# Give Windsurf a real backend: Postgres, auth and storage

> Add Scribase to Windsurf as a remote MCP server and let Cascade create the database, sign-in and storage for your app.

Source: https://scribase.com/agents/windsurf

Add Scribase to your Windsurf MCP config and Cascade can create the backend, apply tested migrations and ask before merging into production.

## Connect Windsurf

_~/.codeium/windsurf/mcp_config.json_

```json
{
  "mcpServers": {
    "scribase": {
      "serverUrl": "https://api.scribase.com/mcp",
      "headers": {
        "Authorization": "Bearer ${env:SCRIBASE_ACCESS_TOKEN}"
      }
    }
  }
}
```

For clients that need a header, create an agent token (it starts with scb_agt_: scoped, expiring and revocable) and keep it in the SCRIBASE_ACCESS_TOKEN environment variable, never in the repository. Never hand an agent a personal access token or a service-role key. Refresh the MCP list in Windsurf after saving.

## Project rules file: .windsurf/rules/scribase.md

```markdown
## Scribase backend
- The backend is Scribase (Postgres, Auth, Storage, Realtime). App code uses @supabase/supabase-js with the URL and anon key that `npx scribase init` writes.
- Never ask me for keys. To sign in, run `scribase login --json`, show me the link and code, and wait for my approval.
- Schema changes are SQL files in supabase/migrations/, rehearsed on a preview branch; every new table enables row-level security with owner policies.
- Merging into production, deleting environments and rotating keys need my explicit approval for that operation.
- Never print, log or commit keys. Full rules: https://docs.scribase.com/llms.txt
```

## FAQ

**Can the agent break production?**

Every write tool waits for an explicit confirm, and schema.apply only accepts a token that policy.test issued for the same schema, so an unproven row-level-security policy cannot be applied. Agent tokens are scoped and expiring, and every call is audited.

**What does it cost?**

Scribase is priced per project, flat, with no usage surprises. See the pricing page for the current price. Sign-up includes a $1 card check that is credited back.

**Can I leave?**

Yes. export.run produces a portable bundle (Postgres dump, auth users, storage objects) you can restore anywhere Postgres runs.