MCP server

Rowsafe's MCP server lets AI assistants read what the dashboard shows and, if you allow it, set Marks, run backups, Proof and checks, change production, or create Rowsafe Cloud servers. Changes run right away as the person who connected the agent, with that person's dashboard rights, or Rowsafe refuses them and says why (How AI agents act). Part of Guard.

ChatGPT, Claude, Cursor, VS Code, Codex or Windsurf: see Connect AI apps.

Set upCopy Anchor Link

# Read-only
claude mcp add rowsafe -- rowsafe mcp

# Read-only, plus Marks (what the Claude Code plugin uses)
claude mcp add rowsafe -- rowsafe mcp --allow-restore-points

# Also backups, Proof, checks, schedules, and changes to production as you
claude mcp add rowsafe -- rowsafe mcp --allow-writes

# A specific key instead of your login, in every project
claude mcp add --scope user rowsafe -e ROWSAFE_API_KEY=rsk_... -- rowsafe mcp

Sign in with Rowsafe (OAuth)Copy Anchor Link

The remote endpoint is an OAuth 2.1 protected resource per the MCP authorization spec (2026-07-28). Clients discover everything from the first 401: give them only the URL.

An owner or admin approves each app in the dashboard, for one organization; the app then acts as that person. Settings, Connected apps lists apps, who allowed them, whether they can act yet, and lets you disconnect them.

Safety modelCopy Anchor Link

• Same API as the CLI. Same key, checks, plan limits and audit log. Every change is in rowsafe audit, attributed to the key or app and the person it acts as.
• Only what the API can do. Tools queue fixed agent tasks and change schedules. Nothing runs commands or SQL on production or reads backup contents: Rowsafe can't.
• Changes to production run as the agent's person. Restores, rewinds, restarts, fixes, settings, updates, standbys, moves, pooling, security fixes, Rowsafe Cloud servers and the rest go through request_change (or create_cloud_server, cloud_firewall, apply_fix, create_app_database). Rowsafe checks the current role of the person behind the agent (who allowed the app, made the key, or approved the CLI login). Owner or admin: it makes the dashboard's own API call as them, at once, with the same checks, confirmations and Marks. Restarts still need root's permission at install. The tools never call those endpoints directly.
• Or Rowsafe refuses, and nothing changes. For example: a member's agent, a key made by another key, an app or key from before agents could act, no backup before a destructive change, a first payment only an owner can make, a server key to compare, over the agents' budget. The agent tells you the reason. Nothing waits for a person. Keys and assistants can't change what AI agents may do. When Rowsafe refuses.
• Read-only unless you say otherwise. rowsafe mcp registers read tools plus copy tools, which never touch production (preview_migration runs SQL on a fresh copy as a regular role; create_safe_copy makes masked copies only, within your plan). --allow-restore-points adds only create_restore_point. --allow-writes adds actions that don't touch production, request_change, create_cloud_server, cloud_firewall, apply_fix and create_app_database.
• No secrets through Rowsafe. People set passwords in the dashboard: new users, resets, restored copies, safe copies made through the remote endpoint. Exception, create_app_database: from local rowsafe mcp the password is made on your machine and only its verifier is sent; on the remote endpoint the person creates the database in the dashboard, where only their browser sees the password. Bucket keys and the passphrase never leave your server. Outputs are size-capped.
• Not exposed: enrollment tokens, API keys, removing hosts, members and roles, plan changes, agent update settings, what root allowed on a server.
• Annotations. Read tools are marked read-only. request_change, cloud_firewall, apply_fix, update_schedule (lower retention deletes old backups) and delete_safe_copy are marked destructive, so clients that confirm destructive calls ask you. Tool descriptions also tell agents to confirm disruptive, destructive or paid changes with you in chat first.

ToolsCopy Anchor Link

Read: always there. Marks: --allow-restore-points or Save Marks. Copies (never production): always for rowsafe mcp and API keys; signed-in apps need Act for you. Write: --allow-writes, a read-write key, or Act for you.

Is it safe? Marks and RewindCopy Anchor Link

Fleet, backups and tasksCopy Anchor Link

Pulse: health and monitoringCopy Anchor Link

Running the databaseCopy Anchor Link

Copies: never productionCopy Anchor Link

Actions that don't touch productionCopy Anchor Link

Rowsafe CloudCopy Anchor Link

An agent that needs a database for its app follows Need a database?: cloud_catalog, create_cloud_server (after you agree to the price), get_cloud_server, cloud_firewall if needed, then create_app_database.

Changes to productionCopy Anchor Link

The actions request_change can make:

• Paid. create_cloud_server, resize_cloud_server and clone_to_new_server record the size and price; the agent tells you first. A first payment is always an owner's: an owner's agent gets the checkout link, others are refused. delete_cloud_server is destructive: Rowsafe types the server's name for the agent and records it. Rowsafe Cloud changes.
• Extensions. manage_databases_users turning on vector, postgis or timescaledb installs the package first where root allowed PostgreSQL updates. timescaledb needs restart: true in params unless already loaded: Rowsafe saves a Mark, then restarts PostgreSQL once (apps disconnect for a few seconds); the agent tells you first. Extensions.
• Restart later. restart takes params.at: a time (RFC 3339, up to 30 days ahead) or "window" for a Rowsafe Cloud server's next maintenance window. Restart now or later.
• A lost server. restore_elsewhere restores a database whose server has been silent 10 minutes onto another server with the same storage and passphrase (name, host_id, and at or mark; neither: the latest point). retire_database then removes the old one (confirm: its name); its backups are kept. Server lost.
• A server's files. restore_server_files and undo_server_files_restore take host (hostname or ID) and confirm (its hostname). A server's own files.
• Always refused. create_standby, rebuild_standby, move_database and fork_database: a person compares the server's key in the dashboard or CLI. A destructive action with no backup yet (the agent can run_backup and retry). Where Proof runs is a dashboard setting agents can't change.
• Within a budget. create_cloud_server runs on the owner's behalf, plus create_app_database, cloud_firewall and clone_to_new_server on servers created this way; everything else runs as the agent's person. When Rowsafe refuses.

Two prompts: incident_triage checks the fleet, reads the evidence behind each problem, and proposes next steps without changing anything. fix_what_pulse_found lists a database's fixable findings, lets you pick, and files each with request_change.

TroubleshootingCopy Anchor Link

• "not logged in" in the client's MCP log: run rowsafe login, or set ROWSAFE_API_KEY in the server's environment.

• Tools missing: write tools, request_change and the change tools need --allow-writes; Marks need --allow-restore-points. Restart the client after changing flags. A signed-in app needs Act for you (and Save Marks); reconnect it to change that.

• forbidden (403): This API key is read-only.: the key can only read.

• "Rowsafe refused this change, and nothing changed": the reason follows (When Rowsafe refuses). If the app or key predates agents acting as their person, that person clicks Let it act as me in Settings → Connected apps (or Let agents using it act as me under API keys), or reconnects it.

• A new Rowsafe Cloud server isn't created yet: it waits for its first payment. An owner pays at the checkout link the agent gave.

• A 402 error: a plan limit is reached. get_org shows usage.

• Smoke test without a client:

  Copy Text

  printf '%s\n' \
    '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"0"}}}' \
    '{"jsonrpc":"2.0","method":"notifications/initialized"}' \
    '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' | (cat; sleep 2) | rowsafe mcp