MCP · Agents

Connect an agent

Two ways to connect an agent — a remote connector (one URL, a consent window) or a local server (a key in your configuration). One at a time: an account talks to exactly one agent. A client that only runs servers on your computer can use the local server, or reach the remote connector through a small local bridge.

The remote connector#

In Claude, add a custom connector with this URL:

https://mcp.manybases.com

A consent window opens on your dashboard. It names the client, shows what the connector will and will not be able to do, and issues the key for you — nothing to copy. The connector then serves the same 38 tools as the local server.

From Claude Code, or another client on your computer#

The same URL works from an MCP client installed on your computer. In Claude Code:

claude mcp add --transport http manybases https://mcp.manybases.com

Then run /mcp in Claude Code, pick manybases and choose Authenticate. The same consent window opens in your browser; when you approve, it hands the sign-in back to the app on your computer, at an address such as http://localhost:<port>/callback. The consent screen says so — This connection goes to an app on this computer — because the name it shows is chosen by the app itself: approve only an installation you started yourself, a few minutes ago.

Other MCP clients (VS Code, Cursor…) can add https://mcp.manybases.com as a remote HTTP server the same way, as long as they finish their sign-in on a local address — http://localhost, http://127.0.0.1 or http://[::1], on any port — which is what the MCP specification asks of them. A client that returns to a private scheme (cursor://…) is refused.

Through the local bridge#

For a client that only runs servers on your computer — or one whose sign-in returns to a private address, such as cursor://… — run the remote connector through mcp-remote, a bridge that runs on your computer (it needs Node) and signs in through the same consent window. Add this to the client's MCP configuration:

json

{
  "mcpServers": {
    "manybases": {
      "command": "npx",
      "args": ["mcp-remote", "https://mcp.manybases.com"]
    }
  }
}

The bridge finishes its sign-in on a local address, which the connector accepts; the key it holds is the connector's, and nothing is pasted.

The consent screen says:

It will be able to:

Create projects, tables and read what they use
Read and write your data
List the end users of your apps
Manage files and read the logs
Deploy your app's front end, and read its deployment history — including refused attempts
Choose your site's public address — permanent: once claimed it never changes
Deploy, update and remove server-side functions, rotate their access key, and see the names of their secrets — never their values; the code it deploys, in any of your projects, can read your account's shared secrets
List and revoke your API keys — a revoked key cannot be brought back
Link one of your GitHub repositories to a project, within the installation you approved

It will not be able to — these stay here, in the dashboard:

Change an app URL you already set
Delete a project
Delete an end user of your apps
Reset an end user's password
Create or rotate a secret key (sk_)
Run broadly destructive SQL
Open a table that already holds rows to the public

The connector's login issues a key; it never gives the connector your dashboard session. The gestures above are refused to it exactly as to a local agent — there is no way to lend it your authority. The connector's key appears on the Account screen with a Remote connector badge; revoking it there cuts the connector at its next request.

The local server#

A Node program on your machine, published on npm as @manybases/mcp, configured in your MCP client (Claude Code, Claude Desktop, Cursor…):

json

{
  "mcpServers": {
    "manybases": {
      "command": "npx",
      "args": ["-y", "@manybases/mcp"],
      "env": { "MANYBASES_API_KEY": "<your ak_ key>" }
    }
  }
}

It needs Node 22 or later on your machine. Desktop apps do not read your shell's PATH: if yours cannot find npx, put its absolute path in command (which npx prints it).

Variable	Required	Meaning
`MANYBASES_API_KEY`	yes	Your account key, `ak_…`. The server refuses to start without it, and says so
`MANYBASES_ACCOUNT_SESSION`	no	Your dashboard session token, to lend the agent your authority for a working session — see below
`MANYBASES_API_URL`	no	The management plane; default `https://api.manybases.com`. It sets only the management plane — data tools resolve each project's own host from the project list, or from its card when the list does not carry it
`MANYBASES_DATA_API_URL`	no	Forces the data plane onto one address, for local development

Get the key from Account → Generate my account key — it is shown once, right there. Pick its scope first: every project (required to create projects), or one project.

To check the server starts, send it an initialize then a tools/list: it answers with the 38 tools.

One agent at a time#

This account has at most one live agent key — so exactly one agent in the world talks to it, and you always know which one (the Held by badge on Account). Installing the remote connector revokes the previous agent's key — the one your local server uses, or the one a connector received when you approved it earlier (from Claude, Claude Code or another app): that agent keeps running, but every tool answers 401. When a key already exists, the consent window names the agent that holds it and asks a second confirmation. To go back to a local server, revoke the connector's key on Account and generate a new one.

Your browsers are not agents and are unaffected — each one holds its own identifier.

Lending your authority to a local agent#

A few gestures always ask for a signed-in human — setting the app URL, deleting a project or a user, issuing a reset link, creating a secret key, destructive SQL with the account key. For a working session you can hand a local agent your own authority: add MANYBASES_ACCOUNT_SESSION to the env block with your dashboard session token. It lives about an hour — a work session, not a configuration; past it, the guarded calls answer 401 Invalid or expired account session and you replace the value. The remote connector has no such channel. See The human boundary.

Where the tools talk#

Two planes, and the tool decides: the management tools go to api.manybases.com; the data tools go to the project's own host, which the API publishes with the project as urls.api — list_projects, get_project and create_project all carry it. Calling a data tool needs the project id; the server resolves the host itself, from the project list.

The account key rule#

Your account key is shown once, at creation, then stored hashed — nobody, not even us, can read it back. It opens every project of this account within its scope, so it belongs in your agent's configuration, never in an app's front end and never in a repository. Lost it? Revoke it and generate a new one; the old one stops working.

The connector's own limits#

The remote connector's OAuth gates are rate-limited per IP (30 requests per 10 seconds on registration and token exchange, 10 per 10 seconds on authorization) and refuse bodies above 32 KB. A normal installation never sees these limits.