What is Faucet?
Faucet, from the US start-up FaucetDB, connects to PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, Snowflake or SQLite, reads the schema and generates a CRUD REST API, an OpenAPI 3.1 spec and an MCP server from it at runtime. Roles, API keys, admin accounts and connection details live in an embedded SQLite file, and an admin UI in the same binary connects databases, builds roles and prints ready-made MCP configs for Claude Code, Cursor, VS Code and Windsurf.
The MCP server is served at /mcp on the same port as the REST API (8080 by default) over Streamable HTTP, authenticated with an X-API-Key header, or launched over stdio. It exposes 8 tools and 2 resources. The repo, created in February 2026 and written almost entirely by one developer, has about 172 GitHub stars; v0.1.15 shipped on 9 October 2026, and the npm package was downloaded 346 times in the month to 10 November.
Everything is MIT-licensed with no paid tier. A hosted Faucet Cloud is announced with a waitlist and no price.
How to install Faucet
npx @faucetdb/faucet serveIs Faucet worth it?
Faucet's idea is sound: rather than hand an agent a SQL prompt, it gives the agent structured tools (faucet_query, faucet_insert, faucet_update, faucet_delete) that map onto HTTP verbs, and checks every call against the API key's role, per service and per table. Filters arrive in a small expression syntax that Faucet parameterises itself, so the model never writes the SQL string that runs. Raw SQL is a separate tool that needs both raw_sql_allowed on the service, which is off by default, and a role granting all five verbs; services flagged read_only refuse every write, raw SQL included. DBHub, by contrast, hands the model an execute_sql tool; Google's MCP Toolbox reaches a similar result by having you write the queries in advance, where Faucet generates its tools from the schema.
The history is the reason for caution. Release v0.1.13, on 3 September 2026, fixed a flaw the maintainers rated high severity: until then, role rules were stored but never consulted, so any valid API key, including one handed to an agent, could read and write every table of every service, over REST and MCP alike. The same release stopped raw SQL ignoring the read_only flag and replaced a built-in default JWT signing secret with a random one. It was disclosed in the release notes rather than as a GitHub advisory, and the repo lists none. Row-level filters are still stored but not applied, a gap the docs state openly.
The network defaults need attention before anything else. faucet serve listens on 0.0.0.0, every interface, on port 8080, in plain HTTP; the docs send TLS to a reverse proxy. Until the first admin account exists, the setup endpoint accepts whoever reaches it first, so a fresh instance on a shared network should be started with --host 127.0.0.1. The stdio mode runs with local admin rights and applies no roles, which means full insert, update and delete on every connected table. Connection passwords sit unencrypted in the config SQLite file, which Faucet restricts to owner-only permissions. Telemetry is on by default: an hourly PostHog ping with counts of tables, keys and roles but no names or data, switched off with FAUCET_TELEMETRY=0.
Our take: Faucet earns a place where a team wants one REST and MCP layer over a SQL Server or Oracle estate that DBHub-style SQL tools would expose too freely. Treat it as a v0.1 product, create a read-only database user anyway, and keep it off public interfaces.
Where it earns its place
An operations team at a manufacturer running a SQL Server ERP
Let Claude answer stock and order questions without touching the ERP's write paths
Connect the ERP with a SELECT-only database user, flag the service read_only, and issue an agent key bound to a GET-only role on the inventory and order tables. The agent filters through faucet_query, capped at 1,000 rows a call; nothing to buy beyond a small VM.
A two-person agency building an internal tool on Postgres
Get a CRUD API and an agent-editable admin path without writing a backend
Point Faucet at the database, use the generated /api/v1 endpoints from the front end, and give the agent a separate key whose role allows POST and PATCH on two tables only. Lock the schema contract so a migration cannot silently break the API.
A data analyst with a Snowflake warehouse
Explore tables and pull samples from Cursor in plain English
Add Snowflake with key-pair authentication, create a GET-only key, and register the /mcp endpoint in Cursor. faucet_describe_table gives the model columns and types; Snowflake warehouse credits for each query remain the real cost.
