Other MCP clients

Any MCP client that can launch a stdio server can use Changeward. You get the tools and the preview → policy → apply → undo flow. Clients without hooks can still run raw commands, so pair this with database credentials the agent doesn't have (see executor.md), or wrap their existing database server with changeward proxy.

The server

changeward mcp postgres --target app      # or: mcp mysql

Flags:

• --executor URL: use a shared executor, with the token in $CHANGEWARD_EXECUTOR_TOKEN.
• --checkpoint: checkpoint the target when the session starts.
• --branch: work on a private copy of the target.
• --session ID: attach to an existing session.

The server must run in a directory that contains changeward.yaml (or a child of it), or set CHANGEWARD_CONFIG=/path/to/changeward.yaml in its environment.

Tools:

Client configuration

These snippets follow each client's documented MCP format. They have not been tested end to end like the coding agents in this folder.

Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

{ "mcpServers": { "changeward": { "command": "/usr/local/bin/changeward",
  "args": ["mcp", "postgres", "--target", "app"],
  "env": { "CHANGEWARD_CONFIG": "/Users/me/projects/shop/changeward.yaml", "CHANGEWARD_AGENT": "claude-desktop" } } } }

VS Code (GitHub Copilot agent mode, .vscode/mcp.json):

{ "servers": { "changeward": { "type": "stdio", "command": "changeward", "args": ["mcp", "postgres", "--target", "app"],
  "env": { "CHANGEWARD_AGENT": "vscode" } } } }

Windsurf (~/.codeium/windsurf/mcp_config.json) and other clients that use the mcpServers shape: the same as Claude Desktop.

Zed (settings.json):

{ "context_servers": { "changeward": { "command": "changeward", "args": ["mcp", "postgres", "--target", "app"] } } }

Clients that support MCP elicitation, like Claude Code, show inline approval prompts. Others report that approval is needed, and you approve with changeward approve.

Agents without MCP: AGENTS.md and the generic hook

changeward install agents-md appends a section to AGENTS.md. It tells any agent that reads it to use the Changeward tools or changeward exec, and never changeward approve.

For agents with a pre-command hook mechanism of their own, call the generic check. It exits with 2 when the command must not run:

changeward hook check "psql -d app -c 'DELETE FROM orders'"          # exit 2, reason on stderr
changeward hook check --json "kubectl apply -f deploy.yaml"           # {"permission": "...", "reason": "..."}

Wrapping an existing database MCP server

If your agent already uses a database MCP server, put Changeward in front of it:

changeward proxy --target app -- npx -y @modelcontextprotocol/server-postgres "$DATABASE_URL"

Reads pass through to the upstream server. SQL writes (execute_sql, query and the like) are planned, decided and applied by Changeward. Other tools that aren't read-only need approval under --env policy.