[PradipNichite]

What this adds

mcp-server/ is a stdio MCP server (database-agent-mcp) that lets Claude Code and other MCP clients use Database Agent agents. It is a thin adapter over the existing REST API: each tool is an ordinary API request made with an existing credential, so authentication, agent-key scope, query caps, model configuration, table visibility, SQL access policy and execution all stay in the API. It holds no database credentials and does not generate or run SQL.

Tool	API route
list_agents	GET /v1/agents (operator key) or GET /v1/agents/{id} per agent key, plus GET …/databases (host, user and password are not returned)
ask_database	POST /v1/agents/{id}/chat?stream=false, or POST …/sessions/{session_id}/messages to continue a conversation
list_conversations	GET /v1/agents/{id}/sessions
get_conversation	GET /v1/agents/{id}/sessions/{session_id}

Tools return structured content: answer, answered, generated SQL, column-labelled rows (row_count, truncated, max_rows up to 1000), chart type/data/metadata, follow-ups and session_id. API errors become MCP tool errors with the server's reason (401/403/404/429/model configuration). Recommended credential: per-agent keys (DATABASE_AGENT_AGENT_KEYS=AGENT_ID=KEY,…); the operator key is supported for single-operator installs. Plain HTTP to a non-loopback host is refused.

Two API changes the adapter needs (DA-MCP-001)

• Session continuation is scoped to its agent. Chat history was read by session_id alone, so a key for agent A could pass a session from agent B and have B's conversation replayed into A's model context (and A's turn appended to B's session). Chat now returns 404 for a session that does not belong to the agent, before history is read or a model is called (ensure_session_belongs_to_agent).
• Saved replay includes the stored result block. GET …/sessions/{id} previously returned only bare rows without column names; each assistant message now also has result (columns, rows, row_count, truncated) from the block already stored per turn. Additive; existing fields are unchanged.

Both are recorded in docs/source-preservation.json. Known limit, documented in docs/mcp.md: the saved replay route returns SQL and rows regardless of the agent's show_sql_query/show_db_result. The adapter applies those settings to saved turns as the live route does, but the route itself does not, so a direct API caller with the same key can still read them.

Verification

• CI: new mcp-adapter job runs tests/mcp (in-memory and stdio MCP client sessions against a synthetic API that mirrors the credential rules) and tests/backend/test_session_scope.py. A deliberate mutation (dropping the saved-SQL visibility gate) turns the visibility test red.
• End to end on a disposable Compose installation of this branch (default model profile, synthetic sample_sales with its read-only account), using the MCP Python SDK over stdio: 27/27 checks, including SQL + rows (North 250.00 / South 200.00), a bar-chart suggestion, a follow-up in the same session, saved conversation with labelled rows, an agent hiding SQL/rows, unknown key → 401, another agent's key → 403, foreign session → 404, delete/drop/update requests producing no SQL with the data unchanged afterwards, and a table the DB account can read but the agent's visibility excludes not being queried.
• Claude Code (claude -p with the documented .mcp.json): list_agents → ask_database → follow-up with session_id → get_conversation, correct rows; and a 403 surfaced as a tool error with another agent's key. claude mcp add + claude mcp list showed ✔ Connected.
• Install paths checked: pip install "git+…#subdirectory=mcp-server" (from this branch) and uvx --from ./mcp-server database-agent-mcp.

🤖 Generated with Claude Code