Best self-hosted backend for AI agents: a checklist

A good self-hosted backend for AI agents has a typed schema the agent can discover, bounded reads, permissions that tie the agent to a real user, and an MCP endpoint you can switch on and off. Kanesh offers that in one small container: an opt-in, read-only MCP endpoint per workspace that uses personal API tokens. It is new, at its first stable release, and writes go through REST, not MCP.

What agents need from a backend

Agents differ from people in one way that matters: they run fast and they follow instructions found in data. A backend for them should limit damage by design.

• A schema to discover. The agent should list collections and fields before it queries, not guess table names.
• Bounded reads. Every query returns a limited page, with filters and sort, so one call cannot dump a database.
• Inherited permissions. The agent acts with a user’s rights and never more.
• Revocable credentials. Tokens are hashed at rest, expire and can be revoked.
• A separate write path. Reading and writing should not share one switch.
• Quiet logs. Request logs should not store record bodies or credentials.

How Kanesh handles each point

Start Kanesh with MCP_ENABLED=true. Each workspace then exposes one MCP endpoint, and Studio shows ready configuration for Codex and Claude Code. The endpoint offers three read-only tools:

Tool	What it returns
get_workspace_schema	Collections and fields the token may read
get_schema_model	Saved lookups and managed indexes
list_records	A bounded page of records, with filters and sort

Agents authenticate with a personal API token. It is stored as a hash, expires and can be revoked, and it carries the permissions of the user who created it. Those permissions come from the same roles and per-collection overrides that apply in Studio and REST, so an agent never sees more than its owner. Logs exclude request bodies and credentials, and tokens are never accepted in query strings.

Writes use REST with the same token. The OpenAPI 3.1 export, generated from the live schema, tells the agent which endpoints exist. You decide in your own code or review step when an agent may write. See the MCP guide for setup.

A checklist you can reuse

Question	Kanesh today
Is MCP built in?	Yes, opt-in with MCP_ENABLED=true
How many endpoints?	One per workspace
Can the agent write over MCP?	No, read-only tools
Whose permissions apply?	The token owner’s
How are tokens stored?	Hashed, expiring, revocable
How mature is it?	New, first stable release

Other platforms also cover agents. Directus, for example, has a native MCP server and an AI assistant, and it is a mature platform. Compare what each one lets an agent do before you pick.

What is not there yet

There are no MCP write tools. There is no OAuth or SSO, no realtime, no workflows, no hooks and no SDKs, and OAuth or SSO, realtime and workflows are on the roadmap. Scoped or read-only API keys are not available, so an agent token has the full rights of its owner. The practical workaround is to create a dedicated user with the Viewer role, or a custom role, and issue the agent’s token from that account.

FAQ

What is MCP?

MCP, the Model Context Protocol, is a protocol that lets AI tools call functions and read data from an external server. A backend that speaks MCP lets an assistant query your data without custom glue code.

Can an agent write data through Kanesh’s MCP endpoint?

No. The MCP tools are read-only today. An agent that needs to create collections or records can call the REST API with the same token, within that token owner’s permissions.

Can an agent see more than I can?

No. The token acts as the user who created it, with the same roles and per-collection rules. Create a separate user with a narrow role if you want the agent to see less than you do.

Next steps

Follow Getting started, connect an agent with the MCP guide, or see the agent data use case. To compare against a platform with its own MCP server, read Kanesh vs Directus.