Skip to content
NEW v1.87.0 — AWS RDS/Aurora discovery · Postgres Advisor · Incident Signals

Unified Control Plane for Modern Databases

Discover, query & monitor every database across Kubernetes, VMs, and cloud — free and offline-first. Advisor, Optimize, Diagnose and alerts on Pro. Provision, back up and govern with Platform.

Free to start · Free email signup · macOS, Windows & Linux
56
Discovery Engines
17
Provisioners
3851
Unit Tests
100%
Offline-First
DBHelm — Database Control Plane
Environments
4
All connected
Databases
81
14 types
Backups
24
0 failures
Alerts
1
CPU warning
Cluster Health — Real-time
CPU Memory IOPS
Recent Discoveries
MongoDB — prod-psmdb (Percona) GKE
PostgreSQL — api-pg-ha (CloudNativePG) EKS
Redis — cache-cluster (Bitnami) AKS

Engines DBHelm discovers + manages

PostgreSQLMongoDBMySQLRedisKafkaElasticsearchCassandraClickHouseCockroachDBNeo4jInfluxDBRabbitMQ + 44 more

How it works

From zero to full visibility
in three steps

Connect → Discover (or provision) → Operate. No agents, no sidecars, no cloud dependency. Free, offline-first.

STEP 01

Connect

Import kubeconfig or Direct Connect

Open DBHelm, go to Environments, and import your kubeconfig — auto-detects cloud provider, region, and cluster. Or use Direct Connect for any database with just a host and port. No agents, no sidecars.

terminal
EnvironmentsAdd EnvironmentImport Kubeconfig

  Name:     prod-cluster
  Provider:  Detected GKE · us-central1
  Auth:      Kubeconfig valid
  Status:    Connected

  Scanning namespaces... done
   4 namespaces · 81 databases discovered
STEP 02

Discover + Provision

Auto-detect across 56 engines, or spin up fresh

DBHelm scans CRDs, StatefulSets, and Deployments to discover databases across 56 engines — SQL, NoSQL, vector, streaming, cache, time-series. Need a new cluster? The wizard provisions via 17 built-in providers covering all DB-Engines top-10: CNPG / Percona PG / PSMDB / MongoDB Community / MySQL Operator / Redis / K8ssandra / SQL Server / Oracle / Db2 / Strimzi on K8s, plus AWS RDS + Cloud SQL + Azure DB Flexible Server (Postgres + MySQL on each).

terminal
All Databases → 81 discovered across 4 environments

  PostgreSQL  (CloudNativePG)      ×3  ● Healthy
  MongoDB     (Percona PSMDB)      ×2  ● Healthy
  Redis       (Bitnami Helm)       ×4  ● Healthy
  Kafka       (Strimzi Operator)   ×1  ● Healthy
  Elasticsearch (ECK)              ×2  ● Healthy
  + 69 more across 14 types

Or: Clusters → Create → CNPG / PSMDB / Strimzi / RDS / …
STEP 03

Operate + intelligence

Monitor, query, optimize, back up, federate, migrate, cost-track

Real-time engine-aware dashboards, on-demand + scheduled backups, a safe-by-default Console with deep adapters, AI assistant on safety rails, cross-engine federation via embedded DuckDB, MySQL→Postgres migration, plus an 8-tool Optimize section: Query Optimizer + Code Optimizer (AI rewrites) + Index Janitor (unused/duplicate/missing-FK indexes with DROP DDL) + Schema Doctor (missing PKs / high-NULL columns / oversized text) + Autovacuum Pressure Map (bloat / wraparound emergency) + Pool Fit (Fit Score 0-100 from pg_stat_activity) + Plan Watch (EXPLAIN regression detection every 30 min) + full-fleet Cost dashboard. Declarative state YAML + GitOps replay + drift detection round it out. All from one unified interface — free to monitor, query & Studio; Pro adds Advisor, Optimize, Diagnose and alerts; Platform adds provisioning, backups, federation & governance.

terminal
┌─ Real-time Monitoring ─────────────┐
│ CPU: ████████░░ 78%   Conn: 142    │
│ Mem: ██████░░░░ 62%   QPS:  2.4k   │
│ IOPS: █████░░░░ 51%   Lag:  0.2s   │
│  1 alert: Buffer pool hit < 99%  │
└────────────────────────────────────┘
SELECT * FROM pg_app.users JOIN my_orders.orders …
 Federated query · 1,243 rows · 124ms

Features

Everything you need to
operate databases at scale

Replace scattered CLI tools, dashboards, and scripts with a single control plane that understands every database — from PostgreSQL to Kafka to vector databases.

Free Connect, query, monitor & Studio Pro Advisor, Optimize, Diagnose, alerts Platform Provision, back up, automate & govern

Universal Discovery

Free

Auto-detect databases across Kubernetes clusters via CRDs, operators, Helm charts, and StatefulSets. Direct Connect for VMs and bare metal — including self-hosted MongoDB replica sets you operate (not Atlas or vendor DBaaS).

K8s OperatorsCRD ScanningDirect ConnectAuto-detect

Deep Monitoring

Free

Engine-level metrics for every database type: InnoDB stats, Galera wsrep, Patroni HA, oplog lag, consumer group lag, query latencies — not just K8s pod metrics.

Real-time ChartsQuery InsightsPerformance AdvisorAlerting

Virtual DBA (AI agent)

Pro

Chat with an AI DBA scoped to one database — or your whole fleet. It investigates with read-only tools (live activity, slow queries, metrics, schema, Incident RCA, query optimizer, index advisor, table profiling, error explainer, migration safety review) and answers with evidence. Strictly read-only: it drafts changes into Schema Changes for a human to apply. BYO key (OpenAI / Anthropic / Ollama) with per-DB PII redaction and local-only policy.

AI agentRead-onlyFleet modeBYO key

AI Incident RCA & Diagnose

Pro

Root-cause analysis over a time window from real signals — pod/DB logs, engine internals, slow queries, replication, FTDC (Mongo), K8s events and TSDB baselines — producing a structured report with evidence and recommended actions. Alerts can auto-run RCA scoped to the breaching pod and embed the cause in the notification. Plus curated diagnostic Playbooks per engine. Works with AI or a heuristic no-AI mode.

