MCP server
Connect Claude Code, Claude Desktop and other MCP clients to Rowsafe. Every tool, the safety model and setup.
Rowsafe speaks the Model Context Protocol. AI assistants can check your fleet ("is everything backed up?", "why did this alert fire?") and, when you allow it, create restore points or queue backups and drills.
| Transport | Credentials | Write tools | |
|---|---|---|---|
rowsafe mcp | stdio, on your machine | The CLI's login, or ROWSAFE_API_KEY | Off by default. --allow-restore-points or --allow-writes. |
https://api.rowsafe.sh/mcp | Streamable HTTP | Authorization: Bearer rsk_... | Always listed. A read-only key can't use them. |
For the safety-net workflow with coding agents, see Use Rowsafe with AI agents.
Set up
Log in with the CLI first (rowsafe login), then pick a mode:
# Read-only
claude mcp add rowsafe -- rowsafe mcp
# Read-only, plus restore points (what the Claude Code plugin uses)
claude mcp add rowsafe -- rowsafe mcp --allow-restore-points
# Everything: backups, drills, verification, adoption, schedules
claude mcp add rowsafe -- rowsafe mcp --allow-writes
# A specific key instead of your login, in every project
claude mcp add --scope user rowsafe -e ROWSAFE_API_KEY=rsk_... -- rowsafe mcp--scope project writes .mcp.json into your repository for everyone: don't put a key in it. Use the stdio form (each developer's own login) there.
Safety model
- Everything goes through the Rowsafe API, with the same API key, checks, plan limits and audit log as the CLI. Every change a tool makes is in
rowsafe audit, attributed to the key. - Tools can only do what the API can do. They queue the fixed agent tasks and change schedules. Nothing runs commands or SQL, restarts PostgreSQL, restores a backup or reads backup contents: Rowsafe can't do those at all.
- Read-only unless you say otherwise.
rowsafe mcpregisters read tools only.--allow-restore-pointsadds onlycreate_restore_point.--allow-writesadds every write tool. - Not exposed at all: enrollment tokens, API keys, removing hosts or databases, plan changes, and agent update settings.
apply_adoptionneeds your approval. It refuses unlessconfirmis the database's exact name and a read-only plan succeeded. Its description tells the model to show you the plan and ask first, and never to passforceunless you asked.- Annotations. Read tools are marked read-only.
apply_adoptionandupdate_schedule(lowering retention deletes old backups) are marked destructive, so clients that confirm destructive calls will ask you. - No secrets in output. Bucket keys and the passphrase never leave your server. Outputs are capped in size.
Tools
| Tool | Access | What it does |
|---|---|---|
fleet_health | read | Every problem in the fleet, worst first, each with the next step. |
get_org | read | Plan, limits and usage. |
list_hosts | read | Hosts, online or not, agent version, update channel and state. |
list_databases | read | Databases with a health summary. |
get_database | read | One database in depth: settings, schedules, WAL, recent backups, drills, tasks and problems. |
list_backups | read | Backups, newest first. |
list_drills | read | Restore drills with failures and warnings. |
list_tasks | read | Tasks, filtered by database, status and type. |
get_task | read | One task with its result, the end of its log and the next step. |
safety_check | read | Is the database protected right now? |
list_restore_points | read | Restore points with their status and the backup to restore from. |
create_restore_point | restore points | Mark this moment by name, and wait until it is in your bucket. |
plan_adoption | write | Register a database on a host and produce a read-only plan, or plan again. |
apply_adoption | write, destructive | Apply the plan. Needs confirm: "<database name>". |
verify_database | write | Prove WAL reaches the bucket; activates the schedules. |
run_backup | write | Queue a full, diff or incr backup. |
run_drill | write | Queue a restore drill. |
update_schedule | write, destructive | Change the schedules (UTC cron) and retention_full. |
There is also one prompt, incident_triage: check the fleet, read the evidence behind each problem, and propose next steps without changing anything.
Troubleshooting
-
"not logged in" in the client's MCP log: run
rowsafe login, or setROWSAFE_API_KEYin the server's environment. -
Tools missing: write tools only appear with
--allow-writes, restore points with--allow-restore-points. Restart the client after changing flags. -
forbidden (403): This API key is read-only.: the key can only read. -
A 402 error: a plan limit is reached.
get_orgshows your usage. -
Smoke test without a client:
printf '%s\n' \ '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"0"}}}' \ '{"jsonrpc":"2.0","method":"notifications/initialized"}' \ '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' | (cat; sleep 2) | rowsafe mcp