Discover, query & monitor every database across Kubernetes, VMs, and cloud — free and offline-first. Advisor, Optimize, Diagnose and alerts on Pro. Provision, back up and govern with Platform.
Open on a Mac, Windows, or Linux computer to install. You can bookmark this page to visit later.
Free to start
·
Free email signup
·
macOS, Windows & Linux
56
Discovery Engines
17
Provisioners
3851
Unit Tests
100%
Offline-First
DBHelm — Database Control Plane
Overview
Dashboard
All Databases
Management
Environments
Direct Connect
Observability
Monitoring
Health Check
Logs
Alerts
Diagnose
Incident RCA
Virtual DBA
Optimize
Query Optimizer
Code Optimizer
Index Janitor
Schema Doctor
Autovacuum
Pool Fit
Plan Watch
Cost
Operations
Live Migration
Schema Changes
Declarative
GitOps log
Intelligence
Playbooks
DR Testing
Right-Sizing
Compliance
Upgrade Advisor
Capacity
Trx Tracer
Environments
4
All connected
Databases
81
14 types
Backups
24
0 failures
Alerts
1
CPU warning
Cluster Health — Real-time
CPU Memory IOPS
Recent Discoveries
MongoDB — prod-psmdb (Percona)GKE
PostgreSQL — api-pg-ha (CloudNativePG)EKS
Redis — cache-cluster (Bitnami)AKS
Engines DBHelm discovers + manages
PostgreSQLMongoDBMySQLRedisKafkaElasticsearchCassandraClickHouseCockroachDBNeo4jInfluxDBRabbitMQ+ 44 more
How it works
From zero to full visibility in three steps
Connect → Discover (or provision) → Operate. No agents, no sidecars, no cloud dependency. Free, offline-first.
STEP 01
Connect
Import kubeconfig or Direct Connect
Open DBHelm, go to Environments, and import your kubeconfig — auto-detects cloud provider, region, and cluster. Or use Direct Connect for any database with just a host and port. No agents, no sidecars.
DBHelm scans CRDs, StatefulSets, and Deployments to discover databases across 56 engines — SQL, NoSQL, vector, streaming, cache, time-series. Need a new cluster? The wizard provisions via 17 built-in providers covering all DB-Engines top-10: CNPG / Percona PG / PSMDB / MongoDB Community / MySQL Operator / Redis / K8ssandra / SQL Server / Oracle / Db2 / Strimzi on K8s, plus AWS RDS + Cloud SQL + Azure DB Flexible Server (Postgres + MySQL on each).
Monitor, query, optimize, back up, federate, migrate, cost-track
Real-time engine-aware dashboards, on-demand + scheduled backups, a safe-by-default Console with deep adapters, AI assistant on safety rails, cross-engine federation via embedded DuckDB, MySQL→Postgres migration, plus an 8-tool Optimize section: Query Optimizer + Code Optimizer (AI rewrites) + Index Janitor (unused/duplicate/missing-FK indexes with DROP DDL) + Schema Doctor (missing PKs / high-NULL columns / oversized text) + Autovacuum Pressure Map (bloat / wraparound emergency) + Pool Fit (Fit Score 0-100 from pg_stat_activity) + Plan Watch (EXPLAIN regression detection every 30 min) + full-fleet Cost dashboard. Declarative state YAML + GitOps replay + drift detection round it out. All from one unified interface — free to monitor, query & Studio; Pro adds Advisor, Optimize, Diagnose and alerts; Platform adds provisioning, backups, federation & governance.
Replace scattered CLI tools, dashboards, and scripts with a single control plane that understands every database — from PostgreSQL to Kafka to vector databases.
Free
Connect, query, monitor & Studio
Pro
Advisor, Optimize, Diagnose, alerts
Platform
Provision, back up, automate & govern
Universal Discovery
Free
Auto-detect databases across Kubernetes clusters via CRDs, operators, Helm charts, and StatefulSets. Direct Connect for VMs and bare metal — including self-hosted MongoDB replica sets you operate (not Atlas or vendor DBaaS).
Engine-level metrics for every database type: InnoDB stats, Galera wsrep, Patroni HA, oplog lag, consumer group lag, query latencies — not just K8s pod metrics.
Chat with an AI DBA scoped to one database — or your whole fleet. It investigates with read-only tools (live activity, slow queries, metrics, schema, Incident RCA, query optimizer, index advisor, table profiling, error explainer, migration safety review) and answers with evidence. Strictly read-only: it drafts changes into Schema Changes for a human to apply. BYO key (OpenAI / Anthropic / Ollama) with per-DB PII redaction and local-only policy.
AI agentRead-onlyFleet modeBYO key
AI Incident RCA & Diagnose
Pro
Root-cause analysis over a time window from real signals — pod/DB logs, engine internals, slow queries, replication, FTDC (Mongo), K8s events and TSDB baselines — producing a structured report with evidence and recommended actions. Alerts can auto-run RCA scoped to the breaching pod and embed the cause in the notification. Plus curated diagnostic Playbooks per engine. Works with AI or a heuristic no-AI mode.