Root causeAuto-RCA alertsPlaybooksNo-AI mode

Backup & Restore

Platform

Scheduled automated backups with retention policies, one-click restore with pre-flight validation, and volume snapshot support. Full restore history with audit trail.

Scheduled BackupsPoint-in-TimeOne-Click RestoreAudit Trail

Live Migration (ClusterSync)

Platform

Namespace-filtered, live MongoDB cluster→cluster migration with minimal downtime — the mongosync / Percona ClusterSync pattern. Split a service onto its own cluster: preflight → initial copy → continuous change-stream replication → guided cutover with the new connection string. Runs as a Kubernetes Job or host process and is read-only against your source data.

MongoDBLive syncChange streamsGuided cutover

Security First

Free

AES-256-GCM encryption (scrypt KDF, per-record salt) for all credentials. JWT HS256 + token versioning. Strict CSP, sandboxed Electron renderer with contextIsolation. RBAC with super-admin / admin / read-only roles. Offline-first — no telemetry by default; opt-in error reporting only. Dependency audits run in CI on every release.

Encrypted StorageRBACNo Default TelemetryOffline First

Instant Onboarding

Free

Import kubeconfig and go — auto-detects cloud provider, region, and cluster name. Or use Direct Connect for any database with just a host and port. No agents or sidecars.

Kubeconfig ImportAuto-detect CloudNo AgentsZero Config

Unified Dashboard

Free

All databases across all environments in one view. Filter by type, cluster, status, or organization. Multi-cluster, multi-cloud, and multi-org support built-in.

Multi-ClusterMulti-CloudOrganizationsRole-Based

And much more

Provisioning (17 providers — every DB-Engines top-10 covered)

Platform

Spin up new clusters from the wizard or YAML: CloudNativePG / Percona PG / Percona Server for MongoDB / MongoDB Community Operator / MySQL Operator (Oracle) / Redis Operator (Spotahome) / Strimzi Kafka / K8ssandra (Cassandra) / SQL Server (StatefulSet) / Oracle Database (OraOperator) / IBM Db2 (Db2u Operator) on K8s, plus AWS RDS Postgres + MySQL, Cloud SQL Postgres + MySQL, Azure Database for PostgreSQL + MySQL Flexible Server.

Cross-engine federation (DuckDB)

Platform

Attach Postgres + MySQL Direct Connections as virtual catalogs and write ANSI SQL across them in one editor. Joins push down to native scanners.

Heterogeneous migration engine

Platform

MySQL → Postgres in three clicks: schema inference, type mapping with lossy flagging, batched data pump, source-vs-target row-count validation. (For same-engine live MongoDB cluster→cluster moves, see Live Migration / ClusterSync.)

Schema Changes (DDL CI/CD)

Platform

Versioned migrations with static safety analysis (flags locking / destructive / non-concurrent ops and suggests safer rewrites), AI-assisted migration review, dry-run with transactional rollback, online schema change, and rollback support. The Virtual DBA can draft a change straight into this module for human review.

Security Posture (DSPM)

Platform

CIS-style hardening scan for Postgres / MySQL — TLS, password hashing, privilege sprawl, anonymous users, local infile, audit logging — returns a graded scorecard with guided remediation for each finding.

Optimize section (8 tools)

Pro

Query Optimizer + Code Optimizer (AI rewrites) · Index Janitor (unused / duplicate / missing-FK indexes with DROP DDL) · Schema Doctor (tables-without-PK, missing-FK indexes, high-NULL columns, oversized text, never-ANALYZEd) · Autovacuum Pressure Map (bloat, stale stats, wraparound emergency) · Pool Fit (Fit Score 0-100, recommended pool size from pg_stat_activity samples) · Plan Watch (re-EXPLAIN every 30 min; alert on plan-shape change or ≥2× cost jump) · Cost (full-fleet, per-table attribution, storage tier ladder).

Query Optimizer (K8s-aware in v1.30)

Pro

Paste a query; the optimizer rewrites it using your live schema, indexes, table sizes, and a safe EXPLAIN plan. Works against either a Direct Connection (TCP) OR a K8s-discovered Postgres / MySQL / MongoDB pod (via psql / mysql -B / mongosh --eval inside the pod). Never executes your query — only EXPLAIN runs. Index suggestions ship with the exact CREATE INDEX + tradeoff note.

Code Optimizer

Pro

Paste application code (TS / JS / Python / Java / Go / Ruby / Rust / +5 more) and get back a rewritten version. Looks for N+1 queries, missing pagination, string-concatenated SQL, sync DB calls in async paths, and engine-specific anti-patterns. Credentials redacted before AI call.

Index Janitor (PG + MySQL in v1.32)

Pro

Surfaces unused / duplicate / redundant / missing-FK indexes for PostgreSQL OR MySQL family databases — Direct Connect OR K8s-discovered. PG uses pg_stat_user_indexes; MySQL uses sys.schema_unused_indexes + information_schema.STATISTICS. Generates the exact DROP INDEX (PG: CONCURRENTLY) or CREATE INDEX DDL.

Schema Doctor (PG + MySQL in v1.32)

Pro

PG: missing primary keys, FKs without covering indexes, ≥80% NULL columns, oversized text, never-ANALYZEd tables. MySQL: missing-PK (critical — InnoDB synthesizes hidden 6-byte rowid), missing-FK-index, oversized VARCHAR(>= 1000), tables with stale UPDATE_TIME. Each finding ships with ALTER TABLE / CREATE INDEX / ANALYZE TABLE DDL.

Autovacuum Pressure Map (Postgres-only)

Pro

Postgres-only by nature — autovacuum is a PG concept; MySQL's InnoDB does incremental dirty-page flushing automatically. Six categories including BLOAT-EXTREME (50%+ dead tuples → VACUUM FULL), STALE-STATS, NEVER-VACUUMED, HIGH-WRITE-RATE, and the WRAPAROUND emergency check (xid_age >1.5B = STOP traffic + VACUUM FREEZE). Direct Connect or K8s-discovered.

