Overview
Let AI agents change real application data without giving the model SQL. MCP connects the agent. Synapsor controls the commit. The Apache-2.0 Runner stays local, receives your database credentials through environment variables, and exposes reviewed read and proposal capabilities instead of raw SQL, activation, approval, or apply tools.
Start with the synthetic proof, then connect a least-privilege staging Postgres or MySQL credential. The own-data path inspects schema metadata read-only, asks you to choose scope and one action, writes reviewable canonical files, and opens a localhost workbench. It never silently substitutes synthetic data for a failed own-data run.
Describe one Safe Action in TypeScript or select an existing reviewed capability. A coding agent may complete and validate only a disabled draft. The secured Workbench previews an exact staging Data PR and requires explicit digest-bound human activation before the tool surface changes.
Cursor is an optional MCP host. Project installation writes only the reviewed Runner launch entry and supports preview, status, and owned uninstall. Approval, apply, revert, credentials, trusted identity, and contract activation remain outside every model-facing MCP surface. Inline MCP App approval is not assumed because host support varies.
Connect one reviewed action
Run these commands from the application repository that owns the staging database. The proof command uses an embedded synthetic fixture; start --from-env is the connectivity path for your own data.
Review the generated contract and tool preview before installing Cursor. Use the dry run first; the real install merges a Synapsor-owned entry into the project MCP file and preserves other servers.
# No database or signup
npx -y @synapsor/runner audit --example dangerous-db-mcp
npx -y @synapsor/runner try --prove
# Your staging database
export DATABASE_URL="<least-privilege staging URL>"
npx -y @synapsor/runner start --from-env DATABASE_URL
# Describe one disabled Safe Action from the reviewed read boundary
npx -y -p @synapsor/runner synapsor-runner start --action plan_credit --description "Propose one reviewed customer plan credit" --based-on support.inspect_customer
# Preview, then install the project-scoped Cursor entry
npx -y -p @synapsor/runner synapsor-runner mcp install cursor --project --dry-run
npx -y -p @synapsor/runner synapsor-runner mcp install cursor --project
npx -y -p @synapsor/runner synapsor-runner mcp status cursor --projectWhat completion means
A successful first safe action is not merely a valid config. Run one reviewed scoped read, inspect its evidence and query audit, let the agent create an exact proposal, and review that Data PR outside MCP before any guarded apply.
Runner records activation milestones locally to make the path measurable. It sends no activation telemetry. Product timing starts when the installed CLI process begins and excludes the initial npm download; cold npx download time is reported separately as an observed environment-specific measurement.
Developer notes
- Use staging and a least-privilege read credential first; keep database RLS or restricted views underneath Runner where available.
- Review the generated tenant/principal scope, visible columns, primary key, version guard, bounds, and proposal operation.
- Confirm tools preview contains no raw SQL, approval, apply, revert, credential, or trusted-identity authority.
- Keep approval and guarded apply outside Cursor and every model-facing MCP catalog.
- Use the localhost workbench for the exact proposal diff, receipt, replay, and separately reviewed compensation path.