Documentation
¶
Overview ¶
Package mcp implements a Model Context Protocol (MCP) server for Wadjet. This allows AI agents (Claude, Cursor, etc.) to discover tables, inspect schemas, and execute SQL queries against a Wadjet instance.
Transport: JSON-RPC 2.0 over stdio (stdin/stdout), for CLI integration with Claude Desktop/Code. There is deliberately no network transport — an HTTP+SSE server was removed because it accepted SQL with no authentication and no ABAC identity, which bypassed row/column security. If a network MCP endpoint is ever reintroduced it must authenticate every request and stamp an identity onto the context (see identity handling below) before reaching db.Query.
Security model: when the backing DB is opened with an AuthProvider, the MCP server is constructed with the identity that authenticated the operator launching it (see NewServerWithIdentity). That identity is stamped onto every request context so db.Query → EnforcePlanPolicies applies table/row/ column policies. Without a provider (dev/embedded, no policy to enforce) the server runs unauthenticated over a direct-to-store DB — the same access the operator already holds via the store credentials.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is an MCP server that exposes Wadjet tools to AI agents.
func NewServer ¶
NewServer creates a new MCP server backed by a Wadjet DB with no ABAC identity. Use this only for DBs opened WITHOUT an AuthProvider (dev/embedded) — there is no security policy to enforce. For a DB with an AuthProvider, use NewServerWithIdentity so queries run under an authenticated identity.
func NewServerWithIdentity ¶
NewServerWithIdentity creates an MCP server that runs every query under the given identity. When identity is non-nil, its ABAC subject is applied to all tool queries; when nil, the server behaves like NewServer.
func (*Server) ServeStdio ¶
ServeStdio runs the MCP server over stdin/stdout using JSON-RPC 2.0. This is the transport used by Claude Desktop and Claude Code. It blocks until the input stream is closed or ctx is cancelled.
Source Files