Pool Fit (PG + MySQL in v1.32)

Pro

Samples connection-pool state 3× one second apart, returns a Fit Score 0-100 + recommended pool size (2-3× peak active). PG via pg_stat_activity; MySQL via information_schema.PROCESSLIST. Catches POOL-TOO-SMALL, POOL-TOO-LARGE, MAX-CONNECTIONS-LOW, LONG-IDLE leaked connections. Direct Connect or K8s-discovered.

Plan Watch (PG + MySQL in v1.32)

Pro

Register a query, DBHelm re-EXPLAINs it every 30 min against PG (EXPLAIN FORMAT JSON) or MySQL (EXPLAIN FORMAT=JSON). Two-layer fingerprinting (query text + plan tree shape). Engine-aware tree walker — PG's plan tree vs MySQL's query_block / nested_loop / table.access_type / table.key. Flags regressions when the engine switches access path OR cost jumps ≥2× with same plan shape.

Cost dashboard (full-fleet aware as of v1.25)

Free

Counts every database in your fleet — provisioned + K8s-discovered + Direct Connect — not just clusters DBHelm provisioned. Per-cluster monthly + annual estimate using built-in rate cards for AWS RDS / Cloud SQL / Azure Flexible Server / K8s defaults. v1.26 adds per-table cost attribution (70% storage + 30% compute weighted) and a storage tier ladder (gp2→gp3, io1→gp3, pd-ssd→pd-balanced).

Declarative state ("Terraform for DBs")

Platform

A single state.yaml describes clusters + objects + schedules. dbhelm plan shows the diff; dbhelm apply executes; dbhelm export captures live state.

GitOps event log + replay

Platform

state-history.jsonl mirrors every state change. Optionally pushed to a real Git remote. Replay any historic event back into a StateFile.

Drift detector

Platform

Background job compares live state with desired YAML or replay history. Severity buckets surface what needs reconciliation.

AI assistant on safety rails

Platform

Bring-your-own-key (OpenAI / Anthropic / Ollama). Every LLM-suggested query passes through the destructive-op classifier + cost dry-run before you can execute.

Mongo Monitoring & DB Studio — GA

Free

Self-hosted MongoDB only: PSMDB replica sets, K8s-managed Mongo (Community / Bitnami / STS), and Direct Connect to mongod you operate (SSH / SOCKS5). Not Atlas or vendor DBaaS. Monitoring with slow ops, Performance Advisor, and deep links into Studio. Studio: read-only Explorer, Schema/Pipeline/Bulk, Safe Ops for audited DML, Indexes for DDL.

Mongo Explorer read-only

Free

Server + client blocklist for insert/update/delete, index DDL, $out/$merge, collMod, dropView, and bracket-notation bypasses. Explorer cannot run DDL or DML — use Safe Ops or Indexes tabs. Direct Connect uses a curated mongosh subset via the official driver (not full shell eval).

Operator Hub (10 operators)

Platform

One-click install for CNPG / PSMDB / MongoDB Community Operator / MySQL Operator (Oracle) / Redis Operator (Spotahome) / K8ssandra / Strimzi / Percona PG / Oracle Database Operator / IBM Db2u Operator. Catalog version pins, Deployment image drift detection, and Update available → re-apply the recommended pin. Manifests fetched through SSRF-safe allowlist; cluster-scoped resources require explicit ack.

Parallel workbenches (v1.55)

Free

Fleet workbench for Dashboard / All Databases / fleet Monitoring. Open any cluster in a new workbench tab — full /db/:id workspace with Console, Monitoring, Backups, Optimize. Switch workbenches without aborting running Console queries; close tabs with × when done.

Console with adapters

Free

Unified IDE: deep adapters for MongoDB, SQL, Redis, Kafka, Elasticsearch, vector DBs, Neo4j, InfluxDB; SaaS adapters with $-per-query dry-run for BigQuery / Snowflake / Redshift / Databricks. Other engines fall through to a Command adapter.

Safe-by-default queries

Free

Read-only mode is the default. Destructive ops (DROP / DELETE / TRUNCATE / dropDatabase / TopicDelete) are detected and blocked until explicit confirm. Every mutation audit-logged.

Object admin

Platform

Create databases, roles, schemas, MongoDB collections + users, Kafka topics, Snowflake warehouses + users + roles, Databricks Unity-Catalog catalogs + schemas + SQL warehouses. UI or declarative YAML.

Backups + scheduled backups

Platform

On-demand backups for CNPG, PSMDB, Percona PG, MySQL Operator, AWS RDS, Strimzi MM2. Cron-style schedules for CNPG, PSMDB, Percona PG, AWS RDS. One-click restore with pre-flight validation; PITR for PSMDB.

Plugin SDK

Free

@dbhelm/sdk lets the community ship provisioners, backups, schedules, objects, SaaS adapters. Backend loads them from ~/.dbhelm/plugins/ at boot.

Health Check

Platform

One-click diagnostics with scored reports, recommendations, and exportable snapshots.

Direct Connect

Free

Connect to databases on VMs, bare metal, or cloud-managed SQL (RDS / Cloud SQL / Azure) with host and port — no Kubernetes required. Self-hosted MongoDB via TCP / SSH / SOCKS5 (not Atlas or vendor DBaaS). SaaS engines (BigQuery / Snowflake / Redshift / Databricks) via service-account JSON.

Maintenance Ops + Scheduler

Platform

Vacuum, reindex, compaction, cache flush per database. Cron-like automation for recurring tasks.

Alert engine + diagnostic auto-RCA

Pro

Configurable TSDB metric alerts with pluggable channels (webhook / email / Slack), silences, maintenance windows and escalation. Toggle "Auto-diagnose on fire" so a firing rule runs Incident RCA scoped to the exact breaching pod and embeds the root cause + a "View RCA" deep link right in the notification.

Audit logging

Platform

Complete audit trail of every action — who did what, when, and where. RBAC-gated. State-changing events also mirrored into the GitOps log.

Log Analyzer

Free

Centralized log viewing with search, filtering, and real-time tailing.

Cross-platform

Free

Native builds for macOS, Windows, and Linux. Free, offline-first; opt-in error reporting only.

56 discovery providers across SQL, NoSQL, Vector, Streaming, Cache, Time-Series, Graph, and more

Every engine below auto-discovers from your Kubernetes clusters; most also work via Direct Connect on VMs you control. MongoDB monitoring targets self-hosted deployments.

