# Give Claude Code a real backend: Postgres, auth and storage

> Connect Claude Code to Scribase over MCP in one command, add the safe-change skill, and let it create the database, sign-in and storage for your app.

Source: https://scribase.com/agents/claude-code

One command connects Claude Code to Scribase. From then on it can create the backend, write migrations, prove row-level security and wait for your approval before anything touches production.

## Connect Claude Code

_Terminal_

```bash
claude mcp add --transport http scribase https://api.scribase.com/mcp

# Or, with an agent token instead of browser sign-in:
claude mcp add --transport http scribase https://api.scribase.com/mcp \
  --header "Authorization: Bearer $SCRIBASE_ACCESS_TOKEN"
```

Claude Code opens the Scribase consent page in your browser the first time it connects, so there is no key to paste. If you prefer a header, use the second command with an agent token (scb_agt_) in SCRIBASE_ACCESS_TOKEN.

## Project rules file: CLAUDE.md

```markdown
## Scribase backend
- The backend is Scribase (Postgres, Auth, Storage, Realtime). App code uses @supabase/supabase-js with the URL and anon key that `npx scribase init` writes.
- Never ask me for keys. To sign in, run `scribase login --json`, show me the link and code, and wait for my approval.
- Schema changes are SQL files in supabase/migrations/, rehearsed on a preview branch; every new table enables row-level security with owner policies.
- Merging into production, deleting environments and rotating keys need my explicit approval for that operation.
- Never print, log or commit keys. Full rules: https://docs.scribase.com/llms.txt
```

## Add the safe-change skill

The skill teaches Claude Code the preview, test, confirm, merge flow, so it follows it every time it touches your schema.

```bash
mkdir -p .claude/skills/scribase-safe-change
curl -fsSL https://scribase.com/mcp/skill -o .claude/skills/scribase-safe-change/SKILL.md
```

## FAQ

**Do I need to install anything?**

No. The MCP server is hosted; Claude Code talks to it over HTTP after you approve it once in the browser. npx runs the CLI on demand.

**Can the agent break production?**

Every write tool waits for an explicit confirm, and schema.apply only accepts a token that policy.test issued for the same schema, so an unproven row-level-security policy cannot be applied. Agent tokens are scoped and expiring, and every call is audited.

**What does it cost?**

Scribase is priced per project, flat, with no usage surprises. See the pricing page for the current price. Sign-up includes a $1 card check that is credited back.

**Can I leave?**

Yes. export.run produces a portable bundle (Postgres dump, auth users, storage objects) you can restore anywhere Postgres runs.