Parse Connection String
database.parse_connection_string
Overview
You pass a JDBC URL or database URI and we return a safe structural summary: driver, host, port, database name, and non-secret options. Passwords are stripped structurally — they never appear in the response, even when present in the input. We do not open a connection or resolve hostnames. Do not use this when you need a live connectivity or authentication check.
Agents and tools often echo connection strings into logs — and passwords go with them. We give you structure without that risk.
Reliability
Same URL in, same summary out. Passwords are dropped as we parse, so they cannot reach the response. Three errors can come back, none of them worth a retry with the same input: CONNSTRING_MALFORMED — trigger: you sent an empty string, something longer than 4,096 characters, or text we could not read as a JDBC URL or a scheme://host URI; retryable: no; next: fix the string and call again. CONNSTRING_DRIVER_UNSUPPORTED — trigger: the scheme names a driver outside the nine we handle (postgresql, mysql, mariadb, sqlserver, oracle, sqlite, h2, mongodb, redis); retryable: no; next: parse that URL yourself or pick a supported driver. CONNSTRING_OPTION_LIMIT_EXCEEDED — trigger: the URL carries more than 100 settings; retryable: no; next: trim the query string before sending it. An expectedDriver mismatch never fails the call — it lands in findings as CONNSTRING_DRIVER_MISMATCH, alongside notes like CONNSTRING_TLS_NO_VERIFICATION, so check findings even on a successful response.
Context footprint
One call replaces brittle regex URL parsing and keeps secrets out of your pipeline. A successful call costs 1 execution credit.
When to use it
When you need to understand or inventory a URL without exposing credentials.
When you need to know whether the database is reachable or the password is correct.
Scope
Non-goals
- Does not connect to the database
- Does not resolve or ping hostnames
- Does not return passwords or usernames
- Does not validate that credentials work
Properties
Capabilities
Cost & billing
Flat rate per invocation
File handling
How we handle your data
What this means
This skill is designed to detect, mask, redact, validate, or otherwise process sensitive data.
Squillify guarantees
- Runs inside Squillify
- This skill runs inside Squillify.
- Payloads are not sent to an external service by this skill.
- Squillify does not permanently store submitted payloads.
- Telemetry records metadata only, not submitted content.
- Submitted payloads are not used for training.
- Submitted payloads are not reviewed by humans.
- Targets sensitive data
- The response does not contain submitted content.
Your responsibility
Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.
Input schema
| Field | Type | Required | Description |
|---|---|---|---|
| connectionString | string | Yes | Connection string parsed locally; credentials are never returned. |
| expectedDriver | string | No | Optional expected driver name; omit it to accept any supported driver. |
Output schema
| Field | Type | Required | Description |
|---|---|---|---|
| scheme | string | Yes | Parsed connection-string scheme. |
| driver | string | Yes | Resolved database driver. |
| host | string | No | Parsed host when present. |
| port | integer | No | Parsed TCP port when present. |
| database | string | No | Parsed database name when present. |
| hasUsername | boolean | Yes | Whether a username was present. |
| hasPassword | boolean | Yes | Whether a password was present. |
| options | object | Yes | Purpose-bound redacted connection option map. It contains from 0 through 1,000 purpose-bound properties — unconstrained RFC 8259 JSON items. |
| safeUri | string | Yes | Redacted URI safe for display. |
| tls | object | Yes | Closed TLS-option receipt. Its documented receipt properties are bounded to 128 entries — unconstrained RFC 8259 JSON items. |
| findings | array | Yes | Bounded array of safe structured database findings. The item shape is defined by the nested schema and the array contains from 0 through 20000 items. |
