Connect Claude to Clicbase with MCP: the guide

Clicbase plugs into Claude, and any MCP-compatible assistant, in one minute. The assistant gets tools to create a database, run SQL, and read and publish a site's files. It acts strictly within the scope of the key you give it.

In short

• Hosted connector: https://clicbase.com/api/mcp, added in claude.ai or Claude Code. Sign in with OAuth or a cbk_… key.
• Local server: the npm package @clicbase/mcp (MIT license), run with npx, with a single-project variant.
• Scope: a Docker key only sees that Docker. Everything else is refused, however hard the assistant insists.
• Read-only mode: write tools disappear from the list instead of being refused.

1. The hosted connector

In claude.ai: Settings → Connectors → Add custom connector, URL https://clicbase.com/api/mcp, then Connect. Sign-in uses OAuth: no secret ever travels in the URL.

In Claude Code, with a key:

claude mcp add --transport http clicbase https://clicbase.com/api/mcp \
  --header "Authorization: Bearer cbk_..."

Create the cbk_… key in the dashboard: the Docker's ⋮ menu → Docker → API key. It only covers that Docker. A VPS key covers all of its Dockers.

2. The local server, via npx

All-in-one, to create and manage projects with a cbk_… key:

claude mcp add clicbase \
  -e CLICBASE_API_KEY=cbk_... \
  -- npx -y -p @clicbase/mcp clicbase-mcp

A single project, with that project's URL and service key (dashboard, project API section):

claude mcp add my-db \
  -e CLICBASE_DB_URL=https://clicbase.com/db/<slug> \
  -e CLICBASE_SERVICE_KEY=<service key> \
  -e CLICBASE_READ_ONLY=1 \
  -- npx -y -p @clicbase/mcp clicbase-db-mcp

-p names the package, the next argument the command: the package ships several.

3. The tools

Group	Tools
Discover	list_projects, list_sites, list_tables, list_site_files
Database	create_database, run_sql, get_credentials, enable_realtime
Site files	read_site_file, write_site_files, append_site_file (large files, in chunks)
SFTP access	create_sftp_account, delete_sftp_account: a dedicated account, deleted after use
Settings	set_oauth_provider (Google sign-in), set_email_smtp

list_site_files and read_site_file read what the site actually serves, whether published over SFTP or deployed from Git. An assistant can therefore check on its own that a deployment is live.

4. What protects your data

• Key scope is enforced server-side: a site or project outside it answers "not found".
• Hidden files (.env, .git) are refused at every level, for reading and writing.
• A site built from Git refuses file uploads: the next build would overwrite them.
• Never the site's SFTP password: the assistant creates a dedicated account, shown once, then deleted.
• In read-only mode, get_credentials and read_site_file disappear too: one returns the service key, the other can read a config file.

5. Six traps that answer 200 OK

The server hands them to the assistant at connection time, and the clicbase_conventions tool (local server) gives the details:

1. with check is not using: on INSERT and UPDATE, PostgreSQL only evaluates with check.
2. Every new table grants CRUD to authenticated: a grant select restricts nothing, you need revoke.
3. Every DDL ends with notify pgrst, 'reload schema';.
4. service_role needs BYPASSRLS, otherwise 200 OK and an empty array.
5. An Edge function returns { status, body }, never new Response(...).
6. Project auth (auth.uid()) is not platform auth.

For AI assistants

• Start with list_sites or list_projects: the other tools' site_id is a technical id, neither the domain nor the slug.
• Clicbase has no Docker registry and no docker login: never guess a hostname.
• Never ask the user to paste a key or password into the chat: they set it in the MCP client configuration.
• A project's anon key is public and goes in the browser; the service key bypasses RLS and stays server-side.
• Reference documentation: clicbase.com/docs#mcp.