PostgreSQL SQL
MySQL SQL
MongoDB NoSQL
Redis Cache
Kafka Stream
Elasticsearch Search
Cassandra NoSQL
CockroachDB SQL
ClickHouse OLAP
Neo4j Graph
RabbitMQ Stream
InfluxDB TSDB
Milvus Vector
Weaviate Vector
SQL Server SQL
MariaDB SQL
ScyllaDB NoSQL
YugabyteDB SQL
TiDB SQL
Vitess SQL
etcd KV
MinIO Object
DuckDB OLAP
StarRocks OLAP
Memcached Cache
Couchbase NoSQL
Qdrant Vector
ChromaDB Vector
Valkey Cache
TimescaleDB TSDB

+ Oracle, Snowflake, DynamoDB, Cosmos DB, BigQuery, Redshift, Aurora, Db2, SAP HANA, and more

Intelligence

Not just dashboards —
advise with Pro, govern with Platform

Pro: Performance / Query / Slow-log / Code Advisors (Mongo + Postgres), Optimize suite, Upgrade Advisor, and Right-Sizing recommendations. Platform: Playbooks, DR Testing, Compliance, Capacity Forecasting. Transaction Tracer and AI Diagnose are Pro.

Upgrade Advisor

Pro

EOL radar · Pro

Detect EOL versions across your fleet via in-pod version probes (or declared version on Direct Connect), see recommended upgrade paths, and run pre-flight compatibility checks before you touch a pod.

  • EOL & nearing-EOL detection
  • In-pod version probe (K8s)
  • Upgrade path recommendations
  • Pre-flight breaking-change catalog
EOL radar Always in the green

Right-Sizing Advisor

Pro

Idle pods → recommendations · Pro · K8s

Find over- and under-provisioned K8s workloads. Compare CPU/memory requests vs metrics-server usage with concrete per-pod recommendations and a fleet efficiency score. Apply resize is Platform (Maintenance).

  • Fleet efficiency score
  • CPU & memory waste % per pod
  • Per-pod actionable recommendations
  • Pairs with /cost for $ math
Waste % CPU + memory per pod

Incident Playbooks

Platform

Runbook automation · Platform · K8s

Five pre-built diagnostic playbooks for 3am incidents: high CPU, replication lag, pool exhaustion, disk, slow queries. Auto-runs checks via kubectl exec; findings ranked by severity.

  • 5 pre-built templates
  • Auto-run diagnostic steps
  • Severity-ranked findings
  • Session execution history
5 templates K8s-discovered DBs

DR Testing

Platform

Failover simulation · Platform · K8s

Score every K8s-discovered database on DR readiness. Evaluate backup freshness, replica health, and failover readiness — then dry-run failover without touching production.

  • DR readiness score (0-100)
  • RPO from last snapshot age
  • RTO heuristic from replicas + size
  • Dry-run failover simulation
RPO/RTO Estimated per database

Compliance Engine

Platform

Policy-as-code · Platform

Build policies from seven built-in checks — backup, alerting, replicas, SSL, connections, resource limits, password policy. Per-DB pass/fail with severity. Session-scoped today; persistence on the roadmap.

  • 7 built-in check types
  • Severity levels (critical → low)
  • Per-DB pass/fail reports
  • Session-scoped policies
7 checks Built-in policy catalog

Capacity Forecasting

Platform

Days-until-full · Platform · K8s metrics

Linear-regression projections for storage, memory, and connections. Days-until-full, growth rate, and urgency tiers from metrics-server + engine queries.

  • Storage, memory & connections
  • Days-until-full (linear regression)
  • Growth rate / day
  • Urgency tiers
Forecast Storage · Mem · Conn

Transaction Tracer

Pro

Live queries · Pro · K8s

Real-time active / slow queries and connections for PostgreSQL, MySQL, MongoDB, and Redis. Lock graphs for PG + MySQL. Part of AI Diagnose / Platform.

  • Active queries + PIDs
  • Slow-query stream
  • Lock graph: PG / MySQL
  • Per-connection state
4 engines PG · MySQL · Mongo · Redis

Zero config

Every tool activates automatically when you connect a database. No agents, no extra scrape configs, no PromQL to write.

Engine-aware

Every recommendation understands the engine — Galera wsrep, oplog, Patroni HA, Raft, consumer-group lag — not just pod CPU.

100% offline

All analysis runs locally on your machine. No default telemetry, no cloud roundtrip, no compliance conversation with your security team.

Cost 40–70% Savings

Stop paying SaaS markup on databases you could run yourself.

MongoDB Atlas, AWS RDS, Confluent Cloud, ClickHouse Cloud and the rest charge 2–4× the raw infrastructure cost for the same hardware. DBHelm gives you the monitoring, backups, DR, and day-2 operations of a managed service on your own cloud — so you pocket the difference.

MongoDB replica set

3 nodes · 16 GB RAM · 100 GB data

MongoDB Atlas M40 $751/mo

$1.04/hr on AWS + backup + egress

DBHelm + EKS (Percona or Bitnami) $300/mo

3× r6i.large · 300 GB gp3

Monthly savings 60% off
$451 / mo

$5,412 per year

Postgres HA cluster

Primary + 2 replicas · 32 GB RAM · 500 GB data

AWS RDS Multi-AZ db.r6g.xlarge $1,275/mo

Multi-AZ premium + gp3 + backup

DBHelm + CloudNativePG on K8s $650/mo

3× r6i.xlarge · 1.5 TB gp3

Monthly savings 49% off
$625 / mo

$7,500 per year

Kafka streaming cluster

3 brokers · 8 vCPU / 32 GB · 500 GB logs

Confluent Cloud Standard $2,800/mo

Base + ingress + egress + storage

DBHelm + Strimzi on K8s $900/mo

3× m6i.2xlarge · 1.5 TB gp3

Monthly savings 68% off
$1,900 / mo

$22,800 per year

A small fleet of 10 databases typically saves $60,000–$150,000 a year.

The managed-DB markup is the premium you pay to skip ops work. DBHelm removes most of that work — auto-discovery, monitoring, backups, DR testing, incident playbooks, right-sizing, capacity forecasting — so the markup stops making sense.

