Give Claude Code a real backend: Postgres, auth and storage
One command connects Claude Code to Scribase. From then on it can create the backend, write migrations, prove row-level security and wait for your approval before anything touches production.
1.Connect Claude Code to Scribase
Claude Code opens the Scribase consent page in your browser the first time it connects, so there is no key to paste. If you prefer a header, use the second command with an agent token (scb_agt_) in SCRIBASE_ACCESS_TOKEN.
claude mcp add --transport http scribase https://api.scribase.com/mcp
# Or, with an agent token instead of browser sign-in:
claude mcp add --transport http scribase https://api.scribase.com/mcp \
--header "Authorization: Bearer $SCRIBASE_ACCESS_TOKEN"2.Tell it the rules
Claude Code reads CLAUDE.md on every task. These five lines keep it on the safe path: preview first, prove row-level security, ask before production.
## Scribase backend
- The backend is Scribase (Postgres, Auth, Storage, Realtime). App code uses @supabase/supabase-js with the URL and anon key that `npx scribase init` writes.
- Never ask me for keys. To sign in, run `scribase login --json`, show me the link and code, and wait for my approval.
- Schema changes are SQL files in supabase/migrations/, rehearsed on a preview branch; every new table enables row-level security with owner policies.
- Merging into production, deleting environments and rotating keys need my explicit approval for that operation.
- Never print, log or commit keys. Full rules: https://docs.scribase.com/llms.txt3.Add the safe-change skill
The skill teaches Claude Code the preview, test, confirm, merge flow, so it follows it every time it touches your schema.
mkdir -p .claude/skills/scribase-safe-change
curl -fsSL https://scribase.com/mcp/skill -o .claude/skills/scribase-safe-change/SKILL.md4.Ask for the app
Paste this. The agent runs init, shows you one link to approve in the browser, creates the table with a tested policy and builds the screen.
Build me a small app with sign-in and a todo list, on a Scribase backend.
1. Run `npx scribase init --yes --json` in the project root. If it returns authorization_pending, show me the link and code, wait until I approve, then run it again.
2. Create a `todos` table owned by the signed-in user, with row-level security so each user only sees their own rows. Use the Scribase MCP tools (policy.test before schema.apply), not the service-role key.
3. Add email sign-in and the todo screen using the generated client.
4. Never print, log or commit the env file.Every tool the agent can call is listed on the MCP page. Full reference: agent setup docs.
Common questions
Do I need to install anything?
No. The MCP server is hosted; Claude Code talks to it over HTTP after you approve it once in the browser. npx runs the CLI on demand.
Can the agent break production?
Every write tool waits for an explicit confirm, and schema.apply only accepts a token that policy.test issued for the same schema, so an unproven row-level-security policy cannot be applied. Agent tokens are scoped and expiring, and every call is audited.
What does it cost?
Scribase is priced per project, flat, with no usage surprises. See the pricing page for the current price. Sign-up includes a $1 card check that is credited back.
Can I leave?
Yes. export.run produces a portable bundle (Postgres dump, auth users, storage objects) you can restore anywhere Postgres runs.