Assistants get the same permissions you already have
Two surfaces. Inside the product, natural language becomes SQL against the connected schema. Outside it, a remote Model Context Protocol endpoint lets approved tools inspect workspaces and act with the user's token, and with an explicit confirm flag on anything that mutates state.
Natural language to SQL
The prompt is turned into SQL for the engine you are browsing. It is not a generic chat answer. The query still has to pass environment RBAC before it runs.
Generated and pasted SQL go through the same heuristic analyser as a change script: destructive patterns are flagged before execution, not after.
SQL generation talks to the OpenAI API. There is no multi-provider switch for Anthropic, Azure OpenAI, or OpenRouter in the product today.
GenerateSql is the same capability exposed to assistants.A remote endpoint, not a local dump of your database
Run npx migratrix-setup. It signs the user in, detects Claude Desktop, Cursor, Codex, Windsurf, and Continue, and writes the connector config. Manual clients use https://mcp.migratrix.com/mcp with a bearer token.
| Area | Tools |
|---|---|
| Change scripts | ListChangeScripts, GetChangeScript, SearchChangeScripts, CreateChangeScript, DeleteChangeScript, GetChangeScriptProgress, AnalyzeChangeScriptRisk, ExecuteChangeScript, ApproveChangeScript, RejectChangeScript, RollbackChangeScript, ListPipelines |
| Environments | ListWorkspaces, ListEnvironments, GetEnvironment, CreateEnvironment, UpdateEnvironment, DeleteEnvironment |
| Flows | ListFlows, CreateFlow, DisableFlow, DeleteFlow |
| Executors | ListAgents, GetWorkspaceAgent, GetAgentSettings, GetAgentActivityLogs, TestAgentConnection |
| Audit | GetAuditLog, VerifyAuditIntegrity |
| Auth and AI | Login, GetCurrentUser, GenerateSql |
Approve, reject, execute, rollback, create, and delete require confirm: true. An assistant cannot quietly promote to production because it guessed the next step.
What an assistant is allowed to be
The wider question what any Executor should be allowed to do to a production database has its own page: AI agents and your databases.
Same token as the human
Every MCP call uses the signed-in user's bearer token. If they cannot approve production in the UI, neither can the assistant. There is no superuser MCP key that bypasses RBAC.
Setup is local config, remote runtime
npx migratrix-setup writes the client config. The tools run against https://mcp.migratrix.com/mcp. Restart the editor after setup. The database still sits behind the Executor; the assistant never receives a connection string.
SQL generation is metered
AI Mode in the product comes with a monthly allowance of generated queries per organisation, and it is backed by the OpenAI API. Rollback SQL is never written by a model: it is generated by engine rules on the Executor.
Not a second control plane
MCP lists, inspects, and confirms the same objects the UI does. It does not add schema compare, Conversion Studio, or Drift Monitor as tools today. Those stay in the product.