MCP Server
Spin up AxioDB in a container and let Claude (or any MCP-compatible AI agent) talk to it directly — create databases, query documents, run aggregations, manage users and roles, all through 32 tools that log in and enforce the exact same RBAC as the web GUI. It runs in the same process as your existing Docker deployment — no separate install, no new database instance.
Quick Start
The MCP server is opt-in and disabled by default — set AXIODB_MCP=true on the same container you already run for the GUI/TCP server:
1docker run -d \2 --name axiodb-server \3 -e AXIODB_GUI=true \4 -e AXIODB_MCP=true \5 -p 27018:27018 \6 -p 27019:27019 \7 -p 27020:27020 \8 -v axiodb-data:/app \9 theankansaha/axiodb10
11# Ports:12# 27018 - HTTP GUI Dashboard13# 27019 - TCP Remote Access (AxioDBCloud)14# 27020 - MCP Server (Streamable HTTP, path /mcp)Register the endpoint (http://localhost:27020/mcp) with whichever AI tool you use:
Claude Code
1claude mcp add --transport http axiodb http://localhost:27020/mcp2
3# Available across every project instead of just this one:4claude mcp add --transport http axiodb http://localhost:27020/mcp -s userOpenAI Codex CLI
1codex mcp add axiodb --url http://localhost:27020/mcp2
3# Or edit ~/.codex/config.toml directly:4[mcp_servers.axiodb]5url = "http://localhost:27020/mcp"opencode
1opencode mcp add2# Interactive prompt: choose "remote", name it "axiodb",3# URL: http://localhost:27020/mcp4
5# Or edit opencode.json directly:6{7 "mcp": {8 "axiodb": {9 "type": "remote",10 "url": "http://localhost:27020/mcp",11 "enabled": true12 }13 }14}GitHub Copilot CLI
1# Interactive: run copilot, then inside it type:2/mcp add3# Server Name: axiodb | Type: HTTP | URL: http://localhost:27020/mcp4
5# Or edit ~/.copilot/mcp-config.json directly:6{7 "mcpServers": {8 "axiodb": {9 "type": "http",10 "url": "http://localhost:27020/mcp"11 }12 }13}Cursor
1// .cursor/mcp.json (project) or ~/.cursor/mcp.json (global)2{3 "mcpServers": {4 "axiodb": {5 "url": "http://localhost:27020/mcp"6 }7 }8}Windsurf
1// ~/.codeium/windsurf/mcp_config.json2{3 "mcpServers": {4 "axiodb": {5 "serverUrl": "http://localhost:27020/mcp"6 }7 }8}Google Antigravity (IDE & CLI)
1// ~/.gemini/config/mcp_config.json - note: serverUrl, not url2{3 "mcpServers": {4 "axiodb": {5 "serverUrl": "http://localhost:27020/mcp"6 }7 }8}AXIODB_MCP=true only has something to serve once RBAC is actually seeded — that requires AXIODB_GUI=true (the default) or AXIODB_TCP=true + AXIODB_TCP_AUTH=true. See Docker Deployment for every environment variable.
Real Login, Real RBAC — Not a Docker Env Var
Every tool except axiodb_login requires a sessionId. Call axiodb_login first with the seeded default account (admin/admin, same as the GUI) or any other RBAC user, and every subsequent call is checked against that logged-in user's actual role — a View-role session gets a real 403 on write tools, exactly like the GUI would. Nothing is gated by a static container environment variable.
1// axiodb_login({ username: "admin", password: "admin" })2{3 "statusCode": 200,4 "message": "Login successful",5 "data": {6 "sessionId": "a1b2c3...",7 "username": "admin",8 "role": "Super Admin",9 "permissions": ["db:view", "db:create", "..."],10 "mustChangePassword": true11 }12}- Sessions live in server memory only, 24h sliding TTL — call
axiodb_logoutwhen done rather than waiting it out axiodb_whoamireturns the identity/role/permissions behind a given sessionaxiodb_change_own_passwordrotates the session and returns a newsessionId- Same login rate limiter as the GUI/TCP login (5 failed attempts / 15 min lockout)
32 Tools, Mirroring the HTTP Control Server 1:1
Every MCP tool maps to the exact same controller and permission check as its HTTP route counterpart — nothing was reimplemented, so behavior (validation, error messages, RBAC) never drifts between the GUI and the MCP surface.
