23. MCP Server

Alex wants their AI assistant to actually do things in LexVault — list users, run a SELECT, rotate a Vault secret — not just read schema docs.

The configs in section 22 teach an AI assistant about your project. The MCP server lets it operate on your project. Eurobase ships a hosted Model Context Protocol server at https://mcp.eurobase.app/mcp that exposes the platform API as tool calls.

What it can do

Projects — list and inspect your Eurobase projects
Database — list tables, describe schema, run SQL, create tables
Auth — list end-users registered in a project
Storage — list files, generate signed download URLs
Vault — list, get, and set encrypted secrets
Functions — list and invoke edge functions

Authentication: Personal Access Tokens

The MCP server authenticates Bearer-style with a Personal Access Token (PAT). Mint one in Account → Personal Access Tokens: name it ("my laptop", "ci-prod"), optionally set an expiry, and copy the plaintext token (shown once on creation).

PATs are deliberately scoped down from a full console login:

  • Authenticate as you across every project you own or are a member of — full SDK + platform-API surface.
  • Never carry superadmin rights, even if the underlying account has them. The platform admin endpoints (allowlist, cross-tenant project list) are unreachable via PAT.
  • Cannot mint other tokens — sign in to the console for that. Limits the blast radius of a leaked PAT.
  • Cannot change passwords or delete the account.

Revoke a PAT any time from the same screen. Tokens are stored as SHA-256 hashes — the plaintext exists only on your machine after creation.

Setup

The Connect page generates the right snippet for each IDE (Claude Code, Codex, Cursor, Windsurf). For Claude Code the one-liner is:

export EUROBASE_PAT=eb_pat_...   # from Account → Personal Access Tokens
claude mcp add --transport http eurobase https://mcp.eurobase.app/mcp \
  --header "Authorization: Bearer $EUROBASE_PAT"

After this, Alex can ask Claude Code things like "how many active LexVault users signed up this week?" and it will run the SELECT itself.

Sovereignty

The MCP server runs in the same Scaleway Paris cluster as the rest of the platform. Tool calls never leave EU infrastructure — the only data that traverses your AI vendor is whatever the model itself sees in the conversation.