bmob-mcp

Bmob MCP Server

Bmob's officially hosted MCP server, endpoint http://mcp.bmobapp.com/mcp, the transport is MCP 2024-11-05 HTTP+SSE. Authenticate via the X-Bmob-Application-Id + X-Bmob-REST-API-Key two HTTP headers; once the agent is configured, you can perform CRUD, design schema, and generate curl boilerplate on your real Bmob project right inside the IDE.

Operation-level routing: for a comparison table of MCP tools vs generate_code vs SDK/REST, see shared/operation-routing.md。
Number of tools：tools/list Returns 12；agent Call 11(excluding the internal tool mcp_endpoint_mcp_post）。

HTTP plaintext warning: the current MCP endpoint is HTTP (not HTTPS). It is only recommended for use in a local development environment; do not commit the .cursor/mcp.json / .mcp.json containing real Keys into a public git repository.

When to use MCP vs when to use the SDK skill

Scenario	Use MCP	Use SDK skill
Want to know which tables exist in the project and what types the fields are	✅ `get_project_tables`	—
Design new tables / add fields / change schema	✅ `create_table`	—
Test CRUD in the IDE (manual triggering during development)	✅ `add_single_data` / `update_single_data` / `delete_single_data`	—
Upload / deploy cloud function source code and verify	✅ `deploy_cloud_function`; execute separately → `invoke_cloud_function`	—
Sync / pull online cloud functions to local	✅ `list_cloud_functions` → `get_cloud_function`(agent writes local files)	—
Execute / trial-run cloud functions（REST `POST /1/functions/<name>`）	✅ `invoke_cloud_function`; generate curl → `generate_code`（`调用云函数`）	—
One-click deploy website / static hosting(single-page HTML or dist.zip to CDN)	✅ `deploy_static_site` or `generate_code`（`部署静态站点单页` / `部署静态站点dist`）	—
Want curl boilerplate in any language (backup, migration scripts)	✅ `generate_code`	—
Write code to be published in the app (production code)	—	✅ `bmob-database-{javascript,android,ios,swift,flutter,restful}`
Configure ACL / permission rules	—	✅ `bmob-acl-and-roles`
Write cloud functions that run on Bmob servers	—	✅ `bmob-cloud-function-development`

Installation

Copy any of the following snippets into the MCP configuration file of the corresponding tool; for details see shared/mcp-install-snippets.md：

{
  "mcpServers": {
    "bmob": {
      "url": "http://mcp.bmobapp.com/mcp",
      "headers": {
        "X-Bmob-Application-Id": "<your-application-id>",
        "X-Bmob-REST-API-Key":   "<your-rest-api-key>"
      }
    }
  }
}

Credential location:Bmob Console → your application → Settings / Application Keys.

Mandatory workflow

Before any write operation, you must first call get_project_tables to get the real table structure of the current project; it is forbidden to generate field names / types by guessing. This is because:

Bmob is schemaless——add_single_data accepts arbitrary JSON; wrong fields will go directly into the database and cause dirty data.
Pointer / Relation Fields must be passed in { "__type":"Pointer", "className":"X", "objectId":"..." } format; if written incorrectly they will be silently ignored.

sequenceDiagram
    autonumber
    participant U as User
    participant A as Agent
    participant M as Bmob MCP
    U->>A: "帮我给 Player 表加一条数据 Lily, 18 岁"
    A->>M: get_project_tables  (always first)
    M-->>A: {Player: {name:String, age:Number, ...}}
    A->>U: 确认字段对应 + 数据示例
    U-->>A: 确认
    A->>M: add_single_data {tableName:"Player", data:"{\"name\":\"Lily\",\"age\":18}"}
    M-->>A: {createdAt:..., objectId:...}
    A->>U: 写入成功，objectId=...

The real schema of the 12 tools (11 for the agent to call)

tools/list There are 12 in total;Do not callthe 12th one mcp_endpoint_mcp_post(server-side internal loopback). Items 1–11 below are agent-usable tools.

1. `get_project_tables`

Get all tables and the corresponding field structures of this project.No parameters need to be passed other than headers。Must be called once before all write operations。

{
  "inputSchema": {
    "type": "object",
    "properties": {},
    "title": "get_project_tablesArguments"
  }
}

2. `create_table`

Create a new data table.

