CouchbaseBLOCK
Model Context Protocol server for Couchbase - connect AI agents and LLMs like Claude, Cursor, and Copilot to Couchbase/Capella
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Couchbase MCP Server is a self-hosted Model Context Protocol (MCP) server that connects AI agents and LLM-powered assistants — Claude, Cursor, Windsurf, VS Code Copilot, and other MCP clients — to data in Couchbase clusters, whether hosted on Capella or self-managed. MCP is an open standard for letting AI assistants call tools and query external data sources; this server implements that standard for Couchbase, so an AI agent can inspect your cluster, run SQL++ queries, read and write documents, and analyze query performance using natural language instead of hand-written code.
It provides tools across categories including Cluster Health, Data Schema, Key-Value, Query, and Performance — with safety controls via read-only mode (on by default) and fine-grained tool disabling, so you can let an AI agent explore and query your data without risking unintended writes. It supports both STDIO and Streamable HTTP transports.
Couchbase MCP server is distributed as a Python Package Index (PyPI) package and via Docker. Enterprise support for Couchbase MCP Server is available by licensing Couchbase AI Data Plane, which also entitles use and enterprise support of Couchbase Agent Memory and Couchbase Agent Catalog.
For full documentation, visit mcp-server.couchbase.com.
[](https://docs.couchbase.com/mcp-server/get-started/overview.html) [](https://opensource.org/licenses/Apache-2.0) [](https://www.python.org/downloads/) [ | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (4 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (21)
"(env vars, ~/.aws/credentials, instance role).",
endpoint = "http://127.0.0.1:${OI_ANALYTICS_PORT}""couchbase-operational-insights @ git+https://github.com/couchbaselabs/operational-insights-python-client.git",
.coveragerc
.pre-commit-config.yaml
module = importlib.import_module(module_path)
"x/../../../stats",
"x/../../../../getIndexStatus",
"../../etc/passwd",
"travel-sample", "inventory", "airport", "x/../../../stats"
# would be a token-exfiltration path. We verify the keyless signature was
CB_OI_CONNECTION_STRING: http://127.0.0.1:8095
MCP_SERVER_URL: http://127.0.0.1:8001/mcp
code=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:8000/mcp 2>/dev/null || echo "000")MCP_SERVER_URL: http://127.0.0.1:8000/mcp
[](https://docs.couchbase.com/mcp-server/get-started/overview.html) [. Omit the
- Access is gated by two scopes read from the token's `scope`/`scp` claim: `couchbase-mcp:read` (read tools, including SQL++) and `couchbase-mcp:write` (write tools: KV mutations, index management, an
- Access is gated by two scopes read from the token's `scope`/`scp` claim: `couchbase-mcp:read` (read tools, including SQL++) and `couchbase-mcp:write` (write tools: KV mutations, scope/collection man
Gates applied: no_behavioural_pass.
1c0adf51af7efull audit observations/trust-audit/mcp-server/couchbase-ecosystem__couchbase-3.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 1c0adf51af7e | BLOCK | D | 69 | first audit |
Questions
What is the Couchbase MCP server?
Model Context Protocol server for Couchbase - connect AI agents and LLMs like Claude, Cursor, and Copilot to Couchbase/Capella
Is Couchbase safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does Couchbase need?
It reads CB_ACCURACY_OPENAI_API_KEY, CB_CLIENT_KEY_PATH, CB_OI_CLIENT_CERT_PASSWORD, CB_OI_PASSWORD, CB_PASSWORD, EMBEDDING_API_KEY, EMBEDDING_AWS_ACCESS_KEY_ID, EMBEDDING_AWS_SECRET_ACCESS_KEY and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Couchbase run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as couchbase-mcp-server.
How current is this page?
The grade is for one exact copy of the source (1c0adf51af7e), read on 2026-10-08. The repository is watched and re-audited when it changes.