MCP for AI Coding Agents

daam-cli ships a Model Context Protocol (MCP) server that lets AI coding agents like Claude Code request time-limited database access through the same admin-approved workflow you use yourself. The AI cannot bypass admin approval, cannot run SQL through MCP, and never sees database credentials. It asks for access, an admin reviews it, and once approved the AI connects to a local Postgres port through your existing tunnel.

How It Works

The MCP server is an access broker, not a SQL execution engine. The AI calls MCP tools to discover databases, file an access request with a justification, poll for approval, and get a localhost connection string. Once approved, the AI runs SQL through its own Bash/psql tooling against that local port. Every query continues to flow through the daam-agent, picking up masking, row filters, and audit unchanged.

• Admin approval is still the only gate. Filing a request via MCP does not grant access: an admin still approves, modifies, or denies it.
• The MCP server acts as you. It loads your existing OAuth credentials from the CLI credential store and files requests on your behalf. There is no separate AI service identity.
• Read-only by convention. Tool descriptions nudge the AI toward narrow investigative reads. Admins can still approve write grants for genuine emergencies: the control plane does not server-side reject them.
• Every request is marked. AI-filed requests carry an origin = "mcp" stamp so admins, emails, webhooks, and audit logs can distinguish them.

Requirements

• An org with the Access Requests feature (Pro or Enterprise plan). MCP rides the same plan gate as console-filed access requests.
• An AI client that speaks MCP over stdio. daam-cli mcp install writes the config for Claude Code automatically in v1; any other MCP client (Cursor, Continue, etc.) can use --print to copy the JSON snippet manually.
• Linux or macOS. Windows is not supported in v1.
• A daam-cli login on the profile you want the AI to use. Install does not log you in, so run daam-cli login first if you haven't already.

Install

Run the install command to register the MCP server with your AI client's config file:

$ daam-cli mcp install
  ✓ Installed daam MCP for Claude Code (profile: <default>, entry: daam)
    Restart Claude Code to use.
    Config: /home/<user>/.config/Claude/claude_desktop_config.json

On macOS the config lives at ~/Library/Application Support/Claude/claude_desktop_config.json. The command is idempotent: re-running it with the same arguments is a no-op.

Flags

Manual install for other clients

Run with --print to emit the JSON snippet, then paste it into your client's MCP config:

$ daam-cli mcp install --print
{
  "mcpServers": {
    "daam": {
      "command": "/usr/local/bin/daam-cli",
      "args": ["mcp"]
    }
  }
}

What the AI Can Do

The MCP server exposes eight tools over stdio. Tool descriptions are part of the API contract, and they shape how the AI uses the surface. Full input and output shapes are documented at the Model Context Protocol specification.

SQL itself is run through the AI's existing tooling (Bash + psql) against the localhost connection string. There is no SQL execution surface in MCP. Queries flow through the daam-agent normally, picking up masking, row filters, and audit log entries.

Approval Flow

From your perspective as a developer with an AI assistant:

1. The AI calls list_databases and describe_schema to understand what's available and which tables it needs.
2. The AI calls request_access with a justification, target database, optional table/column scope, and duration.
3. An org admin receives a notification (email, webhook, Slack, etc.) flagged as AI-originated. The email subject is prefixed with [AI agent] and webhook payloads carry "origin": "mcp".
4. The admin reviews the request in the console. AI-filed requests show a purple MCP badge in the queue and on the request detail page (see the admin-side documentation).
5. On approval, the AI's polling on get_access_request sees the status flip to active, calls get_connection_string, and connects via psql against localhost.
6. On expiry, the daam-agent revokes grants. Subsequent queries fail with permission errors. The AI can call list_my_access, see the expiry, and re-request if needed.

Troubleshooting

The single-screen diagnostic is daam-cli mcp doctor. It checks the profile, OAuth token, control plane reachability, AI client config, filesystem permissions, and the local tunnel registry:

$ daam-cli mcp doctor
daam MCP Doctor

Profile:        acme-corp
CLI version:    0.1.0
Control plane:  https://daam.dev (reachable, 38ms, HTTP 200)

Authentication
  ✓ Token present, expires in 47m
  ✓ Refresh token present

AI clients
  ✓ Claude Code (config at /home/<user>/.config/Claude/claude_desktop_config.json)
    └── entry "daam" → /usr/local/bin/daam-cli mcp

Filesystem
  ✓ /home/<user>/.daam (writable)
  ✓ /home/<user>/.daam/tunnels (mode 0700, writable)
  ✓ /home/<user>/.daam/mcp.log (12KB, last write 3m ago)

Tunnels (active)
  (none)

Result: ✓ all required checks passed

Lines beginning with ✗ are required failures (doctor exits non-zero). Lines beginning with ! are advisory: a missing AI client config or an empty tunnel registry is normal before first use.

MCP server logs are written to ~/.daam/mcp.log (rotating, 10MB cap, 3 backups). Stdout is reserved for the MCP protocol; every diagnostic message goes to stderr or this file.

Uninstall

Remove the MCP entry from your AI client's config:

$ daam-cli mcp uninstall
  ✓ Removed daam MCP entry "daam" from Claude Code
    Config: /home/<user>/.config/Claude/claude_desktop_config.json

Uninstall is idempotent: removing a missing entry does not touch the file at all. Use --name to target a specific entry when multiple are installed.

Uninstall only removes the AI-client config entry. OAuth credentials, tunnel registry, and the MCP log file under ~/.daam/ are left in place. Remove them manually if you want a clean slate.

Security Model

The MCP server runs locally on your machine and acts as you, loading your OAuth tokens from the daam CLI credential store. There is no separate AI service identity, and no token is ever sent to the AI client.

The trust gate is admin approval of access requests, exactly as it is for human-filed requests. The MCP server itself enforces no access policy. Spoofing the origin = "mcp" marker has no security consequence. It is metadata used for admin UI distinction and observability, not authorization.

What MCP cannot do:

• Bypass admin approval.
• Open a tunnel without an active grant.
• Run SQL through the MCP surface (there is no SQL execution tool).
• Issue credentials to itself or escalate beyond your existing org membership.

For non-human service identities (CI jobs, cron-driven automation), use API Keys.