Root causeAuto-RCA alertsPlaybooksNo-AI mode
Backup & Restore
Platform
Scheduled automated backups with retention policies, one-click restore with pre-flight validation, and volume snapshot support. Full restore history with audit trail.
Namespace-filtered, live MongoDB cluster→cluster migration with minimal downtime — the mongosync / Percona ClusterSync pattern. Split a service onto its own cluster: preflight → initial copy → continuous change-stream replication → guided cutover with the new connection string. Runs as a Kubernetes Job or host process and is read-only against your source data.
MongoDBLive syncChange streamsGuided cutover
Security First
Free
AES-256-GCM encryption (scrypt KDF, per-record salt) for all credentials. JWT HS256 + token versioning. Strict CSP, sandboxed Electron renderer with contextIsolation. RBAC with super-admin / admin / read-only roles. Offline-first — no telemetry by default; opt-in error reporting only. Dependency audits run in CI on every release.
Encrypted StorageRBACNo Default TelemetryOffline First
Instant Onboarding
Free
Import kubeconfig and go — auto-detects cloud provider, region, and cluster name. Or use Direct Connect for any database with just a host and port. No agents or sidecars.
All databases across all environments in one view. Filter by type, cluster, status, or organization. Multi-cluster, multi-cloud, and multi-org support built-in.
Multi-ClusterMulti-CloudOrganizationsRole-Based
And much more
Provisioning (17 providers — every DB-Engines top-10 covered)
Platform
Spin up new clusters from the wizard or YAML: CloudNativePG / Percona PG / Percona Server for MongoDB / MongoDB Community Operator / MySQL Operator (Oracle) / Redis Operator (Spotahome) / Strimzi Kafka / K8ssandra (Cassandra) / SQL Server (StatefulSet) / Oracle Database (OraOperator) / IBM Db2 (Db2u Operator) on K8s, plus AWS RDS Postgres + MySQL, Cloud SQL Postgres + MySQL, Azure Database for PostgreSQL + MySQL Flexible Server.
Cross-engine federation (DuckDB)
Platform
Attach Postgres + MySQL Direct Connections as virtual catalogs and write ANSI SQL across them in one editor. Joins push down to native scanners.
Heterogeneous migration engine
Platform
MySQL → Postgres in three clicks: schema inference, type mapping with lossy flagging, batched data pump, source-vs-target row-count validation. (For same-engine live MongoDB cluster→cluster moves, see Live Migration / ClusterSync.)
Schema Changes (DDL CI/CD)
Platform
Versioned migrations with static safety analysis (flags locking / destructive / non-concurrent ops and suggests safer rewrites), AI-assisted migration review, dry-run with transactional rollback, online schema change, and rollback support. The Virtual DBA can draft a change straight into this module for human review.
Security Posture (DSPM)
Platform
CIS-style hardening scan for Postgres / MySQL — TLS, password hashing, privilege sprawl, anonymous users, local infile, audit logging — returns a graded scorecard with guided remediation for each finding.
Optimize section (8 tools)
Pro
Query Optimizer + Code Optimizer (AI rewrites) · Index Janitor (unused / duplicate / missing-FK indexes with DROP DDL) · Schema Doctor (tables-without-PK, missing-FK indexes, high-NULL columns, oversized text, never-ANALYZEd) · Autovacuum Pressure Map (bloat, stale stats, wraparound emergency) · Pool Fit (Fit Score 0-100, recommended pool size from pg_stat_activity samples) · Plan Watch (re-EXPLAIN every 30 min; alert on plan-shape change or ≥2× cost jump) · Cost (full-fleet, per-table attribution, storage tier ladder).
Query Optimizer (K8s-aware in v1.30)
Pro
Paste a query; the optimizer rewrites it using your live schema, indexes, table sizes, and a safe EXPLAIN plan. Works against either a Direct Connection (TCP) OR a K8s-discovered Postgres / MySQL / MongoDB pod (via psql / mysql -B / mongosh --eval inside the pod). Never executes your query — only EXPLAIN runs. Index suggestions ship with the exact CREATE INDEX + tradeoff note.
Code Optimizer
Pro
Paste application code (TS / JS / Python / Java / Go / Ruby / Rust / +5 more) and get back a rewritten version. Looks for N+1 queries, missing pagination, string-concatenated SQL, sync DB calls in async paths, and engine-specific anti-patterns. Credentials redacted before AI call.
Index Janitor (PG + MySQL in v1.32)
Pro
Surfaces unused / duplicate / redundant / missing-FK indexes for PostgreSQL OR MySQL family databases — Direct Connect OR K8s-discovered. PG uses pg_stat_user_indexes; MySQL uses sys.schema_unused_indexes + information_schema.STATISTICS. Generates the exact DROP INDEX (PG: CONCURRENTLY) or CREATE INDEX DDL.
Schema Doctor (PG + MySQL in v1.32)
Pro
PG: missing primary keys, FKs without covering indexes, ≥80% NULL columns, oversized text, never-ANALYZEd tables. MySQL: missing-PK (critical — InnoDB synthesizes hidden 6-byte rowid), missing-FK-index, oversized VARCHAR(>= 1000), tables with stale UPDATE_TIME. Each finding ships with ALTER TABLE / CREATE INDEX / ANALYZE TABLE DDL.
