Official MCP server

Manage your backend directly from your AI

Connect Cursor, Claude Code, VS Code, Windsurf and Codex to Swyftstack and create databases, import data, manage backups, configure storage, rotate passwords and monitor everything - without leaving your editor. One command. No API key to paste.

Add to any MCP-compatible client
{
  "mcpServers": {
    "swyftstack": { "command": "npx", "args": ["-y", "swyftstack-mcp"] }
  }
}
What is MCP?

Your AI, wired straight into your infrastructure

MCP (Model Context Protocol) is an open standard that lets AI assistants call real tools. The Swyftstack MCP server exposes your databases, storage and backups as tools your AI can use - safely and with your permission.

No context switching

Ask for a database in plain language and get a connection string back - in the same chat where you're writing code.

Same guardrails as the console

Every action runs through the scoped REST API. Scopes, dangerous-operation limits and rate limits are enforced server-side.

Zero-config auth

One npx command. The first request opens your browser to sign in - no key to create, copy, or paste.

Installation

Supported AI applications

Pick your client and paste the config. Every one uses the same server - no API key required.

Claude Code

Anthropic's coding agent in your terminal and IDE.

Add the server (one command)
claude mcp add swyftstack -- npx -y swyftstack-mcp
Cursor

The AI code editor.

Add to ~/.cursor/mcp.json (or .cursor/mcp.json in your project)
{
  "mcpServers": {
    "swyftstack": {
      "command": "npx",
      "args": ["-y", "swyftstack-mcp"]
    }
  }
}
VS Code

GitHub Copilot agent mode / MCP.

Add to .vscode/mcp.json in your workspace
{
  "servers": {
    "swyftstack": {
      "command": "npx",
      "args": ["-y", "swyftstack-mcp"]
    }
  }
}
Windsurf

Codeium's agentic editor.

Add to ~/.codeium/windsurf/mcp_config.json
{
  "mcpServers": {
    "swyftstack": {
      "command": "npx",
      "args": ["-y", "swyftstack-mcp"]
    }
  }
}
Codex

OpenAI's coding agent CLI.

Add to ~/.codex/config.toml
[mcp_servers.swyftstack]
command = "npx"
args = ["-y", "swyftstack-mcp"]
Authentication

Two ways to connect

Device login (recommended)

Run the server with no key. On the first request it prints a code and opens your browser; sign in, approve the client (choosing Read only / Developer / Full access), and you're connected. New accounts start a free trial automatically.

API key (scripts & CI)

Create a key under Settings → API keys and set SWYFTSTACK_API_KEY in your MCP client config. Both paths use identical scopes and permissions.

Explicit API key (optional - env var takes precedence)
{
  "mcpServers": {
    "swyftstack": {
      "command": "npx",
      "args": ["-y", "swyftstack-mcp"],
      "env": { "SWYFTSTACK_API_KEY": "sk_live_…" }
    }
  }
}
Capabilities

What your AI can do

The MCP server mirrors the full Swyftstack API surface.

Databases

list, create, delete, restart, rotate password, connection string, SSL status

Import & export

import_database, list_imports, get_import_status, get_latest_export

Backups & recovery

list, create, restore, pin, recovery status, PITR restore request

Network & security

get/set IP allowlist, get/set RLS, get audit logs

Object storage

list buckets, create/delete bucket, list/upload/delete files

Account & billing

agent status, recommendations, usage, limits, billing, upgrade options

Connection

connect, connection_status, list_api_keys, logout

How to enable each feature

From the console, MCP, or API

Everything is manageable from all three. Pick whichever fits your workflow.

FeatureConsoleMCP (ask your AI)API
IP allow-listDatabase → Security → add IP/CIDR entries.Ask: "restrict db_… to 203.0.113.4". Tool: set_ip_allowlist.PUT /v1/databases/:id/allowlist { entries: ["203.0.113.4"] }
Row-Level Security (RLS)Database → Security → Row-Level Security → enable per table.Ask: "enable RLS on the orders table". Tool: set_rls.POST /v1/databases/:id/rls { table: "orders", enabled: true }
Manual backupDatabase → Backups → Create backup.Ask: "back up db_… now". Tool: create_backup.POST /v1/databases/:id/backups
PITR / recoveryDatabase → Backups → Point-in-time recovery.Ask: "what can I restore db_… to?" Tool: get_recovery_status.GET /v1/databases/:id/recovery
WAL archiving statusDatabase → Backups → continuous protection panel.Ask: "is WAL archiving on for db_…?" Tool: get_recovery_status.GET /v1/databases/:id/recovery (wal_archiving)
Import a databaseProject → Databases → Import from URL.Ask: "import postgres://… into my project". Tool: import_database.POST /v1/imports { project, name, source_url }
Example prompts

Just ask, in plain language

Create a Postgres database called production in my project and give me the connection string.

Import postgres://user:pass@old-host/db into a new database named migrated.

How much storage is my biggest database using, and am I close to any limits?

Back up the payments database now and tell me when it's done.

Restrict the analytics database to only my office IP 203.0.113.4.

Enable row-level security on the orders and invoices tables.

What can I restore my database to, and how far back does point-in-time recovery go?

How many days are left on my trial, and what would upgrading cost?

Security model

You're always in control

Scopes

Every key is limited to the scopes you approve: reads, writes, backups, account. A Read-only connection can never change anything.

Dangerous operations

Deleting a database, bucket or backup requires a key with destructive operations explicitly enabled - a separate opt-in on the approval screen.

Full audit trail

Every request is logged. Review exactly what each AI client did under Console → AI Activity.

Troubleshooting

Common questions

The browser didn't open automatically

Copy the URL and code the server printed to your terminal and open it manually, then approve the client.

“This API key is missing the required scope”

Your connection was created with a lower access level. Run the connect tool again and choose Developer or Full access, or create a key with the needed scopes under Settings → API keys.

“Not permitted to perform destructive operations”

Deletes require a key with destructive operations enabled. Re-connect and tick “Allow destructive deletes” on the approval screen.

I want to switch accounts or disconnect

Run the logout tool to remove the saved credential, then connect again. To fully revoke access, delete the key under Settings → API keys.

npx can't find the package

Make sure you have Node.js 18+ installed. The command is npx -y swyftstack-mcp (the -y auto-confirms the download).

Frequently asked questions

Do I need an API key to use the MCP server?

No. Point your AI client at `npx -y swyftstack-mcp` and the first request opens your browser to sign in (device login). A scoped key is minted for you and stored locally - you never copy or paste it. Scripts and CI can still set SWYFTSTACK_API_KEY explicitly.

Is it safe to let an AI manage my infrastructure?

Yes, by design. Every action goes through the same scoped REST API as the console. You choose the access level (Read only, Developer, Full access) when you connect, and destructive deletes require a separate opt-in. Everything is logged under AI Activity.

Which AI applications are supported?

Any MCP-compatible client. We document Cursor, Claude Code, VS Code, Windsurf and Codex, but the same npx command works anywhere MCP servers are supported.

Does the MCP server touch my database directly?

Never. It is a thin REST client - it holds no database credentials and only calls the public Swyftstack API, inheriting all scope, dangerous-operation and rate-limit checks server-side.

How do I disconnect an AI client?

Run the `logout` tool to delete the local credential, or revoke the key under Settings → API keys. You can review everything a client did under Console → AI Activity.

Does connecting cost anything?

No. Connecting is free and uses your existing plan or trial. New accounts start a free trial automatically; the MCP server never processes payments - it opens the billing page in your browser when you choose to upgrade.

Connect your AI in under a minute

One command. Browser sign-in. Then just ask.