MySQL

Scan MySQL tables with detector-ready row sampling.

Category: Databases
Source type: MYSQL
Produces: table
Links: MySQLProduct Granting read-only privileges (GRANT)Credentials Encrypted connectionsReference

MySQL — and MariaDB, which connects identically — is the database under a great many web applications, e-commerce platforms and internal tools. Connect it and Classifyre reads the values in your tables, so a column called notes that quietly accumulated customer identifiers is found for what it contains.

What you need to connect

Host, port, and a user with SELECT on the databases you want scanned. Nothing is ever written.

Managed MySQL (Amazon RDS and Aurora, Azure Database for MySQL, Google Cloud SQL, PlanetScale) works the same way. If your provider requires TLS, set the SSL mode accordingly and paste its CA certificate — that field is stored as a secret like any password.

What Classifyre reads

Tables across one database or every database the user can see, with a denylist for the ones you don’t want and an allowlist for the ones you do.

Shared behaviour · SQL databases

One asset per table or view, never one per row. The asset carries the table's structure — database, schema, table name, object type, its columns and their types, and a row-count estimate — and its content is a sample of real rows, formatted so a detector reads actual values rather than a schema dump.

How many rows, and which ones, is entirely up to the sampling strategy. Large tables are paged through by key rather than by OFFSET, so a scan that stops halfway can resume from where it left off instead of re-reading from the top.

Read-only throughout. The connector issues catalog queries and bounded SELECTs. Nothing is written back, and a read-only account is the right account to give it.

Relationships come out of the engine's own catalog: foreign keys are recorded as REFERENCE links — useful, but they move no data, so they never become a lineage hop, and a view and the tables it reads from are recorded as FLOW — real lineage, with column-level detail parsed out of the view's SQL where the SQL makes that possible. See Lineage.

Metadata on every asset

Asset kind · table

Field	Type	Always present	What it is
database	string	Yes	Database or catalog name
table_name	string	Yes	Table name
table_type	string	Yes	Object type (TABLE/VIEW)
schema	string	No	Schema name
columns	object[]	No	Columns as {name, type} objects
row_count	integer	No	Estimated number of rows

Lineage

Views and the tables behind them are recovered from MySQL’s own catalog and recorded as lineage, with column detail parsed from the view definition where it can be. Foreign keys become references — a useful map of how tables relate, but not a path data travels. See Lineage & Relationships.

Worth knowing

MySQL 8 authentication. Accounts using caching_sha2_password over an unencrypted connection need public-key retrieval allowed; there’s a setting for it. Using TLS is the better answer.
System databases — mysql, sys, information_schema, performance_schema — are excluded automatically.
MariaDB connects through the same driver and needs no special configuration.

Configuration

Beyond the fields below, every source also has the settings shared by all of them: the sampling strategy, the detectors to run, the scan schedule, and the compute limits for its scan jobs.

Required

Without these, the source will not save.

Field	Type	Required	What it does	Default
required	object	Yes	—no extra properties	—
host	string	Yes	MySQL host	localhost
port	integer	Yes	MySQL portmin 1, max 65535	3306

Secrets

Stored encrypted and never shown again after you save them. See Configuration & Fields.

Field	Type	Required	What it does	Default
masked	object	Yes	—no extra properties	—
password	string	Yes	Database password	—
ssl_ca	string	No	PEM-encoded CA certificate for SSL/TLS verification. Paste the full certificate content (-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----). Required when ssl_mode is VERIFY_CA or VERIFY_IDENTITY.	—
username	string	Yes	Database username	—

Optional

Everything you can tune. Sensible defaults apply when you leave them alone.

Field	Type	Required	What it does	Default
optional	object	No	—no extra properties	—
connection	object	No	Connection tuning for MySQL.no extra properties	—
connection.allow_public_key_retrieval	boolean	No	Allow automatic RSA public key retrieval from the server for caching_sha2_password authentication (MySQL 8+). Only needed when not using SSL and connecting to MySQL 8 servers using the default authentication plugin.	false
connection.connect_timeout_seconds	integer	No	Connection timeout in secondsmin 1, max 120	10
connection.ssl_mode	enum	No	SSL/TLS connection mode. DISABLED: no TLS; PREFERRED: TLS when available (default); REQUIRED: mandate TLS without certificate verification; VERIFY_CA: mandate TLS and verify the CA certificate (requires ssl_ca); VERIFY_IDENTITY: mandate TLS, verify CA, and verify server hostname. Allowed: DISABLED, PREFERRED, REQUIRED, VERIFY_CA, VERIFY_IDENTITY	PREFERRED
scope	object	No	Database and table selection scope.no extra properties	—
scope.database	string	No	Single database to scan (optional when include_all_databases is true)	—
scope.exclude_databases	array	No	Database denylist (exact database names)	["information_schema","mysql","performance_schema","sys"]
scope.exclude_databases[]	string	No	—	—
scope.include_all_databases	boolean	No	Scan all visible databases except excluded system databases	false
scope.include_tables	array	No	Optional table allowlist. Accepted forms: table or database.table	—
scope.include_tables[]	string	No	—	—
scope.table_limit	integer	No	Optional cap on number of table assets extracted per databasemin 1	—