SashiDo MCP server

The SashiDo MCP server connects AI assistants to your apps through the Model Context Protocol. Your assistant can then do what you'd do in the dashboard, in your own words: "why is my signup function failing?", "add an index-friendly query for this screen", "deploy and tell me when it's live".

It works with a personal access token, so the assistant gets only the permissions you choose and everything it changes is in your Activity.

Connect

Create a token in Account › Access Tokens (start with Read-only). The dashboard shows ready-made configurations for the clients below.

The hosted server is at https://mcp.sashido.io/mcp. Clients that only support the older SSE transport can use https://mcp.sashido.io/sse.

Claude Code

claude mcp add --transport http sashido https://mcp.sashido.io/mcp \
  --header "Authorization: Bearer sashido_pat_..."

Cursor

In ~/.cursor/mcp.json, or .cursor/mcp.json in a project:

{
  "mcpServers": {
    "sashido": {
      "url": "https://mcp.sashido.io/mcp",
      "headers": { "Authorization": "Bearer sashido_pat_..." }
    }
  }
}

VS Code

In .vscode/mcp.json:

{
  "servers": {
    "sashido": {
      "type": "http",
      "url": "https://mcp.sashido.io/mcp",
      "headers": { "Authorization": "Bearer sashido_pat_..." }
    }
  }
}

Claude Desktop and other local clients

Clients that start servers on your machine run it with npx (Node.js 18 or newer):

{
  "mcpServers": {
    "sashido": {
      "command": "npx",
      "args": ["-y", "@sashido/mcp-server"],
      "env": { "SASHIDO_ACCESS_TOKEN": "sashido_pat_..." }
    }
  }
}

For Claude Desktop this goes in claude_desktop_config.json (Settings › Developer › Edit Config). The local server can also upload files from your disk or from a URL; the hosted one can't.

Give it less than the token allows

A connection can be narrowed further, so one token can serve a careful setup and a bolder one:

Hosted (URL option)	Local (environment variable)	Effect
?read_only=true	SASHIDO_READ_ONLY=true	Only tools that change nothing.
?apps=<id>,<id>	SASHIDO_APPS=<id>,<id>	Only these apps.
?features=objects,logs	SASHIDO_FEATURES=objects,logs	Only these tool groups.

For example, a read-only connection to one app: https://mcp.sashido.io/mcp?read_only=true&apps=AbC123xYz.

The assistant only sees the tools the token and the options allow. The SashiDo API checks the token again on every call, so a tool can't do more than its token, whatever the assistant tries.

Tools

Group	What the assistant can do
apps	List your apps, see one, create one, rename one.
audit	Read the Activity: who changed what, when, and through which client.
infrastructure	See what runs an app (engine, instances, regions, high availability, version), wait for a deployment to go live, list and change Parse Server versions.
builds, deployments	List builds and read their logs, build, deploy, cancel; see what started each deployment and who.
engines, health	Change the engine, scale, turn high availability on or off, check the app's health.
env	Read and change environment variables.
settings	Read and change App Settings (users and passwords, multi-factor authentication, social logins, email, push, Live Queries, API options) and the custom domain. Secrets can be set, never read.
classes	Read and change the schema and class-level permissions.
types	Generate typed classes from your schema for TypeScript, Swift, Kotlin and Dart.
advisor	Check an app for security and data problems, cloud code that no longer works on its version, errors and failed jobs, with what to do for each; plan a Parse Server upgrade.
objects	Query, read, create, update and delete objects.
files	Upload files.
cloud-functions	Call cloud functions, read the deployed cloud code.
push	Send push notifications, see their status, manage audiences.
jobs	List, schedule, run and remove background jobs, see their runs.
logs	Read the logs and the recent errors.
webhooks	Manage function and trigger webhooks.

Tools are marked read-only, changing or destructive, so your client can ask you before a change. Changes that are hard to undo, like switching the Parse Server version, show what will happen first and ask the assistant to confirm.

What changes things

Every tool is marked for your client: read (changes nothing), write, or destructive (deletes or overwrites). Clients that ask before tool calls can ask only for the last two. The destructive ones:

Tool	Does
change_parse_server_version	Switches the app's Parse Server version and redeploys it
delete_class	Removes an empty class (Parse refuses a class that still has objects)
delete_field	Removes a field and its values from every object
delete_object	Deletes an object
delete_env_var	Removes an environment variable and redeploys
remove_custom_domain	Stops serving the app on its custom domain and drops its certificate
delete_job, delete_audience	Removes a job schedule or a push audience
delete_function_webhook, delete_trigger_webhook	Removes a webhook

A read-only connection (read_only=true) has none of them, nor any write tool.

Limits

	Limit
Requests to the hosted server	300 a minute per client IP
API calls behind the tools	600 a minute per access token
query_objects	Up to 1,000 objects per call
get_logs, get_error_logs	Up to 1,000 entries per call
get_build_log	The last 1,000 lines
get_audit_log	50 events per page
wait_for_deployment	Waits up to 45 seconds per call (timeoutSeconds up to 300); call it again while it's rolling out
get_app_advice, plan_parse_server_upgrade	Read up to 80 cloud code files
upload_file_from_path, upload_file_from_url	Local server (stdio) only

Try these

• "Check my-app and tell me what to fix first."
• "What breaks in my cloud code if I move to Parse Server 6? Show me the lines."
• "Generate TypeScript types for my classes into src/types/parse.ts."
• "Show me the errors from the last hour and find the cloud code that throws them."
• "Deploy my-app, wait until it's live, then check its health."
• "Who changed my-app's environment variables this week?"
• "Turn on REST push and Live Queries for Message in my-app, then wait until it's live."
• "Put my-app on api.example.com with a free certificate. Which DNS record do I need?"

More in Build with AI.

Security

• It never sees your password or the master key. The assistant works through the SashiDo API with your token; calls to your app's data go through the API with the key added on our side.
• The token stays with you. The hosted server takes it from each request and stores nothing. Locally, it stays in your client's configuration.
• Everything is recorded. Each change shows in Account › Activity with the token, the assistant (e.g. Claude Code or Cursor) and the tool.
• Treat data as data. Text stored in your app (a user's profile, a comment) can contain instructions aimed at AI assistants. Give the assistant a read-only token when it reads data you don't control, and review changes before you approve them.