MySQL Source

Use the MySQL adapter to verify proposed action values directly against a MySQL or MariaDB system of record.

The adapter’s integration suite runs against a real MySQL 8.4 service in ActionRail CI, including named bindings, live grounding, read-only transaction enforcement, and cleanup after rejected writes.

Source configuration

sources:
  billing-production:
    adapter: mysql
    host: mysql.internal
    port: 3306
    database: billing
    user: actionrail_reader
    password: ${env:BILLING_DB_PASSWORD}
    ssl_mode: verify-identity
    ssl_ca: /etc/ssl/certs/mysql-ca.pem
    connect_timeout: 5
    query_timeout: 5
    require_read_only: true

Field	Default	Constraint
host	—	Required non-empty hostname or address.
port	3306	Integer from 1 to 65535.
database	—	Required database name.
user	—	Required dedicated verification user.
password	empty	In the Console, exactly one ${env:VARIABLE} reference.
ssl_mode	required	disabled, required, verify-ca, or verify-identity.
ssl_ca	system trust store	Optional PEM CA path visible to the SDK process.
connect_timeout	5	1–300 seconds.
query_timeout	5	1–300 second socket read/write timeout for the query.
require_read_only	true	Must remain true.

Use verify-identity in production. required encrypts the connection but does not validate the server certificate or hostname.

Rule check

MySQL uses PyMySQL named parameters:

ground:
  checks:
    - source: billing-production
      query: >-
        SELECT customer_id, status, refundable_balance
        FROM orders
        WHERE order_id = %(value)s
          AND workspace_id = %(workspace_id)s
      match:
        - column: customer_id
          ctx: customer_id
        - column: status
          value: delivered
        - column: refundable_balance
          op: gte
          arg: amount

Available bindings include %(value)s, scalar tool arguments, and scalar trusted-context fields.

Defense in depth

For each check, ActionRail:

1. opens a new PyMySQL connection with autocommit disabled and local_infile disabled;
2. applies connection and socket I/O timeouts;
3. starts an explicit START TRANSACTION READ ONLY transaction;
4. executes one parameterized query;
5. rolls back and closes the connection even after an error.

The database user is still the primary authorization boundary. Create a dedicated SELECT-only user limited to the required schemas, tables, views, and rows. Do not reuse an application writer or administrative credential.

MySQL permits writes to pre-existing temporary tables inside a read-only transaction. ActionRail does not create temporary tables, but this is another reason the database user must not have write or temporary-table privileges.

Driver installation

PyMySQL is installed with the ActionRail SDK; no native client library is required.

Performance guidance

• Index every lookup key used by a grounding query.
• Return only the fields used by match conditions.
• Keep the default query timeout or lower it for interactive agents.
• Avoid locks and long-running analytical queries.
• Monitor Source failures and pending agent calls during database incidents.

Grounding runs synchronously in the action gate. Database latency is therefore part of consequential tool-call latency.