Autovacuum Pressure Map (Postgres-only)
Pro
Postgres-only by nature — autovacuum is a PG concept; MySQL's InnoDB does incremental dirty-page flushing automatically. Six categories including BLOAT-EXTREME (50%+ dead tuples → VACUUM FULL), STALE-STATS, NEVER-VACUUMED, HIGH-WRITE-RATE, and the WRAPAROUND emergency check (xid_age >1.5B = STOP traffic + VACUUM FREEZE). Direct Connect or K8s-discovered.
Pool Fit (PG + MySQL in v1.32)
Pro
Samples connection-pool state 3× one second apart, returns a Fit Score 0-100 + recommended pool size (2-3× peak active). PG via pg_stat_activity; MySQL via information_schema.PROCESSLIST. Catches POOL-TOO-SMALL, POOL-TOO-LARGE, MAX-CONNECTIONS-LOW, LONG-IDLE leaked connections. Direct Connect or K8s-discovered.
Plan Watch (PG + MySQL in v1.32)
Pro
Register a query, DBHelm re-EXPLAINs it every 30 min against PG (EXPLAIN FORMAT JSON) or MySQL (EXPLAIN FORMAT=JSON). Two-layer fingerprinting (query text + plan tree shape). Engine-aware tree walker — PG's plan tree vs MySQL's query_block / nested_loop / table.access_type / table.key. Flags regressions when the engine switches access path OR cost jumps ≥2× with same plan shape.
Cost dashboard (full-fleet aware as of v1.25)
Free
Counts every database in your fleet — provisioned + K8s-discovered + Direct Connect — not just clusters DBHelm provisioned. Per-cluster monthly + annual estimate using built-in rate cards for AWS RDS / Cloud SQL / Azure Flexible Server / K8s defaults. v1.26 adds per-table cost attribution (70% storage + 30% compute weighted) and a storage tier ladder (gp2→gp3, io1→gp3, pd-ssd→pd-balanced).
Declarative state ("Terraform for DBs")
Platform
A single state.yaml describes clusters + objects + schedules. dbhelm plan shows the diff; dbhelm apply executes; dbhelm export captures live state.
GitOps event log + replay
Platform
state-history.jsonl mirrors every state change. Optionally pushed to a real Git remote. Replay any historic event back into a StateFile.
Drift detector
Platform
Background job compares live state with desired YAML or replay history. Severity buckets surface what needs reconciliation.
AI assistant on safety rails
Platform
Bring-your-own-key (OpenAI / Anthropic / Ollama). Every LLM-suggested query passes through the destructive-op classifier + cost dry-run before you can execute.
Mongo Monitoring & DB Studio — GA
Free
Self-hosted MongoDB only: PSMDB replica sets, K8s-managed Mongo (Community / Bitnami / STS), and Direct Connect to mongod you operate (SSH / SOCKS5). Not Atlas or vendor DBaaS. Monitoring with slow ops, Performance Advisor, and deep links into Studio. Studio: read-only Explorer, Schema/Pipeline/Bulk, Safe Ops for audited DML, Indexes for DDL.
Mongo Explorer read-only
Free
Server + client blocklist for insert/update/delete, index DDL, $out/$merge, collMod, dropView, and bracket-notation bypasses. Explorer cannot run DDL or DML — use Safe Ops or Indexes tabs. Direct Connect uses a curated mongosh subset via the official driver (not full shell eval).
Operator Hub (10 operators)
Platform
One-click install for CNPG / PSMDB / MongoDB Community Operator / MySQL Operator (Oracle) / Redis Operator (Spotahome) / K8ssandra / Strimzi / Percona PG / Oracle Database Operator / IBM Db2u Operator. Catalog version pins, Deployment image drift detection, and Update available → re-apply the recommended pin. Manifests fetched through SSRF-safe allowlist; cluster-scoped resources require explicit ack.
Parallel workbenches (v1.55)
Free
Fleet workbench for Dashboard / All Databases / fleet Monitoring. Open any cluster in a new workbench tab — full /db/:id workspace with Console, Monitoring, Backups, Optimize. Switch workbenches without aborting running Console queries; close tabs with × when done.
Console with adapters
Free
Unified IDE: deep adapters for MongoDB, SQL, Redis, Kafka, Elasticsearch, vector DBs, Neo4j, InfluxDB; SaaS adapters with $-per-query dry-run for BigQuery / Snowflake / Redshift / Databricks. Other engines fall through to a Command adapter.
Safe-by-default queries
Free
Read-only mode is the default. Destructive ops (DROP / DELETE / TRUNCATE / dropDatabase / TopicDelete) are detected and blocked until explicit confirm. Every mutation audit-logged.
On-demand backups for CNPG, PSMDB, Percona PG, MySQL Operator, AWS RDS, Strimzi MM2. Cron-style schedules for CNPG, PSMDB, Percona PG, AWS RDS. One-click restore with pre-flight validation; PITR for PSMDB.
