Maplith Bridge MCP server

Maplith Bridge

Connect your database to your AI agent, read-only, without giving anyone your password.

The Bridge runs in your own network. It shares one folder of data files over MCP (the Model Context Protocol), behind a token you create, and it can fill that folder from PostgreSQL under a database role that can only read.

no file. The extractor refuses to run under a role that can do more than read.

• Read-only, end to end. The server has no method that writes and accepts

machine the extractor runs on, and the server that faces the network never holds it.

• Your password stays with you. The database password never leaves the

Node.js alone; the extractor has one dependency, the PostgreSQL client, pinned.

• Small enough to read. Three files of TypeScript. The server runs on

Any MCP client can use it: Claude Code, Claude Desktop, your own agent. It works best with Maplith, which reads the folder to map how your systems fit together.

Quick start

You need Node.js 24 or newer.

npx --yes maplith-bridge@1.0.0-rc.1 rotate-token
npx --yes maplith-bridge@1.0.0-rc.1 serve --dir ./exports

The first command writes a random token to maplith-bridge.token, readable by you only. The second serves the files in ./exports at http://127.0.0.1:8787/mcp, on this machine only. Point any MCP client at that address with the header Authorization: Bearer . With Claude Code:

claude mcp add --transport http bridge http://127.0.0.1:8787/mcp \
  --header "Authorization: Bearer $(cat maplith-bridge.token)"

To fill the folder from PostgreSQL, under a read-only role:

PGHOST=db.example.com PGDATABASE=shop PGUSER=bridge_reader \
  npx --yes maplith-bridge@1.0.0-rc.1 extract postgres --out ./exports --check

--check verifies the role and writes nothing. Run it again without --check to write one CSV file per table.

Run any command with --help for every option.

Set it up for real

runs it: two system users, the read-only role, TLS, a systemd service.

• RUNBOOK.md: a server install, step by step, for the person who

your own AI agent do the same install, stopping for you at every decision, password and sudo.

• INSTALL-WITH-YOUR-AGENT.md: one prompt that has

How it keeps your data safe

Shortened. The full README is on GitHub.