Your saved connections, available to your coding agent.
Taula includes taula-mcp, a Model Context Protocol server over the connections you already set up in the app. Claude Code or any MCP client can list tables, describe schemas, sample rows and run read queries, using the same Keychain credentials. It never sees a password.
One line for Claude Code.
The server speaks JSON-RPC 2.0 over stdio, which is what every MCP client expects. Register the binary once and the agent sees a taula server with seven tools.
For other clients, add a stdio server entry pointing at the same binary. No ports, no daemon, no config file of its own: connections come from Taula's own store.
$ claude mcp add taula -- taula-mcp Added stdio MCP server taula > which tables reference customers? list_connections · list_tables · describe_table orders.customer_id, invoices.customer_id, support_tickets.customer_id → customers.id > how many orders shipped last week? query (read-only gate passed) 2,481 rows in orders where status = 'shipped' and shipped_at ≥ 2026-09-01
// any MCP client, stdio transport { "mcpServers": { "taula": { "command": "/Applications/Taula.app/Contents/MacOS/taula-mcp" } } }
Seven tools. Six of them cannot write.
Every result is capped in rows and flagged when truncated, so an agent cannot pull a whole table by accident. Errors come back as MCP error results, never as exceptions that drop the session.
| Tool | Returns | Availability |
|---|---|---|
list_connections | The names and engines of your saved connections. No hosts, no credentials. | Always |
list_tables | Tables and views for a connection, grouped by schema. | Always |
describe_table | Columns, primary key, indexes, foreign keys, and the table's DDL. | Always |
sample_rows | A capped sample of rows from one table. | Always |
query | Rows for a read-only statement that passed the gate. | Always |
explain | The engine's plan for a read-only statement. | Always |
execute | Runs a write statement and returns any guardrail warnings alongside the result. | Only with TAULA_MCP_ALLOW_WRITES=1 |
Read-only means read-only at every depth.
Every statement sent to query or explain passes a gate before it reaches the driver. The leading keyword must be on a short read allowlist. Then the whole statement is scanned, and a write keyword anywhere, at any nesting depth, rejects it. A data-modifying CTE hidden inside a SELECT is rejected. A column called replace_count is not, because the scanner tokenizes rather than substring-matching.
- Writes are opt-in per process. The
executetool does not exist unless you start the server with writes enabled. An agent cannot discover a tool that is not in the list. - Guardrails still run. Even with writes on, an UPDATE without a WHERE or a DROP TABLE comes back with a warning attached to the result.
- Credentials never travel. Passwords and API tokens are read from the Keychain inside the server process and are never part of a tool result.
The agent already has your repo. Now it has the data.
A coding agent that can read the schema writes migrations that match it, tests against real shapes, and answers "how many rows will this touch" before you run it. Taula is the piece that lets it do so without a password in a config file.
Debug with the real schema
"Why is this query slow?" becomes describe_table, explain, and an answer about the missing index, from the agent that is editing the code.
Write migrations that fit
The agent reads the current DDL and foreign keys before proposing the ALTER, instead of guessing from the ORM model.
Same connections as the app
Add a connection in Taula, tunnel and all, and the agent can use it. Delete it, and the agent cannot. One list, one Keychain.
Ready when you are.
One payment, every update, no subscription. Download the DMG, add a connection, and you are reading rows in under a minute.