@baze-client/mcp-server

A Model Context Protocol server for Baze. It lets a coding agent like Claude Code, Cursor, Windsurf, anything that speaks MCP - read your schema, run SQL, deploy edge functions and read logs, using your credential and never more access than you have.

Quick start

Create a personal access token at dashboard.baze.ng/account, then:

npx @baze-client/mcp-server --access-token bzp_...

Claude Code

claude mcp add baze -- npx -y @baze-client/mcp-server --access-token bzp_...

Any client with a JSON config

{
  "mcpServers": {
    "baze": {
      "command": "npx",
      "args": ["-y", "@baze-client/mcp-server"],
      "env": { "BAZE_ACCESS_TOKEN": "bzp_..." }
    }
  }
}

Remote, with OAuth

No token to paste. Point a client that supports remote MCP servers at:

https://mcp.baze.ng/mcp

The client discovers the authorisation server, opens your browser, and you approve it on a consent screen that names the client and lists exactly what it is asking for. Revoke it later from Account → Connected applications.

Options

| Flag | Environment | Default | Meaning | | ---------------- | -------------------- | ------- | -------------------------------------------------------- | | --access-token | BAZE_ACCESS_TOKEN | - | Required for stdio. Starts with bzp_. | | --project | BAZE_PROJECT | - | Pin every tool to one project. | | --read-only | BAZE_READ_ONLY | off | Refuse writes. | | --features | BAZE_FEATURES | all | account,projects,database,functions,realtime,logs,keys | | --transport | BAZE_MCP_TRANSPORT | stdio | stdio or http. |

Tools

Tools are only advertised when your credential carries the scope they need, so the list you see depends on your token.

Account - baze_get_account, baze_get_project_keys

Projects - baze_list_projects, baze_get_project, baze_create_project, baze_pause_project, baze_resume_project

Database - baze_execute_sql, baze_list_tables, baze_list_extensions, baze_generate_typescript_types, baze_list_migrations, baze_apply_migration

Edge functions - baze_list_edge_functions, baze_get_edge_function, baze_list_edge_function_versions, baze_deploy_edge_function, baze_rollback_edge_function

Observability - baze_get_logs, baze_get_metrics, baze_list_realtime_tables, baze_set_realtime

Scopes

A token carries a scope set, chosen when you create it. Scopes narrow a token below your own role; they never widen it. A token carrying database:write held by someone who is a viewer in the organisation still cannot write, because your live role is re-resolved on every request.

| Scope | Grants | | ------------------------------------ | ------------------------------------------------- | | account:read | Your email and organisations | | projects:read / projects:write | List projects / create, pause, resume | | database:read / database:write | Read schema and query / run writes and migrations | | functions:read / functions:write | Read functions / deploy and roll back | | realtime:read / realtime:write | See published tables / change them | | logs:read, metrics:read | Logs, usage | | keys:read | Project URL and publishable key | | billing:read | Wallet and plan |

What no tool can do

Some things are absent on purpose, and no flag turns them on:

• Reveal your database password or service_role key. Both require an account password typed in the dashboard. A long-lived agent credential standing in for a freshly typed password would defeat the control entirely.
• Delete a project. Deletion needs a password and the project slug retyped.
• Mint or revoke tokens. A token that can mint tokens is a token whose revocation means nothing.
• Install a plugin. Installing grants a plugin standing database and network permissions inside your project. That is a consent decision, not an operation.

Security model

• This server holds no credentials. It forwards your bearer token to the control plane on every call and has exactly the access that token has.

• The control plane decides. Every permission check happens there, against your live role. This process makes no authorisation decisions, so a bug in it cannot grant access.

• Delegated tokens reach an explicit allowlist of endpoints. Anything not on it is refused, whatever scopes the token carries.