The app opens an SSH session and creates a secure local tunnel to MySQL on the server. MySQL is accessed through the tunnel only and is not exposed to the public internet.
Credentials for MySQL on the remote host (after the tunnel), same as in MySQL Workbench when connected through SSH.