{
  "inputSchema": {
    "type": "object",
    "properties": {
      "tableName": { "type": "string" },
      "classNote": { "type": "string" },
      "fields":    { "type": "string", "description": "JSON-encoded field map" }
    }
  }
}

fields is a JSON string, example:

{
  "score":    { "type": "Number",  "isAutoIncre": true, "autoIncreInit": 1000, "note": "游戏分数" },
  "player":   { "type": "Pointer", "targetClass": "Player",                    "note": "玩家" },
  "nickname": { "type": "String",  "unique": true,                             "note": "昵称" }
}

type is one of 10 enum values:

type	Description	Additional constraint
`String`	String	`unique: true` Can be set as a unique key
`Number`	Integer / Decimal	`isAutoIncre: true` + `autoIncreInit: <int>` Can be set to auto-increment
`Bool`	Boolean	—
`Date`	Date	—
`File`	File	URL + filename associated with the Bmob file system
`Geo`	Geographic location	latitude + longitude
`Array`	Array	—
`Object`	Nested object	—
`Pointer`	One-to-many pointer	Required `targetClass: "<TableName>"`
`Relation`	Many-to-many relation	Required `targetClass: "<TableName>"`

Important：createdAt / updatedAt / objectId / ACL is a Bmob built-in field,do notdeclare them in fields .

3. `add_single_data`

Add a row of data to the specified table.

{
  "inputSchema": {
    "type": "object",
    "required": ["tableName", "data"],
    "properties": {
      "tableName": { "type": "string" },
      "data":      { "type": "string", "description": "JSON-encoded row" }
    }
  }
}

data is a JSON string, e.g.:'{"score":1337,"playerName":"bmob","cheatMode":false}'. For Pointer fields use:

{ "player": { "__type": "Pointer", "className": "Player", "objectId": "abc123" } }

4. `update_single_data`

Update a row of data.will use the input parameter data to replace the given fields as a whole(not a patch).

{
  "inputSchema": {
    "type": "object",
    "required": ["tableName", "objectId", "data"],
    "properties": {
      "tableName": { "type": "string" },
      "objectId":  { "type": "string" },
      "data":      { "type": "string" }
    }
  }
}

5. `delete_single_data`

Delete a row with the specified objectId in a table.Irreversible, user must confirm twice before calling.

{
  "inputSchema": {
    "type": "object",
    "required": ["tableName", "objectId"],
    "properties": {
      "tableName": { "type": "string" },
      "objectId":  { "type": "string" }
    }
  }
}

6. `generate_code`

Generate the Bmob curl for the corresponding operation, so the client can translate the curl into any development language.Before calling, you must first call get_project_tables。type is 15 enum values, and the required parameter subset differs for each type:

`type` value	Required parameters
`添加`	`tableName`, `data`
`删除`	`tableName`, `objectId`
`更新`	`tableName`, `objectId`, `data`
`查询一条数据`	`tableName`, `objectId`
`条件查询`	`tableName`, `where`(JSON string), `skip`, `limit`, `count`
`注册`	`data`(must contain `username` + `password`）
`用户名密码登录`	`username`, `password`
`手机号验证码登录`	`mobilePhoneNumber`, `smsCode`
`更新用户`	`sessionToken`, `objectId`, `data`
`请求短信验证码`	`data`(must contain `mobilePhoneNumber` + `template`）
`验证短信验证码`	`data`(must contain `mobilePhoneNumber`）, `smsCode`
`调用云函数`	`funcName`, `data`(when there are no parameters, `data` must be `{}`）
`上传文件`	`fileName`, `content_Type`
`部署静态站点单页`	`fileName`(e.g. `index.html`, default `index.html`）
`部署静态站点dist`	`fileName`(e.g. `dist.zip`, default `dist.zip`）

Complete inputSchema：

{
  "inputSchema": {
    "type": "object",
    "required": ["type", "objectId", "data", "tableName", "where"],
    "properties": {
      "type":              { "type": "string" },
      "objectId":          { "type": "string" },
      "data":              { "type": "string" },
      "tableName":         { "type": "string" },
      "where":             { "type": "string" },
      "skip":              { "type": "integer" },
      "limit":             { "type": "integer" },
      "count":             { "type": "integer" },
      "fileName":          { "type": "string" },
      "content_Type":      { "type": "string" },
      "username":          { "type": "string" },
      "password":          { "type": "string" },
      "mobilePhoneNumber": { "type": "string" },
      "smsCode":           { "type": "string" },
      "sessionToken":      { "type": "string" },
      "funcName":          { "type": "string" }
    }
  }
}

where example:'{"age":{"$gte":18}}' is equivalent to SQL WHERE age >= 18. For the complete where syntax see REST documentation #_24。

7. `deploy_cloud_function`

Upload / deploy cloud function: upload JavaScript or Java cloud function source code to Bmob, and optionally validate immediately.