The fine print
  • ·Self-managed isn't free — you still pay for compute, storage, and network.
  • ·You need a K8s cluster (EKS, GKE, AKS, on-prem — DBHelm works with all).
  • ·Prices are approximate, on-demand, single-region, April 2026.
  • ·See methodology →

Use Cases

Built for teams who
run databases in production

Whether you're building a platform, responding to incidents, or optimizing performance — DBHelm adapts to your workflow.

Platform Engineers

Build a self-service database platform

"We need one tool to provision + manage Postgres on RDS, Mongo on K8s, and Kafka via Strimzi — without writing terraform glue and bespoke runbooks."

Give your teams a unified provisioning + management plane. The wizard creates clusters via 17 built-in providers covering every DB-Engines top-10 engine; the declarative state YAML codifies your fleet so a CI pipeline can apply it.

  • Provision via CNPG / Percona PG / PSMDB / MongoDB Community / MySQL Operator / Redis / K8ssandra / SQL Server / Oracle / Db2 / Strimzi on K8s, or RDS / Cloud SQL / Azure DB managed
  • Declarative state YAML: dbhelm plan / apply / export from CI
  • GitOps event log + replay: every state change is reproducible
  • 10-entry Operator Hub: one-click prereq install with cluster-scope ack guard
  • Plugin SDK to extend with internal-only providers; multi-org RBAC; audit log
SREs + DevOps

Reduce MTTR with deep observability + safe queries

"At 3am when a database is slow, I need engine-level metrics — InnoDB lock waits, replication lag, slow queries — not pod CPU. And I need to query the live DB without fear of running DROP by mistake."

Engine-aware dashboards, the live transaction tracer, the AI assistant that classifies destructive ops before you can run them, and a console that defaults to read-only. Plus the drift detector tells you when live state doesn't match desired.

  • Engine-aware metrics (oplog / Galera wsrep / Patroni / consumer-group lag)
  • Live transaction tracer for PG / MySQL / Mongo / Redis
  • Safe-by-default Console + destructive-op classifier
  • AI assistant on the same safety rails (BYO key)
  • Drift detector + GitOps log so you know what changed
DBAs

One tool for backups, migrations, federation + cost

"I manage Percona on K8s, RDS Postgres, a bare-metal MySQL we want to migrate to Postgres, and we're trying to figure out which managed DB is bleeding money."

On-demand + scheduled backups with one-click restore. MySQL→Postgres migration in three clicks. Eight Optimize tools (Query/Code Optimizer, Index Janitor, Schema Doctor, Autovacuum Pressure Map, Pool Fit, Plan Watch, Cost) cover everything from query rewriting to wraparound emergencies. Cross-engine federation lets you JOIN across Postgres + MySQL DBs without ETL.

  • Backups: CNPG / PSMDB / Percona PG / MySQL Operator / RDS / Strimzi MM2; PITR for PSMDB
  • Optimize section (8 tools): Query/Code Optimizer · Index Janitor · Schema Doctor · Autovacuum · Pool Fit · Plan Watch · Cost
  • Plan Watch (v1.27): re-EXPLAIN every 30 min, alert on plan-shape change or ≥2× cost jump — catch post-deploy regressions before customers do
  • MySQL → Postgres migration: schema infer, type mapping, batched pump, validation
  • Cross-engine federation via embedded DuckDB (Postgres + MySQL families)
  • Cost dashboard: per-cluster $ / month + per-engine + per-provider rate cards

Comparison

Why teams switch to DBHelm

One control plane across every database you run — not a per-vendor silo, a CLI, or a single-DB GUI.

Feature
Recommended DBHelm
Managed DBaaS Atlas, RDS, Cloud SQL kubectl K8s Dashboards DB GUIs DBeaver, TablePlus
Core
Kubernetes-native discovery (CRDs / StatefulSets / Helm) Yes No Partial No No
Direct Connect (VMs / cloud / SaaS) Yes No No No Yes
56 discovery engines, all in one app Yes No No No Partial
Deep engine-level monitoring (oplog / Galera / Patroni) Yes Partial No No No
Multi-cluster + multi-org RBAC Yes Partial Partial Yes No
Provisioning
Cluster provisioning (17 providers) — Platform Yes Partial Partial No No
Operator Hub (pins, drift, one-click upgrade) — Platform Yes No No No No
Object admin (databases / roles / schemas / topics) — Platform Yes Yes No No Partial
Intelligence
AI assistant on safety rails (BYO key) — Platform Yes No No No No
Cross-engine federation (DuckDB; Postgres + MySQL) — Platform Yes No No No No
Declarative state YAML (plan / apply / export) — Platform Yes Partial No No No
GitOps event log + replay + drift detector — Platform Yes No No No No
Cost dashboard (full-fleet: provisioned + K8s-discovered + Direct Connect; per-table attribution; gp2→gp3 ladder) Yes No No No No
Migration engine (MySQL → Postgres in three clicks) Yes Partial No No No
Query Optimizer (live schema-aware SQL/Mongo rewrites + index DDL) Yes Partial No No No
Code Optimizer (12-language app-code rewrites; cred redaction) Yes No No No No
Index Janitor (unused / duplicate / missing-FK indexes with DROP DDL) Yes Partial No No No
Schema Doctor (missing PKs, missing-FK indexes, high-NULL columns, oversized text) Yes No No No No
Autovacuum Pressure Map (bloat, stale stats, wraparound emergency) Yes No No No No
Pool Fit (pg_stat_activity sampling + Fit Score + recommended pool size) Yes No No No No
Plan Watch (re-EXPLAIN every 30 min; alert on plan-shape change or ≥2× cost jump) Yes No No No No
DR readiness + dry-run failover (K8s) — Platform Yes Partial No No No
Capacity forecasting (storage / memory / connections) Yes Partial No No No
Right-sizing recommendations Yes Partial No Partial No
Incident playbooks (5 templates, K8s) — Platform Yes No No No No
Compliance policy engine + report export — Platform Yes Partial No No No
Operations
On-demand + scheduled backups; one-click restore — Platform Yes Yes No No No
Console with deep adapters + safe-by-default queries Yes Partial Partial Partial Partial
Per-query $-cost preview (BigQuery / Snowflake / Redshift / Databricks) Yes No Partial Partial No
Plugin SDK (community provisioners + adapters) Yes No No No No
Offline-first desktop app (free email to download; no cloud lock-in) Yes No Yes Partial Partial
Full support Partial Not supported

Managed DBaaS (Atlas, RDS, Cloud SQL) wins on hands-off backups, failover, and zero-ops scaling — for its own vendor instances. DBHelm is the control plane for databases you operate (K8s, VMs, bare metal, cloud-managed SQL via Direct Connect). Self-hosted Mongo is in scope; Atlas is not a first-class target. Use both: let managed services run what they run, and use DBHelm for the rest of your fleet.

