AI overview

How Cocobox uses LLMs — model routing, your keys vs. ours, credits, and what data leaves your workspace.

Last updated

Cocobox embeds AI in three places:

  1. The editor — natural-language → SQL, fix-this-error, explain-this-query.
  2. Chats — multi-turn conversations with database context.
  3. The API — your own apps and agents (opencode, Claude Code, MCP) talking to LLMs through Cocobox.

You choose which models power each, and you choose whose budget pays for them.

Two ways to pay

Every workspace has a credit balance. Models cost a fixed number of credits per request, listed in Supported models. We handle the upstream provider relationship — you just see one bill from Cocobox.

Bring your own keys (BYOK)

Plug in your own OpenAI, Anthropic, Google, or Azure OpenAI key. Cocobox routes requests through that key; no credits are consumed. You see usage in your provider’s billing console as if you were calling them directly. See Bring your own keys.

You can mix: BYOK for a specific provider, credits for everything else.

What data is sent

For SQL-shaped requests (NL→SQL, explain, fix), Cocobox sends:

  • The prompt you typed.
  • A schema digest — table names, column names + types, foreign keys. No row data.
  • The current SQL in the editor (so the model can edit it).
  • The error message if you clicked “Fix this”.

For Chats, additionally: the prior turns of the conversation and any explicitly attached query results.

What’s never sent (unless you explicitly attach it):

  • Row contents.
  • Connection credentials.
  • Other connections’ schemas.
  • Audit log content.

Privacy controls

Settings → AI:

  • Provider allow-list — restrict which upstream providers can be used (e.g. only Anthropic + Google, no OpenAI).
  • Schema redaction — exclude columns matching glob patterns (*_pii, *.email, etc.) from the schema digest.
  • Statement redaction — replace string literals in statements with ? before logging or sending to AI.
  • No-train guarantee — Cocobox never trains models on your prompts; we contractually require the same of upstream providers.

What’s next