| _meta | object | Yes | Closed parser metadata receipt. Its documented receipt properties are bounded to 128 entries — unconstrained RFC 8259 JSON items. |
API contract
POST /v1/executecurl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"database.parse_connection_string","input":{"connectionString":"jdbc:postgresql://localhost:5432/app"}}'import { Squillify } from "@squillify/sdk";
const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });
const { output } = await sq.execute("database.parse_connection_string", {"connectionString":"jdbc:postgresql://user:[email protected]:5432/appdb?sslmode=require"});Errors
| Code | HTTP | Retryable | Description |
|---|---|---|---|
| VALIDATION_ERROR | 400 | No | The request payload failed schema validation. |
| UNAUTHORIZED | 401 | No | Missing or invalid API key. |
| SKILL_NOT_ACCESSIBLE | 403 | No | The API key is not granted access to this skill. |
| SKILL_NOT_AVAILABLE_FOR_PLAN | 403 | No | This skill is not included in your current plan. |
| PLAN_ELIGIBILITY_UNAVAILABLE | 503 | Yes | Plan eligibility could not be decided. Retry after backoff. |
| SKILL_NOT_FOUND | 404 | No | The requested skill or version does not exist. |
| TENANT_RATE_LIMITED | 429 | Yes | Request rate limit exceeded. Retry after backoff. |
| QUOTA_EXCEEDED | 429 | Yes | Plan quota exhausted. Retryable once the quota period resets. |
| EXECUTION_TIMEOUT | 504 | Yes | Execution exceeded the allowed time budget. |
| CONNSTRING_MALFORMED | 400 | No | The request payload failed this skill's input validation. |
| CONNSTRING_DRIVER_UNSUPPORTED | 400 | No | The skill does not support the requested variant. |
| CONNSTRING_OPTION_LIMIT_EXCEEDED | 429 | No | A size, quota, rate, or time limit was exceeded. |
Other limits
| Limit | Value |
|---|---|
| Recommended inline bytes | 32 KiB |
Limitations
- Does not connect to the database
- Does not resolve or ping hostnames
- Does not return passwords or usernames
- Does not validate that credentials work
- Live connectivity or authentication checks
- Secret rotation or credential validation
How to call
POST /v1/execute (requires authentication)
{
"skillKey": "database.parse_connection_string",
"input": {
"connectionString": "jdbc:postgresql://user:[email protected]:5432/appdb?sslmode=require"
}
}Examples
PostgreSQL URL with password stripped and TLS note
{
"connectionString": "jdbc:postgresql://user:[email protected]:5432/appdb?sslmode=require"
}{
"scheme": "jdbc:postgresql",
"hasUsername": true,
"findings": [
{
"details": {},
"path": "/options/sslmode",
"code": "CONNSTRING_TLS_NO_VERIFICATION",
"message": "sslmode=require encrypts but does not verify the server certificate.",
"severity": "warning"
}
],
"database": "appdb",
"_meta": {
"optionCount": 1,
"redactedOptionCount": 0
},
"safeUri": "jdbc:postgresql://db.internal:5432/appdb?sslmode=require",
"driver": "postgresql",
"tls": {
"requested": true,
"verifiesCertificate": false,
"mode": "require"
},
"hasPassword": true,
"options": {
"sslmode": "require"
},
"host": "db.internal",
"port": 5432
}MySQL URL without credentials
{
"connectionString": "jdbc:mysql://localhost:3306/billing"
}{
"scheme": "jdbc:mysql",
"hasUsername": false,
"findings": [],
"database": "billing",
"_meta": {
"optionCount": 0,
"redactedOptionCount": 0
},
"safeUri": "jdbc:mysql://localhost:3306/billing",
"driver": "mysql",
"tls": {
"requested": false,
"verifiesCertificate": false,
"mode": "none"
},
"hasPassword": false,
"options": {},
"host": "localhost",
"port": 3306
}Recommended use cases
- Review a connection string before storing it in config
- Build a safe inventory of database endpoints
- Check TLS settings without leaking secrets into logs
Avoid for
- Live connectivity or authentication checks
- Secret rotation or credential validation
Related skills
Composable with
Safety & privacy
- Runs without calling any external service.
- Your payloads are never stored permanently.
- Telemetry captures metadata only — never your payload contents.
- We never train models on your payloads.
- No human reviews your payloads.