By the numbers

Built for real infrastructure

56
Discovery Engines
SQL, NoSQL, Vector, Streaming, Cache, TSDB
17
Provisioners
All DB-Engines top-10 covered. CNPG, PSMDB, MongoDB Community, MySQL Operator, Redis, K8ssandra, SQL Server, Oracle, Db2, Strimzi, Percona PG, RDS, Cloud SQL, Azure DB
3851
Unit Tests
Pure modules tested in CI on every push (3162 backend + 683 frontend + 6 desktop) + backend smoke probe
Databases & Clusters
No database or cluster caps. Free to connect, query & monitor.

Works with your infrastructure

Amazon EKSGoogle GKEAzure AKSOpenShiftk3sBare-metalAWS RDS (Postgres + MySQL)Cloud SQL (Postgres + MySQL)Azure Database for PostgreSQL + MySQLCloudNativePGPercona PGPercona PSMDBMongoDB Community OperatorMySQL Operator (Oracle)Redis (Spotahome)K8ssandra (Cassandra)Strimzi (Kafka)Oracle Database OperatorIBM Db2u OperatorSnowflakeDatabricksBigQueryRedshift

Safety + privacy by default

DBHelm is a desktop app. Your credentials and metadata stay on your machine. Read-only is the default; destructive operations require explicit confirmation.

AES-256-GCM Encryption

All credentials and kubeconfigs encrypted at rest in the local SQLite store

Destructive-op Classifier

DROP / DELETE / TRUNCATE / dropDatabase / TopicDelete blocked until you confirm

Role-Based Access

Super-admin / admin / read-only roles with org isolation; JWT HS256 + token versioning

Offline-first

After a free email download, the app runs offline on your machine. Optional error reporting only.

Don't take our word for it

Three things you can verify before you download

We're a young project. Instead of fabricated testimonials, here's the proof you can check yourself.

Verifiable

3851 unit tests on every release

Every release runs the full test suite on Linux + macOS + Windows before binaries are published. Coverage spans destructive-op classification, type mapping, rate-card lookups, federation classification, declarative diffing, replay reconstruction, optimizer prompt builders, EXPLAIN safety, credential redaction, SSRF allowlists, plugin sandboxing.

See full release history
Open

Detailed changelog every release

Every release ships with a per-feature changelog: what shipped, what's in beta, what we cut. No vapor — what's on the changelog is what's in the binary you download. Planned and in-flight work is called out in the changelog too.

Read the changelog
Shipped

Free binaries every release

macOS DMG (Apple Silicon), Windows installer, and Linux AppImage + .deb on every tag. Windows and Linux update in-app; macOS checks for updates and opens dbhelm.com/download until Developer ID signing ships. Free email signup to download; no credit card for Free tier.

Download v1.87.0

Used DBHelm and want to share your experience? Email hello@dbhelm.com — we'd love to feature real quotes from real users instead of inventing them.

Pricing

Free to connect & monitor.
Pro to advise. Platform to operate.

Free forever for connect, query, monitor, and Studio. Pro adds Advisor, Optimize, Diagnose, and alerts. Platform adds provisioning, backups, GitOps, and governance.

DBHelm
$0 / forever
Free
  • Unlimited Direct Connections + registered Kubernetes environments
  • Real-time monitoring with embedded Topology + live query insights
  • Console / Studio with deep adapters + safe-by-default queries
  • Self-hosted Mongo Studio (PSMDB / Community / K8s / Direct Connect)
  • Fleet cost rollup; local users & roles; offline-first
Download Free
Most popular
DBHelm Pro
Subscribe
Pro
  • Everything in Free, plus:
  • Advisor + Right-Sizing + Upgrade Advisor
  • Optimize suite: Query/Code Optimizer, Index Janitor, Schema Doctor, Autovacuum, Pool Fit, Plan Watch, per-table Cost
  • AI Diagnose — Incident RCA, Virtual DBA, Transaction Tracer + Health Check
  • Alerts (email / Slack / webhook) + BYO-AI assistant
Buy Pro
DBHelm Platform
Subscribe
Platform
  • Everything in Pro, plus:
  • Provisioning — 17 provisioners + Operator Hub
  • Backups & PITR — on-demand + scheduled, one-click restore
  • Maintenance — rolling restarts, disk / oplog resize, Live Migration
  • GitOps / schedulers / schema changes + federation + engine migration
  • Governance — audit, compliance, DR, playbooks, capacity
Buy Platform
No telemetry Encrypted storage Self-serve checkout

