MCP server

@gemmein/mcp gives your AI coding tool Gemmein's guide, SDK reference, rule and error explainers, and a live check of your app's safety rules, as tools inside the editor. It helps your agent use @gemmein/sdk correctly, then checks the result.

Set it up

Claude Code:

claude mcp add gemmein -- npx -y @gemmein/mcp

Cursor, or any client that takes an mcpServers block:

{ "gemmein": { "command": "npx", "args": ["-y", "@gemmein/mcp"] } }

Eight tools are read-only. check_integration runs live checks against your app. With a Development secret key it also writes in the Development environment: it creates two test people and a probe record, deletes the record, and signs the test people out of earlier sessions. The test people stay. Live secret keys are refused.

What your agent gets

• guide: the full builder's guide, covering the auth flow, the seven safety rules, record shapes, links, uploads, contention and payments.
• reference: every SDK method, with its signature, return shape and error codes.
• search_docs: targeted search over both, when the agent needs one fact.
• explain_rule: what a safety rule allows, what it suits and the mistakes to avoid, or a summary of all seven for planning.
• explain_error: what a GemmeinError code means and what to do about it.
• validate_collection_name: catches a misnamed collection before every read starts returning empty results.
• explain_relay: give it a gemmein/relays/<name>.json definition and it returns the sentence the dashboard would show, or the one error that names the bad field. It works offline for all eleven actions: write_record, grant_access, revoke_access, grant_credits, email_person, call_url, fulfil_product, refund_product, grant_plan, revoke_plan and start_run.
• reaffirm_template: the CI test script, ready to copy.
• check_integration: runs your isolation and access checks live against your own app and returns structured pass/fail. Details below.

check_integration

check_integration runs the same checks as the CI test script, from inside your agent while it builds. It checks that anonymous access is refused where it must be and that collection names are valid. With your Development secret key, it also checks isolation between two test people, signed in with fresh test sessions. The result comes back as structured pass/fail, so the agent fixes what it finds before the app goes live.

It catches the bug that passes with one person and breaks with two: everyone ends up on the same record, which a single-person test never shows. Apps talk to Gemmein in JSON through an API that enforces the safety rules. There is no query language, no enumerable schema and no raw data layer, so attacks that start by mapping the database have nothing to work with. The safety rules are the part to test, and this checks them.

Pass your pk_ app key to run the anonymous checks. The isolation check between two people also needs an sk_dev key: the Development-only secret key you create in your dashboard. An sk_dev key works only against a Development environment: it reaches no real people's data, runs behind the same rules and rate limits as everything else, and the server refuses it on a Live environment. Keep it in server environment variables like any secret. sk_live keys are refused for test sessions.

What happens if…