Skip to content
Manybases

MCP

One connector. The agent you already build with.

Thirty-seven tools, so your agent creates projects, tables, keys, functions and sites without you opening anything. Set it up where you already work.

Claude Code takes the command; Desktop and the web take the URL.

or Customize → Connectors → Add custom connector

Four lines in your Codex config.

~/.codex/config.toml

Paste into the raw MCP config.

MCP servers → View raw config

Add it as a chat connector.

Connectors → + → MCP server

Base44's Builder plan, and it runs while you build.

Settings → MCP connections → Add custom MCP

Any MCP client

The protocol is the integration. Paste the URL wherever your tool takes one.

the same thirty-seven tools, everywhere

Pick one. An account has a single live agent key — so exactly one agent in the world talks to it, and you always know which.

A URL, or a server on your machine.Both serve the same thirty-seven tools.

remote connector
https://mcp.manybases.com

A consent window opens on your dashboard, names the client, shows what the connector will and will not be able to do, and issues the key for you — there is nothing to copy.

mcp.json
{
  "mcpServers": {
    "manybases": {
      "command": "node",
      "args": ["/path/to/manybases-mcp/dist/index.js"],
      "env": { "MANYBASES_API_KEY": "<your ak_ key>" }
    }
  }
}

Or run the local server from any MCP client’s configuration with your own account key, scoped to every project or to one.

The line an agent does not cross.Twenty-eight tools on the key alone. Four that always need you.

A gesture whose effect is irreversible or reaches beyond what the call names — destroying data that cannot be rebuilt, exposing a table to everyone, handing out an access, redirecting every user of an app — confirms in two steps. When the consequence falls on someone other than the caller, it also needs a signed-in human.

Changing an app URL, deleting a project, deleting an end user and issuing a password-reset link are always yours. Four more gestures have no tool at all: setting a secret’s value, exporting a project, connecting a GitHub account, and issuing an active publishable key. They are not missing — they are the ones a value or an exposure passes through, so they never pass through an agent.

37 tools · 28 on the key alone · 4 always human · 5 conditionally

agent session
waiting for agent
  1. create projectisolated database
  2. define tablesschema + migrations
  3. set auth rulesproviders + policies
  4. deploy functionsserver-side handlers
  5. create bucketfile storage
  6. shiplive subdomain

What it will not do.On purpose, and worth knowing before you build on it.

  • One agent at a time. An account has a single live agent key, so you always know which agent is talking to it — and the remote connector revokes the key a local server was using.

  • The connector can never be lent your authority. Its login issues a key, not a session: the four human gestures are refused to it exactly as to a local agent.

  • Two-step confirmation protects from inattention and races, not from intent. A scripted loop that reads the summary and confirms passes.

Questions.Keys, clients, and what an agent may not do.

Not alone. Deleting a project, deleting an end user, issuing a password-reset link and changing an app URL always need a signed-in human on top of the key. Four more gestures have no tool at all: setting a secret’s value, exporting a project, connecting a GitHub account, and issuing an active publishable key.

A code, a message and a hint written for it to correct itself — the exact problem, the valid values, and the tool that helps. Every response also carries a request id that the project’s log shows.

Only if your tool cannot reach a remote connector, or you want to point the agent at a development API. The connector needs nothing but the URL, and it issues its own key through a consent window on your dashboard.

Next.The parts this one leans on.

Got another idea?

Give it a backend.