FAQ

Frequently asked questions

What is DBHelm?
DBHelm is a free, source-available desktop application that serves as a unified control plane for databases. It auto-discovers 56 database engines on Kubernetes, connects to anything via Direct Connect, provisions new clusters via 17 built-in providers, runs deep monitoring + backups + safe queries, federates Postgres+MySQL via embedded DuckDB, migrates MySQL to Postgres in three clicks, optimizes pasted SQL + application code with live schema awareness, and tracks cost — all from a single interface.
Which databases can DBHelm discover?
56 engines registered in the discovery providers: SQL (PostgreSQL, MySQL, MariaDB, SQL Server, CockroachDB, YugabyteDB, TiDB, Vitess, ClickHouse, TimescaleDB, StarRocks, DuckDB), NoSQL (MongoDB, PSMDB, Cassandra, ScyllaDB, Couchbase, Neo4j), Vector (Milvus, Weaviate, Qdrant, ChromaDB), Cache (Redis, Valkey, Memcached), Streaming (Kafka, RabbitMQ, Pulsar, NATS), TSDB (InfluxDB), Search (Elasticsearch, OpenSearch), KV (etcd), Object (MinIO), Graph (ArangoDB, Dgraph), OLAP (Druid, Pinot), Enterprise (Oracle, IBM Db2, SAP HANA), Cloud-managed (DynamoDB, CosmosDB, BigQuery, Snowflake, Redshift, Aurora), Emerging (SurrealDB, CrateDB, QuestDB, FerretDB, HBase), Serverless (Neon, PlanetScale, Supabase, Aiven). The exact list lives in backend/src/providers/registry.ts.
Which clusters can DBHelm provision (not just discover)?
17 today across two categories. Eleven K8s operators / patterns: CloudNativePG (Postgres) · Percona PG · Percona Server for MongoDB (PSMDB) · MongoDB Community Operator (MongoDB Inc.) · MySQL Operator (Oracle InnoDB Cluster) · Redis Operator (Spotahome) · K8ssandra (Apache Cassandra) · SQL Server StatefulSet · Oracle Database Operator (OraOperator) · IBM Db2u Operator · Strimzi (Kafka). Six cloud-managed services: AWS RDS Postgres + MySQL · Cloud SQL Postgres + MySQL · Azure Database for PostgreSQL + MySQL Flexible Server. Plus a 10-entry Operator Hub for one-click prereq install of the K8s operators above (CNPG / PSMDB / MongoDB Community / MySQL Operator / Redis / K8ssandra / Strimzi / Percona PG / Oracle / Db2u). Scheduled backups, restore flows, and object admin all work from the same UI.
What does the Query Optimizer do? (v1.23)
Pick a connected database, paste a query, click Optimize. The backend introspects live schema (sizes / indexes / column cardinality from information_schema / pg_class / collStats), runs a safe read-only EXPLAIN (never ANALYZE), and asks your configured AI provider to rewrite it with engine-specific best-practice hints (Postgres LATERAL, Mongo ESR rule, Cassandra ALLOW FILTERING red flag, etc.). Returns the rewrite + index suggestions with exact CREATE INDEX DDL + tradeoff notes. Your original query is never executed — only EXPLAIN runs.
What does the Code Optimizer do? (v1.23)
Paste application code in any of 12 languages (TS / JS / Python / Java / Go / Ruby / C# / PHP / Rust / Kotlin / Scala / SQL), optionally link a connected DB for engine-aware suggestions. Returns categorized issues (performance / safety / security / maintainability with severities low → critical) and a rewritten version. Looks for N+1 query patterns, missing pagination, string-concatenated SQL, sync DB calls in async paths, missing batch operations, ORM over-fetching. Credentials in your code are redacted before reaching the AI provider — we surface the redaction count.
What's free, and what needs a license?
Free, forever: connect, query, monitor, and Studio on existing databases — Direct Connections and registered Kubernetes environments, self-hosted Mongo Studio — with no usage caps. Download requires a free DBHelm account (email + one-time code); the desktop app then runs offline-first. Pro (offline license key in Settings) unlocks Advisor + the Optimize suite, AI Diagnose (Incident RCA, Virtual DBA, Transaction Tracer, on-demand Health Check), alerts (email / Slack / webhook), and the BYO-AI assistant. Platform adds provisioning + Operator Hub, backups & PITR, maintenance, GitOps / schedulers, federation, migration, and governance (audit export, compliance, DR, playbooks). Separately, the BSL 1.1 license means you can't re-sell DBHelm itself as a managed service; internal use is unlimited. BSL auto-converts to Apache 2.0 four years after each release.
What are the prerequisites?
For Kubernetes databases: kubectl and a kubeconfig file. For Direct Connect: just the host, port, and credentials. No agents, sidecars, or cloud accounts needed.
Which Kubernetes distributions work?
Any standard K8s cluster — EKS, GKE, AKS, OpenShift, Rancher, k3s, minikube, and bare-metal. If kubectl can reach it, DBHelm can manage it.
How does auto-discovery work?
DBHelm scans Kubernetes namespaces for Custom Resource Definitions (CRDs), StatefulSets, Deployments, and Helm releases that match known database patterns. It detects the database type, operator, version, and cluster topology automatically.
What is the Console and how is it safer than running queries directly?
Console is a single entry point that detects the database type and loads a native IDE: MongoDB collection browser, SQL schema tree, Redis keyspace scanner, Kafka topic + consumer-group explorer, Elasticsearch index browser, vector collection viewer with similarity-search starters, Neo4j graph schema, InfluxDB bucket tree, and SaaS adapters for BigQuery / Snowflake / Redshift / Databricks with pre-flight $-cost estimates. Engines we don't deep-adapter yet fall through to a generic Command adapter. Every adapter is read-only by default: DROP / DELETE / TRUNCATE / dropDatabase / KafkaTopic-delete are detected and blocked until you explicitly confirm. Every mutation is audit-logged and mirrored into the GitOps event log.
How does the AI assistant work? Is my schema sent anywhere?
Bring your own key for OpenAI, Anthropic, or any OpenAI-compatible endpoint (Ollama for local). DBHelm never proxies through us — your prompts go straight to the provider you configure. Every LLM-generated query passes through the same destructive-op classifier as a hand-typed query, plus (for SaaS engines) a dry-run cost estimate, before you can execute. The LLM never auto-executes anything.
What does cross-engine federation mean? How does it work?
DBHelm embeds DuckDB. Pick which Postgres + MySQL Direct Connections to attach, give each an alias, and write ANSI SQL like SELECT * FROM pg_app.users JOIN my_orders.orders ON ... — joins push down to native scanners when they can. Today: Postgres family (CNPG / RDS / Cloud SQL / Azure DB / Cockroach / Citus / Timescale / Yugabyte) and MySQL family (RDS / Cloud SQL / Azure DB / MariaDB / PXC / Vitess). Mongo / Snowflake / BigQuery support is on the roadmap via materialization.