Before you commit
- Setup
- npx @faucetdb/faucet serve, Homebrew, Docker or a release binary, then the setup wizard at localhost:8080 creates the admin and connects a database with host, port, user and password. Create a role and an API key, then claude mcp add --transport http with the X-API-Key header; Claude Desktop needs the mcp-remote bridge. The README bills the database-to-API step as a 60-second quickstart; roles and keys add a few minutes.
- Integrations
- 8 MCP tools (faucet_list_services, faucet_list_tables, faucet_describe_table, faucet_query, faucet_insert, faucet_update, faucet_delete, faucet_raw_sql) and 2 resources; four of the tools can write. The same instance serves the REST API, /openapi.json for ChatGPT Custom GPT Actions, /healthz and /readyz. No OAuth, so ChatGPT connectors are not supported.
- Data and privacy
- Self-hosted; rows go only to the agent's model provider. The agent can do whatever its key's role allows, bounded by the database user. HTTP binds 0.0.0.0 on port 8080 by default; stdio runs with admin rights. Database passwords are stored unencrypted in the config SQLite file (owner-only permissions); API keys are SHA-256 hashed. Anonymous telemetry goes to PostHog hourly unless disabled. Row data returned to the model can carry prompt injection like any database text.
- Cost at scale
- Free; the costs are a host for the binary and database load. faucet_query defaults to 25 rows and caps at 1,000; raw SQL defaults to 100 rows, caps at 10,000 and times out at 30 seconds (up to 300). Snowflake queries spend warehouse credits per call.
- Limits
- Version 0.1.x from a one-developer project, which the README calls suitable for internal tools and prototyping. Six open issues, including SQLite query-builder correctness. No GraphQL, no OAuth, row-level filters not enforced, and each Kubernetes replica needs its own config store.
What’s good
- Seven SQL engines, including Oracle and Snowflake, from one binary
- Per-table verb permissions on every MCP tool call
- Structured tools with parameterised filters; raw SQL off by default
- Admin UI generates MCP configs with the key filled in
What’s not
- Role rules were not enforced at all before v0.1.13
- Binds 0.0.0.0 in plain HTTP; open setup until an admin exists
- stdio mode runs as admin with no roles applied
- Row-level filters stored but not enforced; telemetry on by default
Best for
Teams that want an agent and their internal apps to share one governed REST and MCP layer over SQL Server, Oracle, Snowflake or Postgres databases they already run.
Faucet alternatives
Faucet: common questions
- Is Faucet worth it?
- The right shape for giving an agent governed table access across seven SQL engines, from a project so young that its role checks only started working in September. We rate it 3.6 out of 5.
- How much does Faucet cost?
- Free and open source (MIT), every feature included. A hosted Faucet Cloud is on a waitlist; no price published.
- What are the downsides of Faucet?
- Role rules were not enforced at all before v0.1.13; binds 0.0.0.0 in plain HTTP; open setup until an admin exists; stdio mode runs as admin with no roles applied; row-level filters stored but not enforced; telemetry on by default.
- Who is Faucet best for?
- Teams that want an agent and their internal apps to share one governed REST and MCP layer over SQL Server, Oracle, Snowflake or Postgres databases they already run.
- How much does Faucet cost for a team or in production?
- Free; the costs are a host for the binary and database load. faucet_query defaults to 25 rows and caps at 1,000; raw SQL defaults to 100 rows, caps at 10,000 and times out at 30 seconds (up to 300). Snowflake queries spend warehouse credits per call.
- Is Faucet safe for company data?
- Self-hosted; rows go only to the agent's model provider. The agent can do whatever its key's role allows, bounded by the database user. HTTP binds 0.0.0.0 on port 8080 by default; stdio runs with admin rights. Database passwords are stored unencrypted in the config SQLite file (owner-only permissions); API keys are SHA-256 hashed. Anonymous telemetry goes to PostHog hourly unless disabled. Row data returned to the model can carry prompt injection like any database text.
- What are the best Faucet alternatives?
- The closest alternatives we have reviewed are DBHub, MCP Toolbox for Databases, Supabase MCP Server and database-mcp (cocaxcode).
Answers checked Nov 11, 2026.