Trigger words：上传云函数、部署云函数、发布云函数、写云函数并验证。

{
  "inputSchema": {
    "type": "object",
    "required": ["funcName", "code"],
    "properties": {
      "funcName":    { "type": "string", "description": "云函数名称，如 rsync_img" },
      "code":        { "type": "string", "description": "云函数源码原文" },
      "language":    { "type": "integer", "description": "1=javascript, 2=java" },
      "comment":     { "type": "string", "description": "可选备注" },
      "verify":      { "type": "integer", "description": "1 表示上传成功后立即验证" },
      "verify_data": { "type": "string", "description": "验证入参 JSON 字符串，默认 \"{}\"" }
    }
  }
}

Upload upstream：PUT https://api.codenow.cn/1/functions/{funcName}
Validate upstream：POST https://api.codenow.cn/1/functions/{funcName}
Language：1 is JavaScript,2 is Java
Auto validate：verify=1 when enabled, after a successful upload it will continue to use verify_data to execute the function
Calling instructions after successful deployment: the response contains invokeGuide(REST curl includes headers, SDK boilerplate for each platform,skillRouting). When showing to the userbare URLs are prohibited, must choose one example from invokeGuide.sdk according to the current project type, for REST prefer invokeGuide.rest.curl
For details see MCP project docs/deploy-cloud-function.md

8. `invoke_cloud_function`

Execute cloud function: call a deployed cloud function via REST API and return the result.

Trigger words：调用云函数、执行云函数、invoke cloud function、run cloud function。

{
  "inputSchema": {
    "type": "object",
    "required": ["funcName"],
    "properties": {
      "funcName": { "type": "string", "description": "云函数名称，如 rsync_img" },
      "data":     { "type": "string", "description": "JSON 参数字符串，无参传 \"{}\"" }
    }
  }
}

Upstream：POST https://api.codenow.cn/1/functions/{funcName}
Authentication: uses the MCP-configured X-Bmob-Application-Id + X-Bmob-REST-API-Key
No parameters：data must be {}
When only curl boilerplate is needed and not auto-execution, use generate_code → 调用云函数
For details see MCP project docs/invoke-cloud-function.md

9. `list_cloud_functions`

List online cloud functions: get the names of all cloud functions deployed in the current project. The first step of the sync process.

Trigger words：同步云函数、同步函数、拉取云函数、下载云函数、列出云函数。

{
  "inputSchema": {
    "type": "object",
    "properties": {},
    "title": "list_cloud_functionsArguments"
  }
}

Upstream：GET https://api.codenow.cn/1/functions
Return：functions(name array),count、raw
For details see MCP project docs/sync-cloud-function.md

10. `get_cloud_function`

Pull a single cloud function source: get the source code and metadata of an online function by name;code has been decoded to plaintext.

Trigger words：同步云函数、下载云函数 hello、拉取函数 rsync_img。

{
  "inputSchema": {
    "type": "object",
    "required": ["funcName"],
    "properties": {
      "funcName": { "type": "string", "description": "云函数名称，如 hello" }
    }
  }
}

Upstream：GET https://api.codenow.cn/1/functions/{funcName}
Return：funcName、code(plaintext),language、languageName、suggestedFileName(e.g. hello.js）
Local sync: MCP only fetches data; the agent is responsible for creating the cloudfunctions/ directory and writing files (see bmob-cloud-function-development）
For details, see MCP project docs/sync-cloud-function.md

11. `deploy_static_site`

One-click website deployment / static hosting: deploy a single-page HTML or dist archive to Bmob CDN.