Plugin SDK
Free
@dbhelm/sdk lets the community ship provisioners, backups, schedules, objects, SaaS adapters. Backend loads them from ~/.dbhelm/plugins/ at boot.
Health Check
Platform
One-click diagnostics with scored reports, recommendations, and exportable snapshots.
Direct Connect
Free
Connect to databases on VMs, bare metal, or cloud-managed SQL (RDS / Cloud SQL / Azure) with host and port — no Kubernetes required. Self-hosted MongoDB via TCP / SSH / SOCKS5 (not Atlas or vendor DBaaS). SaaS engines (BigQuery / Snowflake / Redshift / Databricks) via service-account JSON.
Maintenance Ops + Scheduler
Platform
Vacuum, reindex, compaction, cache flush per database. Cron-like automation for recurring tasks.
Alert engine + diagnostic auto-RCA
Pro
Configurable TSDB metric alerts with pluggable channels (webhook / email / Slack), silences, maintenance windows and escalation. Toggle "Auto-diagnose on fire" so a firing rule runs Incident RCA scoped to the exact breaching pod and embeds the root cause + a "View RCA" deep link right in the notification.
Audit logging
Platform
Complete audit trail of every action — who did what, when, and where. RBAC-gated. State-changing events also mirrored into the GitOps log.
Log Analyzer
Free
Centralized log viewing with search, filtering, and real-time tailing.
Cross-platform
Free
Native builds for macOS, Windows, and Linux. Free, offline-first; opt-in error reporting only.
56 discovery providers across SQL, NoSQL, Vector, Streaming, Cache, Time-Series, Graph, and more
Every engine below auto-discovers from your Kubernetes clusters; most also work via Direct Connect on VMs you control. MongoDB monitoring targets self-hosted deployments.
PostgreSQLSQL
MySQLSQL
MongoDBNoSQL
RedisCache
KafkaStream
ElasticsearchSearch
CassandraNoSQL
CockroachDBSQL
ClickHouseOLAP
Neo4jGraph
RabbitMQStream
InfluxDBTSDB
MilvusVector
WeaviateVector
SQL ServerSQL
MariaDBSQL
ScyllaDBNoSQL
YugabyteDBSQL
TiDBSQL
VitessSQL
etcdKV
MinIOObject
DuckDBOLAP
StarRocksOLAP
MemcachedCache
CouchbaseNoSQL
QdrantVector
ChromaDBVector
ValkeyCache
TimescaleDBTSDB
+ Oracle, Snowflake, DynamoDB, Cosmos DB, BigQuery, Redshift, Aurora, Db2, SAP HANA, and more
Intelligence
Not just dashboards — advise with Pro, govern with Platform
Pro: Performance / Query / Slow-log / Code Advisors (Mongo + Postgres), Optimize suite, Upgrade Advisor, and Right-Sizing recommendations.
Platform: Playbooks, DR Testing, Compliance, Capacity Forecasting. Transaction Tracer and AI Diagnose are Pro.
Upgrade Advisor
Pro
EOL radar · Pro
Detect EOL versions across your fleet via in-pod version probes (or declared version on Direct Connect), see recommended upgrade paths, and run pre-flight compatibility checks before you touch a pod.
EOL & nearing-EOL detection
In-pod version probe (K8s)
Upgrade path recommendations
Pre-flight breaking-change catalog
EOL radarAlways in the green
Right-Sizing Advisor
Pro
Idle pods → recommendations · Pro · K8s
Find over- and under-provisioned K8s workloads. Compare CPU/memory requests vs metrics-server usage with concrete per-pod recommendations and a fleet efficiency score. Apply resize is Platform (Maintenance).
Fleet efficiency score
CPU & memory waste % per pod
Per-pod actionable recommendations
Pairs with /cost for $ math
Waste %CPU + memory per pod
Incident Playbooks
Platform
Runbook automation · Platform · K8s
Five pre-built diagnostic playbooks for 3am incidents: high CPU, replication lag, pool exhaustion, disk, slow queries. Auto-runs checks via kubectl exec; findings ranked by severity.
5 pre-built templates
Auto-run diagnostic steps
Severity-ranked findings
Session execution history
5 templatesK8s-discovered DBs
DR Testing
Platform
Failover simulation · Platform · K8s
Score every K8s-discovered database on DR readiness. Evaluate backup freshness, replica health, and failover readiness — then dry-run failover without touching production.
DR readiness score (0-100)
RPO from last snapshot age
RTO heuristic from replicas + size
Dry-run failover simulation
RPO/RTOEstimated per database
Compliance Engine
Platform
Policy-as-code · Platform
Build policies from seven built-in checks — backup, alerting, replicas, SSL, connections, resource limits, password policy. Per-DB pass/fail with severity. Session-scoped today; persistence on the roadmap.
