Connectors overview
Connectors are how Metatate Cloud reads your data estate. Each connector points at one platform — a PostgreSQL database, a BigQuery project, a Snowflake database — and syncs catalog metadata into point-in-time catalog snapshots. Your policies target the catalog assets those snapshots describe, and the current deployment publication serves typed answers about them to people and AI agents.
Metadata firstDirect link to Metadata first
Every connector is metadata-only. A sync reads structure: databases, schemas, tables and views, and columns with their data types and nullability, plus table and column comments on platforms that surface them.
A connector never:
- copies row data from your tables into the catalog;
- writes to or changes anything in your platform;
- enforces policy inside your platform — no native masking, no query rewriting. Enforcement previews, query parsing, and native masking are disabled for every connector kind.
Lifecycle: test, scope, syncDirect link to Lifecycle: test, scope, sync
- Create. Pick a platform, give the connector a display name, and enter its connection details and credential.
- Test the connection. A short, idempotent probe runs from Metatate's sync worker and reports a pass or fail with a redacted message — raw driver errors are never surfaced.
- Choose what to sync. After a passed test, pick the schemas and tables the connector may sync. This is an explicit per-connector sync scope: a new connector starts with nothing selected, and there is no sync-everything action. Fully selecting a schema keeps future tables in that schema flowing in; new schemas require re-selection.
- Activate and sync. Once a scope exists you can run syncs and browse the resulting catalog in the app.
The scope is enforced where sync results are written, so out-of-scope objects never reach the catalog or MCP tools. A scope that cannot be parsed fails the sync with a typed error — it is never silently treated as sync-everything.
SnapshotsDirect link to Snapshots
Each successful sync writes a new point-in-time catalog snapshot and promotes it to current. Promotion only happens when a sync finishes successfully: a failed or partial sync never replaces your current catalog with an empty one.
CredentialsDirect link to Credentials
Credentials are stored in Supabase Vault and referenced, not embedded. They are decrypted only inside the sync worker, are never sent to the browser, and are never shown again after you save them. To rotate a credential, enter a new one.
NetworkDirect link to Network
Outbound connections refuse private, loopback, and link-local addresses — checked against both literal IPs and every address a hostname resolves to. The BigQuery, Databricks, and Snowflake connectors go further: they only talk to closed allowlists of vendor API endpoints.
Supported platformsDirect link to Supported platforms
| Platform | Connects via |
|---|---|
| PostgreSQL | Direct connection, password auth |
| Google BigQuery | Google APIs, service-account key |
| MySQL / MariaDB | Direct connection, password auth |
| Amazon Redshift | Direct connection (Postgres wire protocol), password auth |
| Databricks | Unity Catalog REST API, personal access token |
| Snowflake | SQL REST API v2, key-pair JWT |
The number of data sources you can connect depends on your plan — see plans. To connect your first source end to end, follow the quick start.