What does declarative state and the GitOps log give me?
Write a single state.yaml describing your clusters, objects (databases / roles / schemas / topics), and backup schedules. dbhelm plan shows the diff vs live; dbhelm apply executes via the same registries the UI uses; dbhelm export captures current state. Every state-changing event also writes to ~/.dbhelm/state/state-history.jsonl, optionally pushed to a Git remote via DBHELM_STATE_GIT_REPO. Click "Replay to here" on any historical event in the GitOps log page and the YAML for that point-in-time lands in your clipboard.
How does the cost dashboard estimate spend without my cloud bill?
Built-in rate cards for AWS RDS (14 instance classes), Cloud SQL (6 tiers + custom-shape formula), Azure Flexible Server (8 SKUs), and K8s defaults. We multiply by replicas + storage to get a monthly + annual estimate per cluster. As of v1.25 the dashboard counts EVERY database in your fleet — provisioned + K8s-discovered + Direct Connect — not just clusters DBHelm provisioned. v1.26 added per-table cost attribution (70% storage + 30% compute weighted) so a 1MB hot table that gets scanned 100K times/day still gets a real slice, plus a storage tier ladder (gp2 → gp3, io1 → gp3 when IOPS demand is low, pd-ssd → pd-balanced for OLTP). SaaS engines (BigQuery / Snowflake) bill per-query, so they show $0 with a pointer to the per-query cost preview in the Console. Live billing-puller integration (AWS Cost Explorer / GCP Billing / Azure Cost Management) is on the roadmap.
What's in the Optimize section?
Eight focused tools as of v1.27 — each does one thing well: (1) Query Optimizer — paste a query, get an AI rewrite using live schema + safe EXPLAIN. (2) Code Optimizer — paste app code in 12 languages, get categorized issues + a rewrite. (3) Index Janitor — finds unused / duplicate / low-usage / missing-FK indexes with the exact DROP INDEX CONCURRENTLY DDL. (4) Schema Doctor — tables-without-PK, missing-FK indexes, ≥80% NULL columns, oversized text, never-ANALYZEd. (5) Autovacuum Pressure Map — Postgres-specific bloat / stale stats / wraparound emergency check. (6) Pool Fit — samples pg_stat_activity 3× and returns a Fit Score 0-100 + recommended pool size. (7) Plan Watch — register a query, DBHelm re-EXPLAINs every 30 min, alerts when plan changes or cost ≥2× jumps. (8) Cost — full-fleet aware, per-table attribution, storage tier ladder. All read-only — they generate DDL but never execute it. The DDL gets copied into Console (which has the destructive-op confirm gate).
What is Plan Watch and when should I use it?
Plan Watch is for catching the post-deploy "everything's slow now" class of bugs BEFORE customers do. You register a query (typically your hottest few — top customer dashboard, daily report, login lookup); DBHelm re-EXPLAINs it every 30 minutes (and on demand) and fingerprints the plan tree shape. When Postgres switches access path (Index Scan → Seq Scan, or one index → another), OR cost jumps ≥2× with the same plan shape, the run gets flagged as a regression with a one-line diff explanation ("Plan shape changed: Index Scan using foo_pkey → Seq Scan", "Cost jumped 5× — usually means table grew faster than stats updated"). Pure EXPLAIN — never executes the actual query.
What does the migration engine do today?
MySQL → Postgres in three clicks: pick a source MySQL Direct Connection, pick a target Postgres Direct Connection, plan, execute. Schema is inferred via information_schema; type mapping handles tinyint(1)→bool, AUTO_INCREMENT→SERIAL, JSON→JSONB, ENUM→TEXT (lossy, flagged), unsigned ints widening, etc. Data streams in pages of 1,000 (configurable) with per-table row-count validation. Mongo → Postgres and DynamoDB → Postgres are on the roadmap.
What about playbooks and DR testing — do they work for any database?
Honest scope: Incident Playbooks, DR Testing, Right-Sizing, Transaction Tracer, and the embedded Topology view in Monitoring all require Kubernetes (we talk to the operator + pods directly). Capacity Forecasting needs the K8s metrics-server for live metrics. Upgrade Advisor and Compliance work on both K8s and Direct Connect (Upgrade Advisor falls back to declared version when in-pod probes are unavailable).
Can I connect to non-Kubernetes databases?
Yes. Direct Connect registers databases you operate on VMs, bare metal, or cloud-managed SQL (AWS RDS, Google Cloud SQL, Azure Database) by host, port, and credentials. For MongoDB, DBHelm targets self-hosted deployments (mongod / replica sets / sharded clusters, SSH-tunneled or SOCKS5) — not MongoDB Atlas or other vendor DBaaS as a first-class target. SaaS engines (BigQuery / Snowflake / Redshift / Databricks) also use Direct Connect with their respective auth methods.
Does it send my data to the cloud?
No. DBHelm is offline-first. All configuration, credentials, and kubeconfigs are stored locally in an encrypted SQLite database (AES-256-GCM). Optional opt-in error reporting can be enabled in Settings; everything else stays on your machine. The only outbound calls are: (1) the cloud APIs you configure (Kubernetes / RDS / Cloud SQL / etc), (2) AI provider when you configure one (Platform), (3) the optional Git remote when DBHELM_STATE_GIT_REPO is set, (4) a lightweight update check (Windows/Linux can install in-app; macOS opens dbhelm.com/download until Developer ID signing ships).
Can I extend it without forking?
Yes — the @dbhelm/sdk package exposes typed interfaces for ClusterProvisioner, BackupProvider, ScheduleProvider, ObjectAdminProvider, and SaasProvider. Drop a .mjs file into ~/.dbhelm/plugins/ and DBHelm loads it at boot. The /plugins page (super-admin only) shows what loaded, manifest details, and reason-if-skipped.
Why does SmartScreen / Gatekeeper show a warning?
macOS builds are currently unsigned (Developer ID + notarization is on the roadmap — see the download page). On macOS run: xattr -dr com.apple.quarantine /Applications/DBHelm.app, or right-click → Open. On Windows click "More info" → "Run anyway". Windows/Linux in-app updates still work without Mac signing.

More questions? Reach out at hello@dbhelm.com

Get Started

Ready to take control of your databases?

Download DBHelm and get full visibility into your entire database infrastructure in under two minutes. Free to start.

macOS · Windows · Linux · Free to start · Free email to download