The short answer
The Prisma MCP server is a remote MCP server at https://mcp.prisma.io/mcp that lets an AI tool manage Prisma Postgres databases: create them, run SQL, restore automated backups, manage Object Storage and search Prisma’s docs.1 It can also manage Prisma Compute deployments.2 Prisma’s docs warn that tools that change or delete resources can cause data loss, and that the Prisma CLI’s safeguards apply to CLI commands, not to MCP tool calls.1
So the safety of this server is whatever approval your AI tool asks for. Connect it, keep destructive tools behind a confirmation you actually read, and point it at a workspace without production data until you trust the setup.
Deedglass
A tool call meets your rules before it runs
Asks to run
DELETE FROM visits;
Deletes every row in visits
Deedglass checks your rules
- Reading dataAllowed
- Deleting a whole table (DROP, TRUNCATE)Never
- Changing or deleting rows without saying which (WHERE)This one
- Other changesWait for a person
Two servers, one retired
There used to be two Prisma MCP servers, and old tutorials still mix them up.
| Local server | Remote server | |
|---|---|---|
| Start | npx prisma mcp |
Connect to https://mcp.prisma.io/mcp |
| Shipped in | Prisma ORM 6.6 to 7.x3 | Current1 |
| Prisma 8 | Not included3 | Supported |
| Repository | prisma/mcp, now archived3 |
Prisma’s hosted service |
If you’re on Prisma 8, the remote server is the one. Setup is a URL in your client’s MCP config. For Claude Code, for example:
Code Commands typed in a terminal. The text around it says what happens.
claude mcp add --transport http prisma https://mcp.prisma.io/mcp
You sign in with your Prisma account and pick a workspace when you connect.1 That workspace is the reach of everything below.
The tools, sorted by risk
Prisma’s MCP tools reference lists the tools in groups. Here they are sorted by what they can do to you, using the reference’s own descriptions.2
Read only. Workspace details, lists of databases, connection strings, backups, buckets, Compute apps, builds and deployments, deployment logs, schema introspection and the documentation search. Safe to allow without asking.
Creates things. New databases (each with a new project), connection strings, buckets, S3-compatible bucket keys, and a restore of a backup into a new database (create_prisma_postgres_recovery).2 Low risk to data, but new connection strings and bucket keys are new credentials. Know where they end up.
Changes or deletes data. This is the group to gate:
| Tool | What it does (from the reference) |
|---|---|
execute_sql_query |
Runs SQL that can read, modify or delete data2 |
execute_prisma_postgres_schema_update |
Applies a schema change2 |
delete_prisma_postgres_database |
Permanently deletes a database2 |
delete_object_store_bucket |
Deletes a bucket with its objects and keys2 |
delete_prisma_postgres_connection_string, delete_object_store_bucket_key |
Cuts off whatever used that credential2 |
Changes live traffic. The Compute tools can promote a deployment, roll back an app, stop a deployment, delete deployments and apps, and set or delete environment variables.2 Stopping the live deployment takes your app offline; changing an environment variable can break it on the next start.
One more point about execute_sql_query. It’s the most useful tool and the widest: “SQL that can read, modify or delete data” means DELETE FROM users is a valid call.2 Ask yourself whether an agent needs it at all for the task, or whether schema introspection and a read-only connection string in your app would do.
Why the CLI guardrail doesn’t help here
Prisma has a guardrail for agents in its CLI. Prisma ORM 6.15.0, released in August 2025, added a guardrail so that AI coding tools such as Claude Code, Gemini CLI, Cursor and others get an explicit confirmation step before prisma migrate reset runs.4 In the source, the check also covers db push --force-reset, detects agents by environment variables, and lets the command run once PRISMA_USER_CONSENT_FOR_DANGEROUS_AI_ACTION is set to any value.5 Our post on an agent running migrate reset on production tests it.
That guardrail lives in the CLI. An MCP tool call never runs the CLI, so it never meets the check, which is exactly what Prisma’s MCP docs say.1 delete_prisma_postgres_database asks the agent for nothing beyond the call itself.
Prisma has also been candid about the bigger limit. Its July 2026 post notes that Prisma 8 has no reset command at all, and concedes that no tool can physically stop a process holding the keys from opening a raw connection and running whatever it wants.6 That applies here too: the MCP server’s reach is your workspace login.
Set it up safely
- Start in a scratch workspace. Connect the MCP server to a workspace with no production databases while you learn how your agent uses it.1
- Allow reads, ask for writes. In your client, auto-approve only the read-only tools listed above. Every create, change, delete and Compute action should show you a confirmation with the full arguments. Our guide to requiring approval for MCP tool calls shows how in each client.
- Read the target before you approve. Prisma’s docs say to check the target workspace and resources before approving.1 A database id in a confirmation box is easy to approve without thinking; compare it with the one you meant.
- Deny the delete tools outright if your workflow never needs them. A confirmation you click through dozens of times a day isn’t a control.
- Keep production in a different workspace from the one the agent signs into. Workspace separation is the boundary the server actually respects.
- Know your restore path. The server can restore automated backups into a new database.12 Check how far back your plan’s backups go before you need them.
What to check after a change
An agent’s summary of what it did is not a record of what happened. After any write through this server:
- SQL changes: run a
SELECTthat should show the change, and a count of rows you didn’t expect to touch. - Schema changes: introspect the schema again and compare it with what you approved.
- Deletes: list databases or buckets and confirm the right one is gone, and only that one.
- Compute changes: list deployments and check which one is live, then load the app.
These are the same human-in-the-loop habits that apply to any MCP server with write tools; see MCP server security basics.
Questions people ask
Is the Prisma MCP server safe to use?
It’s as safe as the approvals in your AI tool. Prisma’s docs warn its change and delete tools can cause data loss and that the CLI safeguards don’t apply to MCP calls.1
Does npx prisma mcp still work?
Only with Prisma ORM 6.6 to 7.x. The local server isn’t in Prisma 8, and its repository is archived.3
Can the Prisma MCP server delete my database?
Yes. delete_prisma_postgres_database permanently deletes a database by id.2
To try approvals and read-backs on a real database in your browser, open the playground. To see which MCP servers and database credentials your coding agents can reach on your own machine, run npx deedglass scan (the grade, explained).
Written with AI assistance and checked against our claims register.