Faucet MCP
A single Go binary turns a SQL database into a REST API with roles and an MCP server for Claude Code, Cursor and VS Code
- 170 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- A role with write verbs lets the agent insert, change and delete rows, and the DDL API can create and drop tables
- The local SQLite file holds the passwords of connected databases and access keys
- Stdio mode runs with admin rights and bypasses roles
Install
- Works in
Manual install
npx @faucetdb/faucet serveRequires Node.js 18 or newer. After launch open http://localhost:8080: the wizard creates an admin and connects the first database.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- A role with write verbs lets the agent insert, change and delete rows, and the DDL API can create and drop tables
- The local SQLite file holds the passwords of connected databases and access keys
- Stdio mode runs with admin rights and bypasses roles
This is third-party code. Review the repository files before installing.
What it does
Faucet is a self-hosted Go server that builds a REST API and an MCP server from your database schema on a single port. It works with PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, Snowflake and SQLite. No code or ORM is needed: tables, columns and constraints are read at runtime and turned into CRUD endpoints, an OpenAPI 3.1 spec and MCP tools. Access is built on roles and keys. For each table a role allows a set of GET, POST, PUT, PATCH and DELETE verbs, and an API key is bound to a role. The agent connects to `/mcp` over HTTP with an `X-API-Key` header and sees exactly what its role allows. Eight tools cover listing databases and tables, describing a table, filtered queries, insert, update, delete and raw SQL, which only an administrator can use. First launch happens in the browser: a wizard creates the admin and connects a database, then the API keys page hands out ready `curl` commands and MCP setup with the key already filled in. An admin panel includes a schema view, a query explorer that copies a request as curl, JavaScript or Python, and a lock that protects the API contract from silent schema changes.
Who it is for. Developers of internal tools and teams that want to give an AI agent governed access to an existing SQL database with roles and keys.
Good fit when
- A legacy SQL Server 2012 or MySQL 5.7 database needs a quick REST API without changing the database itself
- Claude Code or Cursor should read data from PostgreSQL through a role limited to GET
- Several databases of different kinds should sit behind one address with shared keys and roles
- A prototype needs ready CRUD and an OpenAPI spec so the frontend does not wait for the backend
- A team wants to lock the API contract so a column rename in the database does not break clients silently
Not a fit when
- You need GraphQL: Faucet generates REST and an OpenAPI 3.1 spec only
- The agent should see only rows owned by a user: row filters are stored in the rules but not yet applied to queries
- You only need reads from one database with no REST or admin panel: a lighter database MCP server is enough
Example request
Connect to Faucet, list the tables in `mydb` and show the ten latest orders with status `active`MCP
- Transport
- http, stdio
- Authentication
- API key
Limitations
The author calls the project under active development and suitable for internal tools, prototypes and agent access. Anonymous statistics are sent hourly by default and are disabled with `faucet config set telemetry.enabled false` or the `FAUCET_TELEMETRY=0` variable. ChatGPT connectors sign in with OAuth, which Faucet lacks, so ChatGPT has to go through a Custom GPT Action over HTTPS and `/openapi.json`. Raw SQL stays off until you allow it for a service and grant the role every verb.
How to disable. Remove the `faucet` block from the client's MCP configuration, for example with `claude mcp remove faucet`. The server stops when the process ends; its settings and keys live in a local SQLite file that you delete by hand.
FAQ
How do I connect Faucet to Claude Code?
Run `faucet serve`, create a role and a key on the API keys page and run `claude mcp add --transport http faucet http://localhost:8080/mcp --header "X-API-Key: YOUR_API_KEY"`. The AI agents page in the admin shows the same command with the key filled in.
Can the agent change data?
Yes, if the key's role allows POST, PUT, PATCH or DELETE: the tools `faucet_insert`, `faucet_update` and `faucet_delete` handle writes. A GET-only role lets the agent read and nothing else.
What does stdio mode do?
`npx -y @faucetdb/faucet mcp` starts the server as the client's subprocess and takes databases from `~/.faucet`. This mode runs with local admin rights and roles do not apply, so it suits your own machine only.
How do I install Faucet without Node.js?
Through Homebrew `brew install faucetdb/tap/faucet`, Docker `docker run -p 8080:8080 -v faucet-data:/data faucetdb/faucet`, `go install` or a prebuilt binary from the releases page.
Where are database passwords and keys stored?
In a local embedded SQLite database; no separate configuration database is needed. API keys are stored as SHA-256 hashes and admin session JWTs are signed with HMAC-SHA256.
Discussion
No questions or reviews yet.
Related
MCP serversInstant REST and MCP over PostgreSQL: the agent reads an existing database through an MCP endpoint with no backend to write
A PostgreSQL MCP server with index tuning, EXPLAIN plans, database health checks and a read-only mode
Apollo's MCP server: turns chosen GraphQL operations into tools the agent uses to work with your API
Supabase's official MCP server: the agent manages tables, reads project config and queries data after an OAuth login
A Pingora gateway that turns existing HTTP services into MCP servers from an OpenAPI spec, with no changes to their code
An MCP server and plugin for agents that generate web APIs from OpenAPI, AsyncAPI, GraphQL, gRPC and SQL specs on a Rust core.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Faucet (this card) | no | API key | 170 | |
| DBHub | no | not required | 3,804 | a token-efficient database MCP server with a read-only mode, without a REST API or roles |
| MCP Toolbox for Databases | yes | not required | 16,820 | Google's open database MCP server with ready tools and your own in `tools.yaml` |
| Supabase MCP Server | yes | OAuth | 2,995 | the official Supabase MCP server with OAuth sign-in for managing Supabase projects |
README in short
The README describes Faucet as a gateway between SQL databases and REST/MCP, with a workflow diagram and admin panel screenshots. It continues with features grouped by security and developer experience, a table of supported databases, a one-minute quickstart, MCP setup for several clients and a command reference. It closes with comparisons to PostgREST, Hasura, DreamFactory and Supabase, an FAQ and a build-from-source guide.