Session
No permission required — login is the gate itself
- axiodb_login
- axiodb_logout
- axiodb_whoami
- axiodb_change_own_password
Database
db:view / db:create / db:delete
- axiodb_create_database
- axiodb_delete_database
- axiodb_database_exists
- axiodb_get_instance_info
Collection
collection:view / collection:create / collection:delete
- axiodb_create_collection
- axiodb_delete_collection
- axiodb_collection_exists
- axiodb_get_collection_info
Documents & Aggregation
document:view / query / create / update / delete / aggregate
- axiodb_insert_document
- axiodb_insert_many_documents
- axiodb_query_documents
- axiodb_update_document
- axiodb_delete_document
- axiodb_total_documents
- axiodb_aggregate
Index
index:view / index:create / index:delete
- axiodb_create_index
- axiodb_drop_index
- axiodb_list_indexes
Dashboard
dashboard:view
- axiodb_get_dashboard_stats
User Management
user:view / create / update-role / reset-password / delete — Super Admin role only
- axiodb_list_users
- axiodb_create_user
- axiodb_update_user_role
- axiodb_reset_user_password
- axiodb_delete_user
Role Management
role:view / role:create / role:delete — Super Admin role only
- axiodb_list_roles
- axiodb_create_role
- axiodb_delete_role
- axiodb_list_permissions
Out of scope by design: transactions and database export/import are not exposed as MCP tools — kept out of this surface entirely rather than deferred.
Human in the Loop on Destructive Tools
Nine tools destroy or overwrite existing state, and each one asks a human before it runs — through your MCP client's own confirmation prompt (the protocol's elicitation/create request), naming the exact target. Declining, cancelling, or leaving the box unchecked aborts with 409 and the operation never reaches the database. Inserts, creates and index builds are never prompted — they only ever add.
1Agent: axiodb_delete_collection({ sessionId, dbName: "shop", collectionName: "orders" })2
3 -> your MCP client prompts YOU:4 "Delete the collection "orders" from database "shop"? Every document and5 index inside it is permanently removed. This cannot be undone." [ ] Confirm6
7 Declined -> { "statusCode": 409, "message": "Aborted: this destructive operation8 was not confirmed by a human reviewer." }9 Confirmed -> collection deleted| Tool | Prompted because |
|---|---|
| axiodb_delete_database | drops every collection, document and index inside it |
| axiodb_delete_collection | drops every document and index inside it |
| axiodb_delete_document | irreversible; many: true deletes every match |
| axiodb_update_document | overwrites unrecoverable field values; many: true hits every match |
| axiodb_drop_index | queries fall back to full scans until it is rebuilt |
| axiodb_delete_user | removes the account and all of its sessions |
| axiodb_delete_role | removes the role's permission set |
| axiodb_update_user_role | changes what that account may do across GUI, TCP and MCP |
| axiodb_reset_user_password | invalidates the current password and every session |
Annotations, and the one hard guarantee: every tool also ships MCP annotations (readOnlyHint, destructiveHint, idempotentHint) so clients can auto-approve reads while holding writes for review. A client that doesn't support elicitation can't show the prompt, and the call then proceeds on the annotations alone — so for an agent that must never write, hand it a View-role login: that is enforced server-side in RBAC and needs no client cooperation.
Example: Insert & Query From an Agent
11. axiodb_login({ username: "admin", password: "admin" })2 -> sessionId: "a1b2c3..."3
42. axiodb_create_database({ sessionId, name: "shop" })5
63. axiodb_create_collection({ sessionId, dbName: "shop", collectionName: "orders" })7
84. axiodb_insert_document({9 sessionId, dbName: "shop", collectionName: "orders",10 document: { customer: "Alice", total: 49.99, status: "paid" }11 })12
135. axiodb_query_documents({14 sessionId, dbName: "shop", collectionName: "orders",15 query: { status: "paid" }16 })Security Notes
- Every write/read tool is permission-checked against the caller's actual role on every call, not just at login
- An invalid, expired, or missing
sessionIdis rejected before it ever reaches a database operation - The nine destructive tools require an explicit human confirmation through the client before they touch data — see Human in the Loop above; a
View-role login is the server-side way to make an agent read-only - Expose port 27020 only to trusted networks/agents, same guidance as the TCP port — the MCP server carries the same authority as the GUI, just a different transport
Give Your Agent a Database
Deploy the container, enable AXIODB_MCP, and register it with your MCP client.