7 built-in check types
Severity levels (critical → low)
Per-DB pass/fail reports
Session-scoped policies
7 checksBuilt-in policy catalog
Capacity Forecasting
Platform
Days-until-full · Platform · K8s metrics
Linear-regression projections for storage, memory, and connections. Days-until-full, growth rate, and urgency tiers from metrics-server + engine queries.
Storage, memory & connections
Days-until-full (linear regression)
Growth rate / day
Urgency tiers
ForecastStorage · Mem · Conn
Transaction Tracer
Pro
Live queries · Pro · K8s
Real-time active / slow queries and connections for PostgreSQL, MySQL, MongoDB, and Redis. Lock graphs for PG + MySQL. Part of AI Diagnose / Platform.
Stop paying SaaS markup on databases you could run yourself.
MongoDB Atlas, AWS RDS, Confluent Cloud, ClickHouse Cloud and the rest charge
2–4× the raw infrastructure cost for the same hardware.
DBHelm gives you the monitoring, backups, DR, and day-2 operations of a managed service
on your own cloud — so you pocket the difference.
MongoDB replica set
3 nodes · 16 GB RAM · 100 GB data
MongoDB Atlas M40$751/mo
$1.04/hr on AWS + backup + egress
DBHelm + EKS (Percona or Bitnami)$300/mo
3× r6i.large · 300 GB gp3
Monthly savings60% off
$451/ mo
$5,412 per year
Postgres HA cluster
Primary + 2 replicas · 32 GB RAM · 500 GB data
AWS RDS Multi-AZ db.r6g.xlarge$1,275/mo
Multi-AZ premium + gp3 + backup
DBHelm + CloudNativePG on K8s$650/mo
3× r6i.xlarge · 1.5 TB gp3
Monthly savings49% off
$625/ mo
$7,500 per year
Kafka streaming cluster
3 brokers · 8 vCPU / 32 GB · 500 GB logs
Confluent Cloud Standard$2,800/mo
Base + ingress + egress + storage
DBHelm + Strimzi on K8s$900/mo
3× m6i.2xlarge · 1.5 TB gp3
Monthly savings68% off
$1,900/ mo
$22,800 per year
A small fleet of 10 databases typically saves
$60,000–$150,000 a year.
The managed-DB markup is the premium you pay to skip ops work.
DBHelm removes most of that work — auto-discovery, monitoring,
backups, DR testing, incident playbooks, right-sizing, capacity
forecasting — so the markup stops making sense.
Whether you're building a platform, responding to incidents, or optimizing performance — DBHelm adapts to your workflow.
Platform Engineers
Build a self-service database platform
"We need one tool to provision + manage Postgres on RDS, Mongo on K8s, and Kafka via Strimzi — without writing terraform glue and bespoke runbooks."
Give your teams a unified provisioning + management plane. The wizard creates clusters via 17 built-in providers covering every DB-Engines top-10 engine; the declarative state YAML codifies your fleet so a CI pipeline can apply it.
Provision via CNPG / Percona PG / PSMDB / MongoDB Community / MySQL Operator / Redis / K8ssandra / SQL Server / Oracle / Db2 / Strimzi on K8s, or RDS / Cloud SQL / Azure DB managed
Declarative state YAML: dbhelm plan / apply / export from CI
GitOps event log + replay: every state change is reproducible
10-entry Operator Hub: one-click prereq install with cluster-scope ack guard
Plugin SDK to extend with internal-only providers; multi-org RBAC; audit log
SREs + DevOps
Reduce MTTR with deep observability + safe queries
"At 3am when a database is slow, I need engine-level metrics — InnoDB lock waits, replication lag, slow queries — not pod CPU. And I need to query the live DB without fear of running DROP by mistake."
Engine-aware dashboards, the live transaction tracer, the AI assistant that classifies destructive ops before you can run them, and a console that defaults to read-only. Plus the drift detector tells you when live state doesn't match desired.
Drift detector + GitOps log so you know what changed
DBAs
One tool for backups, migrations, federation + cost
"I manage Percona on K8s, RDS Postgres, a bare-metal MySQL we want to migrate to Postgres, and we're trying to figure out which managed DB is bleeding money."
On-demand + scheduled backups with one-click restore. MySQL→Postgres migration in three clicks. Eight Optimize tools (Query/Code Optimizer, Index Janitor, Schema Doctor, Autovacuum Pressure Map, Pool Fit, Plan Watch, Cost) cover everything from query rewriting to wraparound emergencies. Cross-engine federation lets you JOIN across Postgres + MySQL DBs without ETL.
Backups: CNPG / PSMDB / Percona PG / MySQL Operator / RDS / Strimzi MM2; PITR for PSMDB
Optimize section (8 tools): Query/Code Optimizer · Index Janitor · Schema Doctor · Autovacuum · Pool Fit · Plan Watch · Cost
Plan Watch (v1.27): re-EXPLAIN every 30 min, alert on plan-shape change or ≥2× cost jump — catch post-deploy regressions before customers do
MySQL → Postgres migration: schema infer, type mapping, batched pump, validation
Cross-engine federation via embedded DuckDB (Postgres + MySQL families)
Offline-first desktop app (free email to download; no cloud lock-in)
Yes
No
Yes
Partial
Partial
Full support
Partial
Not supported
Managed DBaaS (Atlas, RDS, Cloud SQL) wins on hands-off backups, failover, and zero-ops scaling — for its own vendor instances. DBHelm is the control plane for databases you operate (K8s, VMs, bare metal, cloud-managed SQL via Direct Connect). Self-hosted Mongo is in scope; Atlas is not a first-class target. Use both: let managed services run what they run, and use DBHelm for the rest of your fleet.
