56 results available
Sign in
Skills directory

neki

planetscale

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. The skill content was retained without changes. Classified findings before hardening: 23. Classified findings closed: 0. Classified findings remaining: 23. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 8.


Open before hardening

5

Medium

18

Low
Open after hardening

5

Medium

18

Low

Expand
File
Group
Subtype
Severity
Status
references/query-patterns.md

Excessive Agency & Rogue Autonomy

—

Medium
Open
references/schema-design.md

Sensitive Data & Secret Exposure

Agent snooping

Medium
Open
references/indexing.md

Sensitive Data & Secret Exposure

Agent snooping

Medium
Open
references/monitoring.md

Sensitive Data & Secret Exposure

Agent snooping

Medium
Open
SKILL.md

Sensitive Data & Secret Exposure

Agent snooping

Medium
Open
references/architecture.md

Prompt Injection

Third-party content as instructions

Low
Open
references/schema-changes.md

Prompt Injection

Third-party content as instructions

Low
Open
references/cli-and-insights.md

Prompt Injection

Third-party content as instructions

Low
Open

23 findings


SKILL.md

PlanetScale Neki

Docs: https://planetscale.com/docs/neki · https://neki.dev/

Overview

Neki is distributed (sharded) Postgres by PlanetScale. Every shard is real Postgres; Neki places a router in front of the shards and adds per-instance sidecars and a control plane (topology service, admin, Replicator) to route, coordinate, and operate Postgres across many shards — all behind one Postgres connection string on port 5432. Applications use standard Postgres clients, drivers, and ORMs.

Neki is built by the maintainers of Vitess but is a from-scratch system for Postgres, not a Vitess port. It has been demonstrated at about 100 million queries per second and more than a petabyte, and also suits small, unsharded databases (which still get online DDL, zero-downtime operations, connection pooling, and online version upgrades). A new database starts unsharded and can be sharded later.

Per-shard Postgres (VACUUM, WAL, memory, storage, index audits) is ordinary Postgres. Use the postgres skill. On Neki, a configuration profile's Postgres parameters apply to every shard on that profile, and VACUUM, ANALYZE, and VACUUM FULL sent through a router run on every shard even when __neki.shard is set.

Key ideas

  • Router — stateless proxy that parses, plans, routes, buffers, and combines results. Any router serves any connection; production runs at least 3 across availability zones. Connect on port 5432 with sslmode=verify-full — there is no separate pooler port (no 6432/PgBouncer); pooling happens inside Neki.
  • Shard — one Postgres primary plus replicas; its own failure domain. A sidecar and a PostgresManager run beside each Postgres instance.
  • Data topology — JSON map of databases, shards, shard groups (key ranges), and shard indexes (xxhash, modulo, range) that decides where rows live and how queries route.
  • Reference tables and GSIs — replicate small shared data across a group, or map a non-shard-key lookup to the owner row's shard key.
  • Cross-shard caveat — multi-shard reads don't share a snapshot and multi-shard writes aren't atomic; atomic distributed transactions aren't supported in Platform Preview. Keep transactions single-shard.
  • Session settings — __neki.target, __neki.fanout, __neki.tx_mode, __neki.shard, and __neki.replica_recency / _locality / _affinity are the only __neki.* settings; set them before BEGIN. Any other __neki.* name (a typo like __neki.transaction_mode, or an invented one) is accepted silently as a custom parameter — SET and even SHOW succeed — but does nothing. Confirm with SHOW on the real name.

Resources

Concepts and architecture

TopicReferenceUse for

Architecture

references/architecture.md

Router, sidecar, PostgresManager, admin, Replicator, topology service, HA, query lifecycle

Data Topology & Sharding Model

references/sharding-model.md

Shard groups, shard indexes, key ranges, authoritative shard group, co-location, editing the topology

Sharding Readiness & Best Practices

references/sharding-readiness.md

When to shard, choosing a shard key, readiness checklist

Scaling & Capacity

references/scaling-and-capacity.md

Shard layout, hot shards and skew, shard groups, cluster sizing, workload isolation

Queries and transactions

TopicReferenceUse for

Query Planning & Routing

references/query-serving.md

EXPLAIN (NEKI_PLAN), single-shard vs scatter, __neki.fanout, read targeting, direct shard targeting

Transactions

references/transactions.md

Single- vs cross-shard transactions, snapshots, __neki.tx_mode, advisory locks

SQL Query Patterns

references/query-patterns.md

Anti-patterns, pagination, N+1, Platform Preview query-shape limits

ID Generation

references/id-generation.md

Sequences across shards, UUIDv7, composite keys

Error Codes

references/error-codes.md

Reading NK013 errors and the catalog codes

Schema and indexing

TopicReferenceUse for

Schema Design

references/schema-design.md

Primary keys, data types, foreign keys, uniqueness, partitioning, unsupported objects

Indexing, Reference Tables & GSIs

references/indexing.md

Per-shard indexes, reference tables, global secondary indexes

Operations

TopicReferenceUse for

Schema Changes

references/schema-changes.md

Native DDL, managed Online and Direct DDL workflows

Data Migration & Resharding

references/resharding-migration.md

MoveTables, Reshard, differ, cutover, imports

Replication & HA

references/replication.md

Per-shard physical replication, failover, switchover, replica reads and lag

Connections

references/connections.md

Router connections, roles, router groups, TLS, replica routing

Backup & Recovery

references/backup-recovery.md

Scheduled and manual backups, restore to a new branch, PITR

Monitoring

references/monitoring.md

Metrics, logs, Query Insights, anomalies, schema recommendations

Extensions

references/extensions.md

Enabling and installing extensions, pgvector on sharded tables

CLI, Metafunctions & Insights

references/cli-and-insights.md

pscale, __neki.* metafunctions, session settings, MCP

Install

Install with chainctl
chainctl skill install public/planetscale/neki:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/planetscale/database-skills
Upstream commitf6ed002d03084cb39c01d1d58904d47a36f5322a
OCI reference

skills.cgr.dev/public/github.com/planetscale/skills/neki:latest

License

MIT

Files

HARDENING.md

LICENSE

SKILL.md

references/architecture.md

references/backup-recovery.md

references/cli-and-insights.md

references/connections.md

references/error-codes.md

references/extensions.md

references/id-generation.md

references/indexing.md

references/monitoring.md

references/query-patterns.md

references/query-serving.md

references/replication.md

references/resharding-migration.md

references/scaling-and-capacity.md

references/schema-changes.md

references/schema-design.md

references/sharding-model.md

references/sharding-readiness.md

references/transactions.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.