McpBackend MCP Server and Agent Skill

The hosted MCP server gives your coding agent 16 authenticated tools for projects, API contracts, schemas, tables, row-level security, API keys, end-user auth, webhooks, usage, and team access. The open Agent Skill adds the operating playbook: inspect live state first, make the smallest change, choose permissions explicitly, keep secrets out of source control, and verify the result.

• MCP server

  The live control surface. It performs authorized operations against your McpBackend account through OAuth.

• Agent Skill

  The portable workflow. It tells a compatible agent how to plan, secure, and verify McpBackend changes.

The skill follows the open Agent Skills format and is published at github.com/mcpbackend/skills. Review the source, then install it with the skills CLI:

npx skills add https://github.com/mcpbackend/skills --skill mcpbackend

After installation, invoke it as $mcpbackend or ask for a task such as “create a secure McpBackend project for a client portal.” Compatible agents can also activate it automatically when the request matches its description.

Add the Streamable HTTP endpoint to your MCP client. The first connection opens McpBackend sign-in and consent in your browser.

{
  "mcpServers": {
    "mcpbackend": {
      "url": "https://mcp.mcpbackend.com/mcp"
    }
  }
}

For Claude Code, the equivalent command is:

claude mcp add --transport http mcpbackend https://mcp.mcpbackend.com/mcp

1. 1

   Clarify the app

   Establish entities, relationships, important queries, user authentication, access rules, and whether EU residency is required.

2. 2

   Inspect live state

   List projects and read the current schema before assuming what already exists.

3. 3

   Create the smallest schema

   Add intentional columns, relationships, uniqueness rules, and indexes for real query paths.

4. 4

   Set security explicitly

   Enable auth when needed and choose public, authenticated, or owner-only reads and writes for every table.

5. 5

   Issue scoped credentials

   Create least-privilege API keys only after access rules are settled and store one-time secrets outside source control.

6. 6

   Verify and hand off

   Read the schema again, check usage, and summarize the backend without exposing secrets.

• OAuth instead of pasted tokens

  The MCP client completes browser-based authorization and keeps its own credential.

• Live inspection before writes

  The agent reads projects and schema instead of relying on stale chat context.

• Least-privilege keys

  Per-table permissions are preferred over permanent full-account credentials.

• Explicit row access

  Public, authenticated, and owner modes are chosen from the application's actual user flows.

• One-time secrets stay secret

  API key and webhook secrets go to environment configuration, not commits or summaries.

• Human intent for team changes

  Invitations and access revocation are performed only when explicitly requested.