---
title: SashiDo MCP server
group: Automate and AI
nav: MCP server
updated: 2026-11-14
description: Connect Claude, Cursor, VS Code and other MCP clients to your SashiDo apps. Read the schema, query data, deploy, scale, debug with logs, check security and plan Parse Server upgrades from your AI assistant.
keywords: sashido mcp, parse server mcp, mcp server, model context protocol, claude code mcp, cursor mcp, vs code mcp, ai backend management, parse server ai
---

The SashiDo MCP server connects AI assistants to your apps through the [Model Context Protocol](https://modelcontextprotocol.io). Your assistant can then do what you'd do in the dashboard, in your own words: "why is my signup function failing?", "add an index-friendly query for this screen", "deploy and tell me when it's live".

It works with a [personal access token](/en/docs/developers/authenticate), so the assistant gets only the permissions you choose and everything it changes is in your Activity.

## Connect

Create a token in **Account › Access Tokens** (start with **Read-only**). The dashboard shows ready-made configurations for the clients below.

The hosted server is at `https://mcp.sashido.io/mcp`. Clients that only support the older SSE transport can use `https://mcp.sashido.io/sse`.

### Claude Code

```bash
claude mcp add --transport http sashido https://mcp.sashido.io/mcp \
  --header "Authorization: Bearer sashido_pat_..."
```

### Cursor

In `~/.cursor/mcp.json`, or `.cursor/mcp.json` in a project:

```json
{
  "mcpServers": {
    "sashido": {
      "url": "https://mcp.sashido.io/mcp",
      "headers": { "Authorization": "Bearer sashido_pat_..." }
    }
  }
}
```

### VS Code

In `.vscode/mcp.json`:

```json
{
  "servers": {
    "sashido": {
      "type": "http",
      "url": "https://mcp.sashido.io/mcp",
      "headers": { "Authorization": "Bearer sashido_pat_..." }
    }
  }
}
```

### Claude Desktop and other local clients

Clients that start servers on your machine run it with `npx` (Node.js 18 or newer):

```json
{
  "mcpServers": {
    "sashido": {
      "command": "npx",
      "args": ["-y", "@sashido/mcp-server"],
      "env": { "SASHIDO_ACCESS_TOKEN": "sashido_pat_..." }
    }
  }
}
```

For Claude Desktop this goes in `claude_desktop_config.json` (**Settings › Developer › Edit Config**). The local server can also upload files from your disk or from a URL; the hosted one can't.

## Give it less than the token allows

A connection can be narrowed further, so one token can serve a careful setup and a bolder one:

| Hosted (URL option) | Local (environment variable) | Effect |
|---|---|---|
| `?read_only=true` | `SASHIDO_READ_ONLY=true` | Only tools that change nothing. |
| `?apps=<id>,<id>` | `SASHIDO_APPS=<id>,<id>` | Only these apps. |
| `?features=objects,logs` | `SASHIDO_FEATURES=objects,logs` | Only these tool groups. |

For example, a read-only connection to one app: `https://mcp.sashido.io/mcp?read_only=true&apps=AbC123xYz`.

The assistant only sees the tools the token and the options allow. The SashiDo API checks the token again on every call, so a tool can't do more than its token, whatever the assistant tries.

## Tools

| Group | What the assistant can do |
|---|---|
| `apps` | List your apps, see one, create one, rename one. |
| `audit` | Read the Activity: who changed what, when, and through which client. |
| `infrastructure` | See what runs an app (engine, instances, regions, high availability, version), wait for a deployment to go live, list and change Parse Server versions. |
| `builds`, `deployments` | List builds and read their logs, build, deploy, cancel; see what started each deployment and who. |
| `engines`, `health` | Change the engine, scale, turn high availability on or off, check the app's health. |
| `env` | Read and change environment variables. |
| `settings` | Read and change App Settings (users and passwords, multi-factor authentication, social logins, email, push, Live Queries, API options) and the custom domain. Secrets can be set, never read. |
| `classes` | Read and change the schema and class-level permissions. |
| `types` | Generate typed classes from your schema for TypeScript, Swift, Kotlin and Dart. |
| `advisor` | Check an app for security and data problems, cloud code that no longer works on its version, errors and failed jobs, with what to do for each; plan a Parse Server upgrade. |
| `objects` | Query, read, create, update and delete objects. |
| `files` | Upload files. |
| `cloud-functions` | Call cloud functions, read the deployed cloud code. |
| `push` | Send push notifications, see their status, manage audiences. |
| `jobs` | List, schedule, run and remove background jobs, see their runs. |
| `logs` | Read the logs and the recent errors. |
| `webhooks` | Manage function and trigger webhooks. |

Tools are marked read-only, changing or destructive, so your client can ask you before a change. Changes that are hard to undo, like switching the Parse Server version, show what will happen first and ask the assistant to confirm.

## What changes things

Every tool is marked for your client: **read** (changes nothing), **write**, or **destructive** (deletes or overwrites). Clients that ask before tool calls can ask only for the last two. The destructive ones:

| Tool | Does |
|---|---|
| `change_parse_server_version` | Switches the app's Parse Server version and redeploys it |
| `delete_class` | Removes an empty class (Parse refuses a class that still has objects) |
| `delete_field` | Removes a field and its values from every object |
| `delete_object` | Deletes an object |
| `delete_env_var` | Removes an environment variable and redeploys |
| `remove_custom_domain` | Stops serving the app on its custom domain and drops its certificate |
| `delete_job`, `delete_audience` | Removes a job schedule or a push audience |
| `delete_function_webhook`, `delete_trigger_webhook` | Removes a webhook |

A read-only connection (`read_only=true`) has none of them, nor any write tool.

## Limits

| | Limit |
|---|---|
| Requests to the hosted server | 300 a minute per client IP |
| API calls behind the tools | 600 a minute per access token |
| `query_objects` | Up to 1,000 objects per call |
| `get_logs`, `get_error_logs` | Up to 1,000 entries per call |
| `get_build_log` | The last 1,000 lines |
| `get_audit_log` | 50 events per page |
| `wait_for_deployment` | Waits up to 45 seconds per call (`timeoutSeconds` up to 300); call it again while it's rolling out |
| `get_app_advice`, `plan_parse_server_upgrade` | Read up to 80 cloud code files |
| `upload_file_from_path`, `upload_file_from_url` | Local server (stdio) only |

## Try these

- "Check my-app and tell me what to fix first."
- "What breaks in my cloud code if I move to Parse Server 6? Show me the lines."
- "Generate TypeScript types for my classes into src/types/parse.ts."
- "Show me the errors from the last hour and find the cloud code that throws them."
- "Deploy my-app, wait until it's live, then check its health."
- "Who changed my-app's environment variables this week?"
- "Turn on REST push and Live Queries for Message in my-app, then wait until it's live."
- "Put my-app on api.example.com with a free certificate. Which DNS record do I need?"

More in [Build with AI](/en/docs/developers/build-with-ai).

## Security

- **It never sees your password or the master key.** The assistant works through the SashiDo API with your token; calls to your app's data go through the API with the key added on our side.
- **The token stays with you.** The hosted server takes it from each request and stores nothing. Locally, it stays in your client's configuration.
- **Everything is recorded.** Each change shows in **Account › Activity** with the token, the assistant (e.g. Claude Code or Cursor) and the tool.
- **Treat data as data.** Text stored in your app (a user's profile, a comment) can contain instructions aimed at AI assistants. Give the assistant a read-only token when it reads data you don't control, and review changes before you approve them.