@groveback/mcp

An MCP server that exposes the admin API of a running Groveback as tools, so an LLM (Claude Code, Claude Desktop, Cursor, Codex, …) can build your backend by conversation — create collections, schemas, policies, roles, functions/custom HTTP endpoints, users, and seed data.

It talks to your Groveback over its REST admin API using a project API key with admin scope. It imports no server internals and never touches the database directly.

Setup

1. In the dashboard (/dashboard), create a project and an API key with the admin scope. The full secret (shown once) looks like gb_sk_<projectId>.<secret>.
2. Add the server to your MCP client. stdio transport; the command is npx -y @groveback/mcp.

Claude Code

claude mcp add groveback \
  -e GROVEBACK_URL=http://localhost:8080 \
  -e GROVEBACK_API_KEY=gb_sk_<projectId>.<secret> \
  -- npx -y @groveback/mcp

Claude Desktop / Cursor / Windsurf / other clients — same mcpServers JSON shape:

{
  "mcpServers": {
    "groveback": {
      "command": "npx",
      "args": ["-y", "@groveback/mcp"],
      "env": {
        "GROVEBACK_URL": "http://localhost:8080",
        "GROVEBACK_API_KEY": "gb_sk_<projectId>.<secret>"
      }
    }
  }
}

Configuration (env)

| Variable | Required | Description | |---|---|---| | GROVEBACK_URL | yes | Base URL of your running Groveback, e.g. http://localhost:8080 | | GROVEBACK_API_KEY | yes | Admin-scoped key gb_sk_<projectId>.<secret> (carries the project id) | | GROVEBACK_MCP_READONLY | no | 1 to register only read tools (no mutations) |

Tools

Call get_guide first — it returns a cheatsheet for the permission-string format, the policy DSL ($auth.* placeholders), how a server-side admin key needs an admin policy rule for full access, the per-collection REST data API, native end-user auth (/api/v1/auth/*), the @groveback/sdk client and Swagger/OpenAPI URLs, the function trigger union, and the HTTP handler context. Then: collections/schemas/policies/indexes, roles (member + end-user), functions and custom HTTP endpoints, users, documents, API keys, OAuth providers, plan usage, and config export/import.

Destructive tools carry a destructiveHint annotation so clients can ask for confirmation. Control-plane operations (create/suspend projects, members) are out of scope — do those in the dashboard.

License

Apache-2.0