PocketBaseBLOCK
This is an MCP server that interacts with a PocketBase instance. It allows you to fetch, list, create, update, and manage records and files in your PocketBase collections.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://smithery.ai/server/@mabeldata/pocketbase-mcp) [](https://github.com/mabeldata/pocketbase-mcp/blob/main/LICENSE)
This is an MCP server that interacts with a PocketBase instance. It allows you to fetch, list, create, update, and manage records and files in your PocketBase collections.
Compatibility
Notes for newer PocketBase servers:
- v0.27+: the
geoPointfield type and thegeoDistance()filter function are fully supported bylist_records/batch_records— see Filter examples with geoPoint. - v0.40.x:
Log.Datamay be truncated by the server (~16KB) and marked with"__pb_truncated__": true; log messages are limited to 8KB.list_logs/get_logoutput passes this through as-is. - v0.38+: a superuser IP whitelist can be enabled in PocketBase Settings. When active, requests from IPs outside the whitelist (including this MCP's token) are rejected with HTTP 403 — see Troubleshooting.
- v0.33+: collection/record ids may not contain
./\|"'` - v0.28+: the
jsonfield type has a default maximum size of 1MB; larger payloads fail validation oncreate_record/update_record.
Installation
Installing via Smithery
To install PocketBase MCP Server for Claude Desktop automatically via Smithery:
npx -y @smithery/cli install @mabeldata/pocketba
cc5e6c0caa0dOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add pocketbase-mcp --env POCKETBASE_ADMIN_TOKEN=${POCKETBASE_ADMIN_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"pocketbase-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"POCKETBASE_ADMIN_TOKEN": "${POCKETBASE_ADMIN_TOKEN}"
}
}
}
}Exposed tools (32)
16 read · 14 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_field_migration | write | Create a migration file for adding a field to an existing collection. |
apply_all_migrations | write | Apply all pending migrations. |
apply_migration | write | Apply a specific migration file. |
create_backup | write | Create a new database+storage backup on the PocketBase instance. The operation is queued by the server and may take a moment to appear in list_backups. |
create_collection_migration | write | Create a migration file specifically for creating a new PocketBase collection. |
create_migration | write | Create a new, empty PocketBase migration file with a timestamped name. |
create_record | write | Create a new record in a PocketBase collection. |
delete_record | destructive | Delete a record from a PocketBase collection by ID (permanent — the record is removed server-side). |
download_file | read | Get the URL to download a file from a PocketBase collection record field. |
dry_run_view_query | write | Validate a VIEW collection query without saving the collection (server >= v0.37). Returns the resulting field definitions and a sample of rows, or a validation error. |
fetch_record | read | Fetch a single record from a PocketBase collection by ID. |
get_collection_scaffolds | read | Get example collection schema payloads (scaffolds) from the PocketBase instance (server >= v0.37) — an object keyed by collection type (base, auth, view) with ready-to-edit templates for building new collections. |
get_collection_schema | read | Get the schema (fields, rules, etc.) of a PocketBase collection. |
get_log | read | Get a single API request log by ID. |
get_logs_stats | read | Get API request logs statistics with optional filtering. |
get_settings | read | Fetch all PocketBase app settings (meta, logs, smtp, email templates, external stores, etc.). Secret fields are returned masked by the server. |
list_backups | read | List all backup files available on the PocketBase instance (name, size, last modified). |
list_collections | read | List all collections in the PocketBase instance. |
list_cron_jobs | read | Returns list with all registered app level cron jobs. |
list_logs | read | List API request logs from PocketBase with filtering, sorting, and pagination. |
list_migrations | read | List all migration files found in the PocketBase migrations directory. |
list_records | read | List records from a PocketBase collection. Supports filtering, sorting, pagination, and expansion. |
restore_backup | read | Restore the PocketBase instance from an existing backup file. DESTRUCTIVE: replaces all current data. Requires confirm=true. |
revert_migration | read | Revert a specific migration file. |
revert_to_migration | read | Revert migrations up to a specific target. |
run_cron_job | write | Triggers a single cron job by its id. |
run_sql | write | Execute a raw SQL query against the PocketBase instance (server >= v0.39). DANGEROUS: requires the server process to be started with POCKETBASE_ENABLE_SQL=true; returns an error otherwise. Use read-only queries when possible. |
set_migrations_directory | write | Set the directory where migration files will be created and read from. |
truncate_logs | destructive | Delete ALL API request logs from the PocketBase instance (server >= v0.40). DESTRUCTIVE and irreversible. Requires confirm=true. |
update_record | write | Update an existing record in a PocketBase collection by ID. |
update_settings | write | Bulk-update PocketBase app settings with a partial payload (PATCH semantics: only the provided keys change). Provide real values for secret fields — the masked |
upload_file | write | Upload a file (provided as content string) to a PocketBase collection record field. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (7 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (14)
Fetch all PocketBase app settings (meta, logs, smtp, email templates, external stores, etc.). Secret fields are returned masked by the server.
env: { ...process.env, POCKETBASE_API_URL: 'http://127.0.0.1:8090', POCKETBASE_ADMIN_TOKEN: '***' },const PB_URL = `http://127.0.0.1:${PB_PORT}`;default: http://127.0.0.1:8090
token: 'mock-superuser-token',
delete_record, truncate_logs
import { PocketBaseServer } from '../../src/server/pocketbase-server.js';import { registerTools } from '../../src/tools/index.js';import { handleToolCall } from '../../src/tools/index.js';import { handleToolCall } from '../../src/tools/index.js';import { handleToolCall } from '../../src/tools/index.js';- `POCKETBASE_API_URL`: The URL of your PocketBase instance (e.g., `http://127.0.0.1:8090`). Defaults to `http://127.0.0.1:8090` if not set.
"POCKETBASE_API_URL": "<YOUR_POCKETBASE_API_URL>", // e.g., "http://127.0.0.1:8090"
@modelcontextprotocol/sdk, pocketbase, @types/node, typescript, vitest
Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.
cc5e6c0caa0dfull audit observations/trust-audit/mcp-server/mabeldata__pocketbase-3.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | cc5e6c0caa0d | BLOCK | D | 69 | first audit |
Questions
What is the PocketBase MCP server?
This is an MCP server that interacts with a PocketBase instance. It allows you to fetch, list, create, update, and manage records and files in your PocketBase collections.
What tools does PocketBase expose?
32 in total: 16 read-only, 14 that write, and 2 that can delete or overwrite (delete_record, truncate_logs). Every one is listed on this page with its risk.
Is PocketBase safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does PocketBase need?
It reads POCKETBASE_ADMIN_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does PocketBase run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as pocketbase-mcp at 1.1.0.
How current is this page?
The grade is for one exact copy of the source (cc5e6c0caa0d), read on 2026-10-08. The repository is watched and re-audited when it changes.