nao

• ✓ evals: supported
• ✓ logs: supported
• ✓ cost: supported
• ✓ users: supported

What Benchouse reads

Benchouse reads nao’s own database with a read-only role. It doesn’t need access to nao itself.

• Each question and nao’s answer.
• The SQL nao ran, from its execute_sql tool calls, with row counts, errors and results.
• Reasoning, follow-up suggestions and clarifying questions.
• Other tool calls and MCP calls, such as read, list and display_chart.
• The model, tokens and cost of each answer, and the user who asked.

Connect

nao stores its data in the database its DB_URI points to. If DB_URI was never set, nao uses a local sqlite file and there is no role to create.

1. If DB_URI starts with postgres://, create a read-only role on that database:

   CREATE ROLE benchouse_read LOGIN PASSWORD '…';
   GRANT CONNECT ON DATABASE nao TO benchouse_read;
   GRANT USAGE ON SCHEMA public TO benchouse_read;
   GRANT SELECT ON chat, chat_message, message_part, llm_inference,
                   "user", project, mcp_call_log TO benchouse_read;

   The role can read these seven tables and nothing else. API keys, sessions, OAuth tables and stored Git tokens stay unreadable. message_part includes the results of the queries nao ran, and Benchouse stores those.

2. Allow your database to accept connections from Benchouse.

3. In Agents, click Add agent, choose nao, and create a nao connection with the database host, database name, role, password and TLS mode. For a sqlite nao, give the path to the file instead of a host.

4. Choose nao from what the connection reports.