By the numbers
Built for real infrastructure
56
Discovery Engines
SQL, NoSQL, Vector, Streaming, Cache, TSDB
17
Provisioners
All DB-Engines top-10 covered. CNPG, PSMDB, MongoDB Community, MySQL Operator, Redis, K8ssandra, SQL Server, Oracle, Db2, Strimzi, Percona PG, RDS, Cloud SQL, Azure DB
3851
Unit Tests
Pure modules tested in CI on every push (3162 backend + 683 frontend + 6 desktop) + backend smoke probe
∞
Databases & Clusters
No database or cluster caps. Free to connect, query & monitor.
DBHelm is a desktop app. Your credentials and metadata stay on your machine. Read-only is the default; destructive operations require explicit confirmation.
AES-256-GCM Encryption
All credentials and kubeconfigs encrypted at rest in the local SQLite store
Destructive-op Classifier
DROP / DELETE / TRUNCATE / dropDatabase / TopicDelete blocked until you confirm
After a free email download, the app runs offline on your machine. Optional error reporting only.
Don't take our word for it
Three things you can verify before you download
We're a young project. Instead of fabricated testimonials, here's the proof you can check yourself.
Verifiable
3851 unit tests on every release
Every release runs the full test suite on Linux + macOS + Windows before binaries are published. Coverage spans destructive-op classification, type mapping, rate-card lookups, federation classification, declarative diffing, replay reconstruction, optimizer prompt builders, EXPLAIN safety, credential redaction, SSRF allowlists, plugin sandboxing.
Every release ships with a per-feature changelog: what shipped, what's in beta, what we cut. No vapor — what's on the changelog is what's in the binary you download. Planned and in-flight work is called out in the changelog too.
macOS DMG (Apple Silicon), Windows installer, and Linux AppImage + .deb on every tag. Windows and Linux update in-app; macOS checks for updates and opens dbhelm.com/download until Developer ID signing ships. Free email signup to download; no credit card for Free tier.
Used DBHelm and want to share your experience? Email hello@dbhelm.com — we'd love to feature real quotes from real users instead of inventing them.
Pricing
Free to connect & monitor. Pro to advise. Platform to operate.
Free forever for connect, query, monitor, and Studio. Pro adds Advisor, Optimize, Diagnose, and alerts. Platform adds provisioning, backups, GitOps, and governance.
DBHelm
$0/ forever
Free
Unlimited Direct Connections + registered Kubernetes environments
Real-time monitoring with embedded Topology + live query insights
Console / Studio with deep adapters + safe-by-default queries
Self-hosted Mongo Studio (PSMDB / Community / K8s / Direct Connect)
Fleet cost rollup; local users & roles; offline-first
No telemetry Encrypted storage Self-serve checkout
FAQ
Frequently asked questions
What is DBHelm?
DBHelm is a free, source-available desktop application that serves as a unified control plane for databases. It auto-discovers 56 database engines on Kubernetes, connects to anything via Direct Connect, provisions new clusters via 17 built-in providers, runs deep monitoring + backups + safe queries, federates Postgres+MySQL via embedded DuckDB, migrates MySQL to Postgres in three clicks, optimizes pasted SQL + application code with live schema awareness, and tracks cost — all from a single interface.
Which clusters can DBHelm provision (not just discover)?
17 today across two categories. Eleven K8s operators / patterns: CloudNativePG (Postgres) · Percona PG · Percona Server for MongoDB (PSMDB) · MongoDB Community Operator (MongoDB Inc.) · MySQL Operator (Oracle InnoDB Cluster) · Redis Operator (Spotahome) · K8ssandra (Apache Cassandra) · SQL Server StatefulSet · Oracle Database Operator (OraOperator) · IBM Db2u Operator · Strimzi (Kafka). Six cloud-managed services: AWS RDS Postgres + MySQL · Cloud SQL Postgres + MySQL · Azure Database for PostgreSQL + MySQL Flexible Server. Plus a 10-entry Operator Hub for one-click prereq install of the K8s operators above (CNPG / PSMDB / MongoDB Community / MySQL Operator / Redis / K8ssandra / Strimzi / Percona PG / Oracle / Db2u). Scheduled backups, restore flows, and object admin all work from the same UI.
What does the Query Optimizer do? (v1.23)
Pick a connected database, paste a query, click Optimize. The backend introspects live schema (sizes / indexes / column cardinality from information_schema / pg_class / collStats), runs a safe read-only EXPLAIN (never ANALYZE), and asks your configured AI provider to rewrite it with engine-specific best-practice hints (Postgres LATERAL, Mongo ESR rule, Cassandra ALLOW FILTERING red flag, etc.). Returns the rewrite + index suggestions with exact CREATE INDEX DDL + tradeoff notes. Your original query is never executed — only EXPLAIN runs.
