Serve Ptah's operations to an AI client over the Model Context Protocol, on
stdin and stdout.

This is not a command to run by hand: an MCP client starts it and speaks the
protocol to it. Point one at the Ptah binary with "mcp" as the argument.

Without --workspace it serves six reading tools and nothing else. None of them
applies a migration, writes a file, or changes a database:

  describe_session  what this session may do and what it can reach
  validate_schema   structural problems in a declared schema, no database
  render_schema     the DDL a declared schema becomes, in dependency order
  schema_lineage    which base columns feed each view column
  search_docs       what Ptah's own documentation says, with its source
  read_database     the schema a configured database currently holds

Every one of them asks the capability policy first. A session always has a
policy; a workspace only adds the artifact half.

A declared schema is read from the directories you name and from nowhere else.
--schema-source-root names them, and --workspace is one when you give it. A
source that would be fetched rather than opened, such as oci://, is refused: no
capability on this surface grants a network fetch.

A live database is yours to configure, not the agent's to name. --database-url
gives the connection, --database-class says how far to trust it, and the model
sees only the name and the class. Inspection is denied until you allow it:
--allow-database-inspect takes "ask" or "allow", and it is scoped to the class
of the database you configured. --auto-approve is about patches and grants
nothing here.

  ephemeral     allowed outright
  dev, target   asked about, per read
  production    denied, and no flag on this surface widens it
  unclassified  denied; classify the database to change that

Three of Ptah's own reading verbs are deliberately absent -- schema inspect,
schema diff and migrations lint -- because each needs a scratch database it
resets destructively, and a destructive capability must not sit behind a
read-only name on a surface an agent drives.

With --workspace it also serves three artifact tools, confined to the directories
you name:

  read_artifact       one artifact directory, or one file inside it
  preview_patch       what a proposed change would do; writes nothing
  apply_patch         apply a previewed patch, verify it, undo a break

Writing is off until you turn it on. --allow-write names the artifact classes an
agent may propose changes to, and without it every apply is refused. A named
class still asks for approval per patch through the client, unless
--auto-approve says otherwise -- which is what a client that cannot show a
prompt needs.

The gates run for one target. --dialect names it, and --server-version pins the
release within that dialect so a rule gated on a capability the family gained
later answers for the server this project runs.

A patch cannot leave the directory its class names, cannot write the migration
integrity file, and cannot be applied if the directory changed after it was
previewed. Ptah recomputes the integrity file itself and runs its validation and
lint gates after every write, undoing the whole patch when the write introduced
an error.

Applying a migration to a database is not available here at any setting.

Credentials are the client's to supply. This server holds none, stores none, and
sends nothing anywhere: it runs locally and talks to whatever the caller names.

Usage:
  ptah mcp [flags]

Flags:
      --allow-database-inspect string   Effective verdict for inspecting the configured database: ask or allow
      --allow-write strings             Artifact classes an agent may propose writes to: migrations, schema, tests [env: PTAH_ALLOW_WRITE]
      --audit-log string                Where to append the agent audit record (default <workspace>/.ptah/agent-audit.jsonl) [env: PTAH_AUDIT_LOG]
      --auto-approve                    Apply patches without asking for approval through the client
      --database-class string           Trust classification of the database: ephemeral, dev, target, production or unclassified [env: PTAH_DATABASE_CLASS]
      --database-name string            Name a caller selects the database by; defaults to the database in the URL [env: PTAH_DATABASE_NAME]
      --database-url string             Live database an agent may be permitted to inspect; never sent to the model [env: PTAH_DATABASE_URL]
      --dialect string                  Target dialect the validation and lint gates run for; required with --workspace [env: PTAH_DIALECT]
  -h, --help                            help for mcp
      --migrations-dir string           Migration directory, inside the workspace [env: PTAH_MIGRATIONS_DIR]
      --schema-dir string               Declared-schema directory, inside the workspace [env: PTAH_SCHEMA_DIR]
      --schema-source-root strings      Directories a declared schema may be read from; the workspace when one is configured [env: PTAH_SCHEMA_SOURCE_ROOT]
      --server-version string           Server version string used to refine target capabilities, for example 17 or 10.11.6-MariaDB (requires a target dialect; a value that names no server is refused) [env: PTAH_SERVER_VERSION]
      --tests-dir string                Ptah test directory, inside the workspace [env: PTAH_TESTS_DIR]
      --workspace string                Project root the artifact tools work within; without it only the reading tools are served [env: PTAH_WORKSPACE]