How to give Claude Code and Codex safe database access over MCP

To give Claude Code or Codex safe access to your data, expose it through an MCP endpoint that uses a revocable personal token tied to a limited user, and never hand the agent your database connection string. In Kanesh this takes three steps: set MCP_ENABLED=true, create a token for a user with a narrow role, and paste the endpoint into the agent’s config. The MCP tools are read-only.

Why not share the connection string

A database credential grants everything its role can do. It has no per-collection rules, and revoking it for one agent means rotating it for every service that uses it. An MCP endpoint in front of the data lets you set what the agent can see, and cut it off without touching anything else.

Step by step

1. Create a limited user

As the owner, add a member for the agent. Give them the Viewer role, or a custom role and policies that allow reading only the collections the agent needs. Kanesh supports up to 20 custom roles and 50 policies per workspace, plus per-collection CRUD overrides. See access control.

2. Turn on MCP

Start Kanesh with the variable set:

MCP_ENABLED=true

Open Settings → AI & MCP in Studio. It shows the workspace endpoint and configuration snippets for Codex and Claude Code.

3. Create a token

Sign in as the limited user and open Account → API tokens. The secret is shown once and stored only as a hash. Tokens expire and can be revoked. Keep the secret in an environment variable, not in a file in your repository:

export KANESH_TOKEN=...

4. Configure the agent

For Codex, add the endpoint to your MCP configuration:

[mcp_servers.kanesh]
url = "http://127.0.0.1:8080/api/v1/workspaces/WORKSPACE_ID/mcp"
bearer_token_env_var = "KANESH_TOKEN"

For Claude Code, copy the snippet from the same Studio page. Then ask the agent to call get_workspace_schema first and list_records second, to confirm it sees only the collections you intended.

What the agent can and cannot do

Can	Cannot
Read the collections and fields its token may read	Create, update or delete records through MCP
Read saved lookups and managed indexes	See collections outside the user’s role
Read bounded pages of records with filters and sort	Manage credentials or change passwords

Safety checklist

• Use a dedicated user and the narrowest role that works.
• Set a token lifetime, and revoke the token when the task ends.
• Keep the token in an environment variable, and out of version control.
• Put HTTPS in front of any endpoint that is not on localhost.
• Treat record contents as untrusted input. Text stored in a record can try to instruct an agent.
• Review any write yourself. Writes go through REST with the same token, so decide deliberately whether the agent gets that access at all.

FAQ

Which agents can I connect to Kanesh?

Codex and Claude Code. Studio shows ready configuration for both under Settings → AI & MCP, and they use the same workspace endpoint and personal token.

Can the agent change my data?

Not through MCP, because the three tools are read-only. The same token also works on the REST API, though, and it carries its owner’s permissions. If you only want reading everywhere, issue the token from a user with the Viewer role.

What if the token leaks?

Revoke it under Account → API tokens and create a new one. Tokens are stored as hashes and expire, so a leaked token has a limited lifetime. Because the token only has the limited user’s permissions, the exposure is bounded to what that user can read.

Next steps

Start with Getting started, then follow the MCP guide. To see how another platform with an MCP server compares, read Kanesh vs Directus.