What does the Code Optimizer do? (v1.23)
Paste application code in any of 12 languages (TS / JS / Python / Java / Go / Ruby / C# / PHP / Rust / Kotlin / Scala / SQL), optionally link a connected DB for engine-aware suggestions. Returns categorized issues (performance / safety / security / maintainability with severities low → critical) and a rewritten version. Looks for N+1 query patterns, missing pagination, string-concatenated SQL, sync DB calls in async paths, missing batch operations, ORM over-fetching. Credentials in your code are redacted before reaching the AI provider — we surface the redaction count.
What's free, and what needs a license?
Free, forever: connect, query, monitor, and Studio on existing databases — Direct Connections and registered Kubernetes environments, self-hosted Mongo Studio — with no usage caps. Download requires a free DBHelm account (email + one-time code); the desktop app then runs offline-first. Pro (offline license key in Settings) unlocks Advisor + the Optimize suite, AI Diagnose (Incident RCA, Virtual DBA, Transaction Tracer, on-demand Health Check), alerts (email / Slack / webhook), and the BYO-AI assistant. Platform adds provisioning + Operator Hub, backups & PITR, maintenance, GitOps / schedulers, federation, migration, and governance (audit export, compliance, DR, playbooks). Separately, the BSL 1.1 license means you can't re-sell DBHelm itself as a managed service; internal use is unlimited. BSL auto-converts to Apache 2.0 four years after each release.
What are the prerequisites?
For Kubernetes databases: kubectl and a kubeconfig file. For Direct Connect: just the host, port, and credentials. No agents, sidecars, or cloud accounts needed.
Which Kubernetes distributions work?
Any standard K8s cluster — EKS, GKE, AKS, OpenShift, Rancher, k3s, minikube, and bare-metal. If kubectl can reach it, DBHelm can manage it.
How does auto-discovery work?
DBHelm scans Kubernetes namespaces for Custom Resource Definitions (CRDs), StatefulSets, Deployments, and Helm releases that match known database patterns. It detects the database type, operator, version, and cluster topology automatically.
What is the Console and how is it safer than running queries directly?
Console is a single entry point that detects the database type and loads a native IDE: MongoDB collection browser, SQL schema tree, Redis keyspace scanner, Kafka topic + consumer-group explorer, Elasticsearch index browser, vector collection viewer with similarity-search starters, Neo4j graph schema, InfluxDB bucket tree, and SaaS adapters for BigQuery / Snowflake / Redshift / Databricks with pre-flight $-cost estimates. Engines we don't deep-adapter yet fall through to a generic Command adapter. Every adapter is read-only by default: DROP / DELETE / TRUNCATE / dropDatabase / KafkaTopic-delete are detected and blocked until you explicitly confirm. Every mutation is audit-logged and mirrored into the GitOps event log.
How does the AI assistant work? Is my schema sent anywhere?
Bring your own key for OpenAI, Anthropic, or any OpenAI-compatible endpoint (Ollama for local). DBHelm never proxies through us — your prompts go straight to the provider you configure. Every LLM-generated query passes through the same destructive-op classifier as a hand-typed query, plus (for SaaS engines) a dry-run cost estimate, before you can execute. The LLM never auto-executes anything.
What does cross-engine federation mean? How does it work?
DBHelm embeds DuckDB. Pick which Postgres + MySQL Direct Connections to attach, give each an alias, and write ANSI SQL like SELECT * FROM pg_app.users JOIN my_orders.orders ON ... — joins push down to native scanners when they can. Today: Postgres family (CNPG / RDS / Cloud SQL / Azure DB / Cockroach / Citus / Timescale / Yugabyte) and MySQL family (RDS / Cloud SQL / Azure DB / MariaDB / PXC / Vitess). Mongo / Snowflake / BigQuery support is on the roadmap via materialization.
What does declarative state and the GitOps log give me?
Write a single state.yaml describing your clusters, objects (databases / roles / schemas / topics), and backup schedules. dbhelm plan shows the diff vs live; dbhelm apply executes via the same registries the UI uses; dbhelm export captures current state. Every state-changing event also writes to ~/.dbhelm/state/state-history.jsonl, optionally pushed to a Git remote via DBHELM_STATE_GIT_REPO. Click "Replay to here" on any historical event in the GitOps log page and the YAML for that point-in-time lands in your clipboard.
How does the cost dashboard estimate spend without my cloud bill?
Built-in rate cards for AWS RDS (14 instance classes), Cloud SQL (6 tiers + custom-shape formula), Azure Flexible Server (8 SKUs), and K8s defaults. We multiply by replicas + storage to get a monthly + annual estimate per cluster. As of v1.25 the dashboard counts EVERY database in your fleet — provisioned + K8s-discovered + Direct Connect — not just clusters DBHelm provisioned. v1.26 added per-table cost attribution (70% storage + 30% compute weighted) so a 1MB hot table that gets scanned 100K times/day still gets a real slice, plus a storage tier ladder (gp2 → gp3, io1 → gp3 when IOPS demand is low, pd-ssd → pd-balanced for OLTP). SaaS engines (BigQuery / Snowflake) bill per-query, so they show $0 with a pointer to the per-query cost preview in the Console. Live billing-puller integration (AWS Cost Explorer / GCP Billing / Azure Cost Management) is on the roadmap.
