Eurobase
Sign in Get started

23. MCP Server

Alex wants their AI assistant to actually do things in LexVault — list users, run a SELECT, rotate a Vault secret — not just read schema docs.

The configs in section 22 teach an AI assistant about your project. The MCP server lets it operate on your project. Eurobase ships a hosted Model Context Protocol server at https://mcp.eurobase.app/mcp that exposes the platform API as tool calls.

What it can do

Projects — list and inspect your Eurobase projects
Database — list tables, describe schema, run SQL, create tables; list database (RPC) functions and read their definitions
Auth — list end-users registered in a project
Storage — list files, generate signed download URLs
Vault — list, get, and set encrypted secrets
Functions — list, read, deploy (create or update), invoke, roll back and delete edge functions; read their logs

Authentication: Personal Access Tokens

The MCP server authenticates Bearer-style with a Personal Access Token (PAT). Create one in Account → Personal Access Tokens: pick the project and the access the tool needs, and copy the token (shown once; it starts with eb_ptk_).

A token works for one project and does there exactly what a member with its access level does in the console — never more than your own role:

  • Read-only — list and describe tables, list views, sequences and types (listSchemaObjects), read rows with filters and counts (queryTable), list and read files (downloadFile). No SQL, no changes. The default, and enough for questions like "how many users signed up this week?".
  • Developer — also SQL (reads and writes), creating and changing tables, deploying and invoking functions, signed URLs. What an AI app builder such as Lovable needs to change your schema.
  • Admin — also secrets (Vault), end users and API keys. Project settings (auth providers, CORS, redirect URLs) stay in the console.

Tokens never reach your other projects, organizations, billing or account settings, never carry superadmin rights, and can't create other tokens. A refusal says the token lacks access, and for a Read-only token that a Developer token would do. Older all projects tokens (eb_pat_) still work, read-only for SQL through MCP — replace them with project tokens.

Revoke a PAT any time from the same screen. Tokens are stored as SHA-256 hashes — the plaintext exists only on your machine after creation.

Setup

The Connect page generates the right snippet for each IDE (Claude Code, Codex, Cursor, Windsurf). For Claude Code the one-liner is:

export EUROBASE_PAT=eb_ptk_...   # from Account → Personal Access Tokens
claude mcp add --transport http eurobase https://mcp.eurobase.app/mcp \
  --header "Authorization: Bearer $EUROBASE_PAT"

For Codex, the ~/.codex/config.toml entry reads the token from the same variable with bearer_token_env_var = "EUROBASE_PAT" — Codex ignores a headers key, so a config written that way connects without a token.

After this, Alex can ask Claude Code things like "how many active LexVault users signed up this week?" and it will run the SELECT itself.

Sovereignty

The MCP server runs in the same Scaleway Paris cluster as the rest of the platform. Tool calls never leave EU infrastructure — the only data that traverses your AI vendor is whatever the model itself sees in the conversation.

Next: Your Account →