CLI MCP Server

The Nhost CLI ships with the CLI MCP server, which lets you interact with your Nhost projects through AI assistants using the Model Context Protocol. It provides secure, controlled access to your GraphQL data, project configuration, and documentation—with granular permissions that let you specify exactly which queries and mutations an LLM can execute. For development, it streamlines your workflow by enabling AI-assisted schema management, metadata changes, and migrations, while providing direct access to your GraphQL schema for intelligent query building.

CLI vs. Backend MCP Server

This is the CLI MCP server — it runs on your machine (nhost mcp start), authenticates as you (admin secret or PAT), and helps you build and manage your projects.

To instead expose your project to your end users’ AI assistants in production, use the Backend MCP Server.

Not sure which one you need? See the Backend MCP vs. CLI MCP comparison.

Connect an AI assistant

Give your AI assistant the link https://docs.nhost.io/install-mcpCopy linkCopied! and it will read the onboarding instructions and set up the MCP server for your local project.

See Development Setup for the per-client commands and the manual steps.

Overview

The CLI MCP provides a unified interface for managing Nhost projects through the Model Context Protocol. It works with both your local development project (via the Nhost CLI) and your Nhost Cloud projects and organizations, offering tools for querying data, managing configuration, and handling metadata and migrations.

Available Tools

Nhost Cloud

Run against the Nhost Cloud platform to manage your account, organizations, and project configuration.

Tool	Description
cloud-graphql-query	Runs GraphQL queries and mutations against the Nhost Cloud platform to query and update project configurations. Schema: schema://nhost-cloud.

Projects (local & cloud)

Run against an individual project, whether it’s your local project or on Nhost Cloud.

Tool	Description
graphql-query	Runs GraphQL queries and mutations against a project’s data. Requires subdomain, role, and optionally userId. Operations must be allowed in configuration. Schema via the get-schema tool.
get-schema	Retrieves a project’s GraphQL schema, exposing its queries and mutations.
manage-graphql	Manages a project’s metadata, migrations, permissions, and remote schemas. Requires admin_secret and manage_metadata enabled. Typically used for local development. Schema: schema://graphql-management.
search	Searches Nhost’s public documentation and returns links to relevant pages.

Available Resources

The CLI MCP exposes the following resources:

Resource	Description
schema://nhost-cloud	GraphQL schema for the Nhost Cloud platform. Includes mutations only if enable_mutations is enabled (see the configuration reference).
schema://graphql-management	GraphQL management schema for Nhost projects, covering metadata, migrations, permissions, and remote schemas. Available only when manage_metadata is enabled for at least one project.
schema://nhost.toml	Cuelang schema for the nhost.toml configuration file.

Security and Privacy

Enhanced Protection Layer

The CLI MCP is designed with security at its core, providing an additional protection layer beyond your existing GraphQL permissions. Key security features include:

• Authentication enforcement for all requests
• Permission and role respect based on your existing authorization system and the credentials provided
• Query/mutation filtering to further restrict allowed operations

Granular Access Control

One of the CLI MCP’s key security advantages is the ability to specify exactly which operations can pass through, even for authenticated users:

[[projects]]
subdomain = "my-blog"
region = "eu-central-1"
pat = "nhp_project_specific_pat"
allow_queries = ["getBlogs", "getComments"]
allow_mutations = ["insertBlog", "insertComment"]

With the configuration above, an LLM will be able to only execute the queries and mutations above on behalf of a user even if the user has broader permissions in the Nhost project.

Additionally, for local development projects, you can enable metadata management:

[[projects]]
subdomain = "local"
admin_secret = "nhost-admin-secret"
manage_metadata = true

This allows the LLM to create migrations, manage permissions, and handle schema changes through the manage-graphql tool.

For more details, see the configuration page.