RELATED 01
Instant MCP
OFFICIAL SERVERQuery, write and manage the schema and permissions of InstantDB apps from an AI editor
11kGitHub stars
82/wknpm downloads
40popularity score
Nhost Backend MCP Server
Exposes an Nhost project's GraphQL API to the end users' own AI assistants, under their own permissions
Official · Nhost Go Local · Streamable HTTP DatabasesDeveloper tools
28 popularity score ★ 9.4k ⇣ 1.6k pulls
Connect your client
Local (once it is running)
Add in one click
Opens the app, which asks before it adds the server.
Or add it by command or config
Claude CodeTerminal
claude mcp add --transport http nhost-backend http://localhost:3000/Cursor~/.cursor/mcp.json
{
"mcpServers": {
"nhost-backend": {
"url": "http://localhost:3000/"
}
}
}VS Code.vscode/mcp.json
{
"servers": {
"nhost-backend": {
"type": "http",
"url": "http://localhost:3000/"
}
}
}Codex~/.codex/config.toml
[mcp_servers.nhost-backend]
url = "http://localhost:3000/"Gemini CLITerminal
gemini mcp add --scope user --transport http nhost-backend http://localhost:3000/Settings 11
MCP_GRAPHQL_ENDPOINT |
Required: GraphQL endpoint requests are forwarded to, e.g. http://hasura-service:8080/v1/graphql on Nhost Run. |
|---|---|
MCP_AUTH_URL |
Required: Nhost Auth URL used as OAuth2 server and for JWKS validation, e.g. https://SUBDOMAIN.auth.REGION.nhost.run/v1. |
MCP_REALM |
Optional: Public URL of the deployed server, reported in the WWW-Authenticate header. |
MCP_ENFORCE_ROLE |
Optional: Accept only tokens whose default Hasura role matches this value; others get 403. |
MCP_INSTRUCTIONS |
Optional: Server-level instructions about your app, sent to the client on connect. |
MCP_QUERY_INSTRUCTIONS |
Optional: Replaces the description of the graphql-query tool. |
MCP_MUTATION_INSTRUCTIONS |
Optional: Replaces the description of the graphql-mutation tool. |
MCP_SCHEMA_INSTRUCTIONS |
Optional: Replaces the description of the get-schema tool. |
MCP_LISTEN_ADDR |
Optional: HTTP listen address; :3000 by default. |
MCP_BROWSER_HTML |
Optional: HTML page served when a browser opens the service URL (from 0.2.0). |
MCP_DEBUG |
Optional: Turns on debug logging; false by default. |
What it does
Nhost's Backend MCP Server is a small Go service that a developer deploys next to an Nhost project so that the app's users can query and change their data from an MCP client such as Claude or Cursor. It is not a tool for the developer: each user signs in through the project's own Nhost Auth (OAuth2 with PKCE), the server checks the resulting JWT against the project's JWKS, and every GraphQL request is forwarded with that user's token, so Hasura's row- and column-level permissions decide what comes back.
Instead of one tool per table, it offers three generic tools: one to look at the GraphQL schema, one for queries and one for mutations. When it starts, it fetches a summary of the schema and adds it to the instructions the client receives. Operators can add their own app-specific instructions, replace each tool's description, and pin access to a single Hasura role (for example a read-only user_mcp role) with MCP_ENFORCE_ROLE; tokens whose default role differs get 403 Forbidden.
It ships as the nhost/mcp container image and speaks streamable HTTP on port 3000, usually deployed as an Nhost Run service. The deployment docs and README still pin nhost/mcp:0.1.0 in their examples, while the service changelog lists 0.2.0 (June 2026, adds a configurable landing page for browsers, MCP_BROWSER_HTML) and 0.3.0 (September 2026, adds an unauthenticated /healthz endpoint for probes); the docs themselves say to check the releases page and update the tag. Nhost also has a separate CLI MCP server (nhost mcp start) for developers managing a project with admin rights.
What it needs
An Nhost project (cloud or local via the Nhost CLI) with a Hasura GraphQL API, and Nhost Auth set up as an OAuth2 provider with a consent page and Client ID Metadata Document (CIMD) support enabled. A place to run the nhost/mcp container, typically Nhost Run (one-click install or a run-mcp.toml deployed with nhost run config-deploy; locally with nhost up --run-service run-mcp.toml), reachable at a public URL. An MCP client that supports remote HTTP servers and OAuth2 discovery.
Limits
Only HTTP: clients that run local stdio servers only, or that lack the MCP OAuth2 discovery flow, cannot connect. GraphQL subscriptions are not supported. graphql-query rejects mutations and graphql-mutation rejects queries. It cannot see anything the signed-in user's role cannot see in Hasura, and it does not manage the project itself (schema, settings, deployments). Doc and README examples pin image tag 0.1.0, which lacks the browser landing page (0.2.0) and /healthz (0.3.0); set a current tag.
Who it suits
Suits teams already building on Nhost who want to give their own app's users an assistant interface to their data without writing per-operation tools, and who are ready to set up OAuth2, CIMD and a consent page and to design a least-privilege Hasura role. It is not for a developer who wants an assistant to build or administer an Nhost project: Nhost's docs point to its CLI MCP server (nhost mcp start) for that. It also does not fit teams not on Nhost/Hasura, or users whose client cannot do remote OAuth2 servers.
Tools 3
get-schema- Lists the available GraphQL operations, or returns the SDL for chosen queries and mutations
graphql-query- Runs a read-only GraphQL query as the signed-in user; mutations are refused
graphql-mutation- Runs a GraphQL mutation to insert, update or delete data as the signed-in user; queries are refused