Credentials
Where a database's password is, who can read it, and why it cannot be rotated from here.
cubeship db credentials pgPrints the username, the password, the database name and both connection strings. It is an admin's request and its own endpoint — never part of a listing — and the database's Overview shows the same behind a reveal.
Stored as given
The password is stored as it was chosen or generated, not hashed: a hash
cannot connect to anything, and every attached app needs the real one in
its environment. It is also in the container's own configuration, which
docker inspect on the host reads.
Generated unless chosen
A request with no password gets 32 generated characters, so a database with a weak one is not something anybody gets by leaving a box empty. The dashboard generates its own and shows it.
Not rotated from here
Changing the stored password would change every connection string
Cubeship hands out while the database went on accepting only the old
one — the engine read it once, at initialisation. Rotating is an
ALTER USER (or the engine's equivalent) run inside the database, and
then a new database on this instance is the only way to change what
Cubeship knows.
Never through an agent
No MCP tool reads or sets a password. An agent can provision a database and attach an app, and the app receives the credential through its environment without the agent ever holding it.