MCP server

Let Claude Code and other AI tools work on your DontCode project directly: sign in from the terminal, query and update your database, run migrations, and manage files. All through the same v1 gateway.

6 min read

MCP

What this is

The DontCode Backend MCP server is a small local program that exposes your project to an AI agent as a set of tools. It is published in the dontcode package and runs over stdio, so Claude Code launches it for you; nothing is hosted on your side.

Every tool is a thin call onto the v1 gateway. The agent can only do what the gateway allows, and when you sign in through the browser, only what your role on the project allows.

New to DontCode? The full product documentation lives at dontcode.co/docs

Setup

Add the server to your tool. In Claude Code, put this in .mcp.json at your project root (or run claude mcp add). No API key is needed here; you sign in through the browser on first use.

{
  "mcpServers": {
    "dontcode": {
      "command": "npx",
      "args": ["-y", "dontcode", "mcp"]
    }
  }
}

To point at a staging gateway, set DONTCODE_API_URL. For non-interactive use (CI, scripts), set DONTCODE_API_KEY to a dc_ project key and skip the browser sign-in entirely.

Signing in

The first time the agent needs access, ask it to sign in. It calls the auth_login tool, which prints a URL and a short code and opens your browser.

The agent calls auth_login. A verification URL and a short code appear.
You open the URL (already signed in to DontCode), confirm the code matches, and choose the project to connect.
You approve. The browser hands a short-lived, project-scoped token back to the terminal; the agent calls auth_wait to pick it up.
The token is cached locally (in ~/.dontcode) and reused until it expires, then you sign in again.

The token is bound to your user account on the server side, so it cannot be forged. The gateway checks your project role on every request, and revoking your membership revokes the token at once.

Tools

Tool	What it does
auth_login / auth_wait	Sign in through the browser and pick up the token.
auth_status	Show the current project, your role, and what you can do.
auth_logout	Forget the cached token.
db_query	Read rows: find, findFirst, count, with where / select / orderBy.
db_insert	Insert one row.
db_update	Update rows matching a where clause.
db_delete	Delete rows matching a where clause.
db_migrate	Apply schema DDL (create / alter / drop table, indexes).
storage_list	List files in a bucket.
storage_get_url	Get a public URL for a file.
storage_temporary_url	Get a short-lived signed URL.
storage_upload	Upload text content to a path.
storage_remove	Delete files.
storage_move	Move or rename a file.

Writes and deletes are marked so the agent confirms with you before changing anything.

Roles and permissions

When you sign in by browser, the token carries your project role. The gateway enforces it per request, so the agent can never do more than you can.

Role	Can do
viewer	Read data, list and read files.
editor	Everything viewer can, plus insert, update, delete, and upload.
admin / owner	Everything editor can, plus schema migrations.

A dc_ project API key (the non-interactive path) is project-scoped with full access, the same as the rest of the v1 gateway.

Good to know

The browser token is short-lived and stored only on your machine, never printed by the agent.
The MCP server talks only to the v1 gateway over HTTPS; it has no special access of its own.
You can sign out anytime with the auth_logout tool or npx dontcode logout.
Run dontcode status to check which project and role a cached session has.