v0.8: check (with an executive summary and --redact for sharing), compare, and record + report to watch an instance for up to 24 hours (how). 26 rules plus 8 for recordings. FAQ and more on the website.
codeDB Lens connects to your instance with a read-only login, runs a catalog of evidence-based
rules and writes a self-contained HTML + JSON report with an A–F grade and a coverage seal
(the share of rules that could actually run). Nothing about your database leaves your machine.
Install
| Where | How |
|---|
| Windows | Installer (per user, no admin) or portable .zip |
| Windows (Scoop) | scoop bucket add codedb https://github.com/codedb-io/codedb-lens then scoop install codedb/codedb-lens |
| Linux | .deb / .rpm from the latest release, or the tarball for x64 / arm64 |
| Docker | docker run --rm -e PG_DSN -v "$PWD:/out" ghcr.io/codedb-io/codedb-lens check --engine pg --dsn-env PG_DSN --out /out |
The Windows binaries are open source but not code-signed yet, so SmartScreen may show a warning.
Why, and how to verify the download.
Why another tool?
- Evidence, not opinions. Every finding shows the collected values, the query that produced them and when.
- Honest confidence. Each finding is Confirmed, Hint or No data. A rule that lacks permission
never shows up as a false "OK"; it lowers the coverage instead.
- Read-only, always. No DDL, no DML, no agent, no installation on the server.
- Rules are data. Each rule is a YAML file plus a SQL query. Contributions don't touch the engine.
- English and Portuguese (Brazil), in the app, the CLI and the report.
What it checks
| SQL Server | PostgreSQL |
|---|
| Missing or old backups | Version out of support |
| No recent clean DBCC CHECKDB | pg_stat_statements not available |
| Failing SQL Agent jobs | A single query dominating execution time |
| Disk or transaction log running out of space | Long and idle-in-transaction sessions |
| Dominant waits, translated | Sessions blocked by locks |
| Sessions blocked right now | Transaction ID wraparound risk |
| A single query dominating CPU | Dead rows and autovacuum falling behind |
| Instance settings left at defaults | Replication slots retaining WAL, replica lag |
| TempDB file layout | Connections near the limit, no pooler |
| Version out of support | Unused, duplicate and invalid indexes |
| High-impact missing indexes | Estimated table bloat |
| Unused and duplicate indexes | Largest tables |
Each rule has a documentation page with what it checks, why it matters, what to do and its limits.
Quick start
On Windows, open codeDB Lens from the Start menu. Pick the engine, enter the server and run the diagnosis.
Connection profiles are saved; passwords go to the Windows Credential Manager.
Command line (Windows and Linux):
codedb-lens check --engine mssql --server prod01 --auth windows
codedb-lens check --engine pg --dsn-env PG_DSN
Passwords are never accepted as command-line arguments. Use integrated auth, an environment variable or a saved profile.
Use with AI (MCP)
Ask Claude, GitHub Copilot or Cursor about your database. codedb-lens mcp is a read-only MCP server that your AI
client starts on your computer, with your saved profiles:
- Diagnosis: with the Lens's minimal login, the AI runs the health check, reads recordings and explains what to
fix, without reading business data.
- Data: with a login that reads the tables you choose, the AI lists and describes them and answers questions with
one
SELECT at a time, within row and time limits.
codedb-lens mcp install --client claude-desktop --profile prod # or vscode, cursor, claude-code
The app's AI (MCP) screen has the commands ready to copy. Guide: lens.codedb.com.br/mcp.
Minimum permissions
-- SQL Server
CREATE LOGIN codedb_lens WITH PASSWORD = '<strong password>';
GRANT VIEW SERVER STATE TO codedb_lens;
GRANT VIEW ANY DEFINITION TO codedb_lens;
GRANT CONNECT ANY DATABASE TO codedb_lens; -- per-database rules (indexes); no data access
USE msdb;
CREATE USER codedb_lens FOR LOGIN codedb_lens;
ALTER ROLE db_datareader ADD MEMBER codedb_lens;
ALTER ROLE SQLAgentReaderRole ADD MEMBER codedb_lens;
-- PostgreSQL (repeat GRANT CONNECT for each database)
CREATE ROLE codedb_lens LOGIN PASSWORD '<strong password>';
GRANT pg_monitor TO codedb_lens;
GRANT CONNECT ON DATABASE app TO codedb_lens;
Supported versions
| Engine | Supported | Best-effort |
|---|
| SQL Server | 2017, 2019, 2022, 2025 (Windows and Linux), Azure SQL Managed Instance, Amazon RDS | 2016 and older; Azure SQL Database (6 of 13 rules apply, see permissions) |
| PostgreSQL | 15, 16, 17, 18, Amazon RDS, Aurora, Azure Flexible Server | 14 |
Privacy
No telemetry. Lens makes two kinds of network calls: an optional, once-a-day version check against GitHub Releases
that sends no data (--no-update-check or CODEDB_LENS_NO_UPDATE=1 turns it off), and, only when you ask for the free
key, one registration request with the name and e-mail you type (or, when renewing, only the current key). See SECURITY.md.
Need continuous monitoring?
Lens shows a snapshot. codeDB
watches your SQL Server and PostgreSQL instances around the clock, with history, baselines and alerts on Teams, Slack and e-mail.
Windows code signing
Windows binaries are built by GitHub Actions from this repository and are not code-signed yet (certificates are paid and
this is a free project). Details, how to verify a download and warning-free alternatives:
Why Windows shows a warning.
Contributing
New rules are especially welcome. A rule is a YAML file plus a SQL query, so you don't need to touch the Go code:
see CONTRIBUTING.md, or just open an issue with a rule idea.
License
Apache 2.0. The codeDB SaaS and its API are separate, closed-source products.