Trigger words：一键部署网站、静态托管、部署静态站点、部署网站、上传 dist、托管 HTML。

{
  "inputSchema": {
    "type": "object",
    "required": ["fileName"],
    "properties": {
      "fileName": { "type": "string", "description": "仅允许 .zip / .html / .htm，如 index.html 或 dist.zip" },
      "content":  { "type": "string", "description": "仅单页 HTML 传文件原文。zip 不要传 content，不要 Base64。" },
      "filePath": { "type": "string", "description": "本地文件路径，用于生成 curl --data-binary @路径。远程 MCP 读不到磁盘。" }
    }
  }
}

Single-page HTML：fileName=index.html，content is the raw HTML; this tool deploys it directly
zip / large files：Forbidden: converting zip to Base64 and passing it to MCP (slow, and macOS base64 default line breaks will corrupt it). Only pass fileName + optional filePath. The tool returns needLocalUpload + curl，Agent must be executed immediately with the local Shell curl --data-binary @文件
Invalid extension returns {"code": 158, "error": "file must be zip or html"}
For details, see MCP project docs/deploy-static-site.md

12. `mcp_endpoint_mcp_post`

Server internal loopback endpoint,do not call proactively。

FAQ

Cross-platform Q&A:shared/faq.md(including MCP tool selection and mcp_endpoint_mcp_post explanation).

Anti-patterns

See shared/anti-patterns.md(especially: embedding MCP in production, transmitting keys over plaintext HTTP).

Use case recipes

Static site deployment:shared/recipes/static-site-deploy.md。

Security checklist

Config files must not be committed to git：.cursor/mcp.json / .mcp.json / ~/.codex/config.toml if it contains a real Key, it must be excluded in .gitignore .
delete_single_data and update_single_data must be double-confirmed: these two tools are irreversible; before executing, the agent must show the target objectId and data diff to the user for review.
Do not write create_table.fields in createdAt / updatedAt / objectId / ACL—these fields are already built into Bmob.
Always get_project_tablesbefore writing: skipping this step will cause schemaless Bmob to accept wrong fields and pollute the data.
The current MCP endpoint is plaintext HTTP: the REST API Key in the Header can be sniffed during transmission. Do not call it on public WiFi.
MCP is a development-time tool: do not embed the "agent → MCP" link into production applications; use the SDK for production code.

Common errors

Symptom	Cause	Fix
`deploy_static_site` returns `needLocalUpload`	MCP cannot transmit binary; this is the normal flow	immediately use the local Shell to execute the returned `curl`（`--data-binary`), do not use Base64
zip via MCP Base64 is slow and corrupts	content enters the model context; macOS `base64` default line breaks	Do not convert to Base64.`deploy_static_site` only pass fileName, then run the returned curl
`tools/list` reports `-32602 Invalid request parameters`	did not `initialize` + `notifications/initialized` handshake first	MCP client does this by default; for manual testing, refer to the diagnostic snippet below
Header 401 / 403	App ID or REST API Key is written incorrectly; or the App ID and Key do not belong to the same application	Retrieve them again from the console; note that the "test environment / production environment" keys are different
`add_single_data` succeeds but data does not appear	Field name is misspelled (schemaless does not report an error)	First `get_project_tables` Use the real field name
Pointer field does not take effect	Passed as the string objectId	Change to `{"__type":"Pointer","className":"X","objectId":"..."}`

Diagnostic snippet (manual SSE connection test)

For developers only to verify MCP server connectivity; under normal circumstances the agent handles this automatically.

# 1. 拿 session 端点
curl -s -N 'http://mcp.bmobapp.com/mcp' \
  -H 'Accept: text/event-stream' \
  -H 'X-Bmob-Application-Id: <id>' \
  -H 'X-Bmob-REST-API-Key: <key>' &

# 2. SSE 立刻吐出第一帧 event: endpoint，里面有 session_id
# event: endpoint
# data: /mcp/messages/?session_id=xxx

# 3. POST initialize / notifications/initialized / tools/list 到该 session
curl -s -X POST 'http://mcp.bmobapp.com/mcp/messages/?session_id=xxx' \
  -H 'Content-Type: application/json' \
  -H 'X-Bmob-Application-Id: <id>' \
  -H 'X-Bmob-REST-API-Key: <key>' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"smoke","version":"0.0.1"}}}'

Reference

shared/operation-routing.md — operation-level three-channel comparison (MCP / generate_code / SDK·REST）
Bmob MCP introduction page
shared/mcp-install-snippets.md — configuration templates for five IDEs
Complete REST API documentation — generate_code The generated curl form corresponds to this
Error code dictionary:bmob-error-codes

About this skill

When to use MCP vs when to use the SDK skill

Installation

Mandatory workflow

The real schema of the 12 tools (11 for the agent to call)

1. get_project_tables

2. create_table

3. add_single_data

4. update_single_data

5. delete_single_data

6. generate_code

7. deploy_cloud_function

8. invoke_cloud_function

9. list_cloud_functions

10. get_cloud_function

11. deploy_static_site

12. mcp_endpoint_mcp_post

FAQ