Frequently asked questions

Short answers to the questions that come up most often. If something is missing, the rest of these docs go deeper — start with Quick start or Connecting ClickHouse.

Can OptiHouse modify my data or schema?

No. It only issues SELECT against system.*. The recommended user has readonly = 1, so the database itself blocks any write. Recommendations are advice — you apply them yourself.

Do I need to install an agent on my servers?

No. OptiHouse connects out to your cluster and pulls a snapshot. The future pull-based agent is optional and meant for air-gapped or strict egress-only environments.

Which ClickHouse versions are supported?

The core scan works on 20.1 and newer. A few advanced analyzers need newer system views — projections need 22.3, skipping indices need 20.3. On older versions those checks are skipped cleanly rather than failing the scan.

How often does it scan?

Every 15 minutes per connection, plus on demand. Anomaly detection needs at least two scans before it has something to diff.

My cluster is behind a VPN — can I still use it?

Yes. The SSH bastion mode tunnels through an existing jump host and covers most corporate VPN setups. See Connecting ClickHouse for the setup steps.

What is the difference between the Optimizer and Recommendations?

The optimizer analyses one query you paste in. Recommendations run the same rules continuously across your whole query_log to find the queries worth fixing in the first place.

Why did a recommendation move to "applied" on its own?

Auto-apply detected the fix — either the finding disappeared for several scans, or a verifier found positive evidence in system.*. If it was a mistake, the detail page has an action to reopen it. See Auto-apply & verification.

Can I use the optimizer without connecting a cluster?

Yes. The optimizer endpoint is public and credential-free — it analyses SQL text only. Try the live playground on the landing page.

Where are my credentials stored?

ClickHouse passwords and SSH keys live server-side in encrypted columns and are never returned by the API. See Security & privacy for the full picture.

Is there an API?

Yes — everything the UI does goes through it. See the API reference, and the live OpenAPI schema at /docs on the API host.