Skip to content
AccessVault Docs

MCP Catalog Editor

The Catalog tab defines exactly what Claude can do against a connection. Instead of letting the AI send arbitrary SQL, you author a catalog of named, parameterized, read-only queries — tools in MCP terms — and the sidecar serves only the ones you’ve enabled.

Each connection has its own catalog, stored at ~/Library/Application Support/com.accessvault.dev/catalogs/<connection-id>.json. New connections are seeded with one example tool, select_version.

Authoring a tool

Click New tool and fill in:

  • Name — letters, digits, underscores, starting with a letter. This is the MCP tool identifier Claude sees, so make it descriptive: orders_by_customer beats query1.
  • Description — what the tool returns. Claude uses this to decide when to call it, so write it for the AI as much as for yourself.
  • SQL — the query, using $1, $2, … for parameters in the order declared below. Only SELECT and WITH statements are accepted; anything else is rejected at save time with “non-read-only SQL — only SELECT and WITH are allowed”.
  • Parameters — one entry per placeholder: a name, a type (string, integer, number, or boolean), whether it’s required, and an optional description. The placeholder count in the SQL must match the declared parameters.

Parameter types matter: values flow from Claude’s JSON straight into typed native bindings — they are never string-interpolated into the SQL, so SQL injection through a parameter value is structurally off the table, and NULL vs empty string can’t be confused.

Every save passes through validation — name format, read-only SQL, placeholder/parameter match, duplicate names — so a broken tool can’t reach the catalog file.

Enabled is the exposure gate

The Enabled checkbox is what controls AI exposure: disabled tools are hidden from Claude entirely. The sidecar hot-reloads the catalog on every change, so enabling or disabling a tool takes effect in a running Claude session within moments, no re-registration needed.

The approval stamp

Approve / Revoke approval puts a review timestamp on a tool, and the list shows each tool’s state: Disabled, Approved, or Pending review.

Be clear about what this is: the approval stamp is review metadata, not a gate. An enabled tool is served to Claude whether or not it’s approved. This matters most for AI-suggested tools, which arrive enabled and unapproved (“Pending review”) — live immediately. If you use approval as a team hygiene convention, remember it’s the Enabled checkbox that actually turns a tool off.

Deleting

Delete removes a tool permanently after a confirmation. If Claude has a session open, the tool disappears from its tool list on the next hot reload.

All catalog edits — create, update, delete, enable/disable, approve/unapprove — are recorded in the audit log as builtin:* entries.