What's in the Optimize section?
Eight focused tools as of v1.27 — each does one thing well: (1) Query Optimizer — paste a query, get an AI rewrite using live schema + safe EXPLAIN. (2) Code Optimizer — paste app code in 12 languages, get categorized issues + a rewrite. (3) Index Janitor — finds unused / duplicate / low-usage / missing-FK indexes with the exact DROP INDEX CONCURRENTLY DDL. (4) Schema Doctor — tables-without-PK, missing-FK indexes, ≥80% NULL columns, oversized text, never-ANALYZEd. (5) Autovacuum Pressure Map — Postgres-specific bloat / stale stats / wraparound emergency check. (6) Pool Fit — samples pg_stat_activity 3× and returns a Fit Score 0-100 + recommended pool size. (7) Plan Watch — register a query, DBHelm re-EXPLAINs every 30 min, alerts when plan changes or cost ≥2× jumps. (8) Cost — full-fleet aware, per-table attribution, storage tier ladder. All read-only — they generate DDL but never execute it. The DDL gets copied into Console (which has the destructive-op confirm gate).
What is Plan Watch and when should I use it?
Plan Watch is for catching the post-deploy "everything's slow now" class of bugs BEFORE customers do. You register a query (typically your hottest few — top customer dashboard, daily report, login lookup); DBHelm re-EXPLAINs it every 30 minutes (and on demand) and fingerprints the plan tree shape. When Postgres switches access path (Index Scan → Seq Scan, or one index → another), OR cost jumps ≥2× with the same plan shape, the run gets flagged as a regression with a one-line diff explanation ("Plan shape changed: Index Scan using foo_pkey → Seq Scan", "Cost jumped 5× — usually means table grew faster than stats updated"). Pure EXPLAIN — never executes the actual query.
What does the migration engine do today?
MySQL → Postgres in three clicks: pick a source MySQL Direct Connection, pick a target Postgres Direct Connection, plan, execute. Schema is inferred via information_schema; type mapping handles tinyint(1)→bool, AUTO_INCREMENT→SERIAL, JSON→JSONB, ENUM→TEXT (lossy, flagged), unsigned ints widening, etc. Data streams in pages of 1,000 (configurable) with per-table row-count validation. Mongo → Postgres and DynamoDB → Postgres are on the roadmap.
What about playbooks and DR testing — do they work for any database?
Honest scope: Incident Playbooks, DR Testing, Right-Sizing, Transaction Tracer, and the embedded Topology view in Monitoring all require Kubernetes (we talk to the operator + pods directly). Capacity Forecasting needs the K8s metrics-server for live metrics. Upgrade Advisor and Compliance work on both K8s and Direct Connect (Upgrade Advisor falls back to declared version when in-pod probes are unavailable).
Can I connect to non-Kubernetes databases?
Yes. Direct Connect registers databases you operate on VMs, bare metal, or cloud-managed SQL (AWS RDS, Google Cloud SQL, Azure Database) by host, port, and credentials. For MongoDB, DBHelm targets self-hosted deployments (mongod / replica sets / sharded clusters, SSH-tunneled or SOCKS5) — not MongoDB Atlas or other vendor DBaaS as a first-class target. SaaS engines (BigQuery / Snowflake / Redshift / Databricks) also use Direct Connect with their respective auth methods.
Does it send my data to the cloud?
No. DBHelm is offline-first. All configuration, credentials, and kubeconfigs are stored locally in an encrypted SQLite database (AES-256-GCM). Optional opt-in error reporting can be enabled in Settings; everything else stays on your machine. The only outbound calls are: (1) the cloud APIs you configure (Kubernetes / RDS / Cloud SQL / etc), (2) AI provider when you configure one (Platform), (3) the optional Git remote when DBHELM_STATE_GIT_REPO is set, (4) a lightweight update check (Windows/Linux can install in-app; macOS opens dbhelm.com/download until Developer ID signing ships).
Can I extend it without forking?
Yes — the @dbhelm/sdk package exposes typed interfaces for ClusterProvisioner, BackupProvider, ScheduleProvider, ObjectAdminProvider, and SaasProvider. Drop a .mjs file into ~/.dbhelm/plugins/ and DBHelm loads it at boot. The /plugins page (super-admin only) shows what loaded, manifest details, and reason-if-skipped.
Why does SmartScreen / Gatekeeper show a warning?
macOS builds are currently unsigned (Developer ID + notarization is on the roadmap — see the download page). On macOS run: xattr -dr com.apple.quarantine /Applications/DBHelm.app, or right-click → Open. On Windows click "More info" → "Run anyway". Windows/Linux in-app updates still work without Mac signing.