NocoDB MCP tools and self-hosted database features

NocoDB runs on your own server, giving you full control over data and upgrade timing. Unlike SaaS competitors, it operates under the Fair Code Sustainable Use License, permitting internal use without cost. Commercial licensing is required only if you offer it as a managed service to third parties. For production environments, the recommended setup involves 4 vCPU, 8 GB of RAM, and at least 50 GB of disk space. This infrastructure requirement stands in stark contrast to the zero-setup convenience of cloud-first rivals like Airtable, which reached an $11 billion valuation in late 2021 before facing significant workforce reductions in 2022 and 2023.

The competitive landscape has shifted dramatically since Bending Spoons acquired Airtable for $1.3 billion in August 2026. That acquisition triggered a mass layoff of "a large portion" of the company’s staff. Meanwhile, open-source challengers like Amsterdam’s Baserow and San Francisco-based NocoDB continue to provide visual solutions for creating databases without proprietary lock-in. APITable, headquartered in Hong Kong, also competes in this space, having grown organization users from 6,000 to over 20,000 across 30 countries in 2022. These tools target users who expect software to be free, a common expectation in emerging markets and China’s tech industry.

MCP integration changes the game

NocoDB’s recent releases focus heavily on connectivity through Model Context Protocol (MCP) servers. The tool count jumped from 11 to 149, covering the entire workspace rather than just records. This expansion allows Claude, ChatGPT, Cursor, or any MCP client to build within NocoDB directly. Users can stand up a table, wire a workflow to a webhook, assemble an interface page, or lock down permissions in a single conversation. Each tool wraps the same service as its REST API, ensuring validation, permissions, and audit logs remain identical. Every call respects the caller’s role: viewers read, editors write, and creators change the schema.

This capability positions NocoDB as a backend for AI agents rather than just a data grid. The release notes state that "149 is just the start," with developers already building the next set of tools. Rich text emails in workflows now support headings, styling, lists, colors, and links with custom anchor text. Workflow variables can be inserted anywhere in the email body, enabling dynamic communication. Buttons can now appear on table page headers, record review toolbars, and dashboard group headers. Page-level buttons run automations without requiring a specific record, broadening the scope of user interaction.

For teams managing complex data structures, drag-and-drop functionality in List View allows records to be nested by dropping one onto another. Sub-records travel with their parent, and underlying links update automatically. Inline creation of linked record fields eliminates the need to leave the current view when establishing new relationships. Date helpers in workflow expressions, such as $now() and $dateAdd, simplify time-based logic. These features address specific pain points in workflow automation that previously required external scripting or manual intervention.

Self-hosting realities and limitations

Self-hosting NocoDB offers privacy but demands technical oversight. The Community Edition includes core features, but certain capabilities are locked behind paid plans. Rich Text Emails require the Plus plan or higher on NocoDB Cloud. In the Community Edition, the MCP server retains its record tools, but the expanded 149-tool suite is reserved for paid tiers. Paid field types like UUID, AutoNumber, Color, unique constraints, and lookup limits are rejected by the API in unlicensed deployments. This gating strategy ensures that while the base platform remains accessible, advanced functionality drives revenue.

A planned breaking change to the API datetime format will affect PostgreSQL and SQLite deployments. Datetime values will move from second to millisecond precision in REST API responses, webhook payloads, and CSV exports. Values are formatted on read, so existing records return in the new format without migration. Consumers using strict parsers may need updates to accept the millisecond component. Tolerant parsers like Day.js and most ISO 8601 parsers remain unaffected. Range filters and sorting are unchanged, but exact datetime equality filters compare at second precision and may miss values with non-zero milliseconds.

Security hardening measures include rejecting disabled or expired API tokens in the Community Edition. Hidden fields stay hidden behind row color rules on shared views, and comments are scoped to their base. Table visibility is enforced on every route to prevent unauthorized access. Clearer PostgreSQL permission errors now name the affected table in full, including quoted names with spaces or mixed case. These improvements reduce ambiguity for administrators troubleshooting access issues. However, the shift to millisecond precision requires careful testing for any integrations relying on exact timestamp matches. Will your current parsing logic handle the new precision without breaking downstream processes?