Nhost

The Nhost CLI is used to set up a local development environment. This environment will automatically track database migrations and Hasura metadata.

nix profile install github:nhost/nhost#cli

Install the CLI in a project to pin the version for the whole team:

npm install -D @nhost/cli pnpm add -D @nhost/cli yarn add -D @nhost/cli bun add -d @nhost/cli

npx @nhost/cli@latest --version pnpm dlx @nhost/cli@latest --version yarn dlx @nhost/cli@latest --version bunx @nhost/cli@latest --version

curl -sSL https://raw.githubusercontent.com/nhost/nhost/main/cli/get.sh | bash

curl -sSL https://raw.githubusercontent.com/nhost/nhost/main/cli/get.sh | bash -s 1.38.0

Only needed to pull configuration from an existing Nhost Cloud project or to deploy — skip it for purely local work.

Scaffolds anhost/directory (backend configuration, version-controlled in Git) and afunctions/directory.

Or start from an existing Nhost Cloud project:

Spins up the full stack (Postgres, GraphQL, Auth, Storage, Functions) with Docker and prints the local service URLs.

The Nhost cli ships with an MCP server that lets you interact with your Nhost projects through AI assistants using the Model Context Protocol. It provides secure, controlled access to your GraphQL data, project configuration, and documentation—with granular permissions that let you specify exactly which queries and mutations an LLM can execute. For development, it streamlines your workflow by enabling AI-assisted schema management, metadata changes, and migrations, while providing direct access to your GraphQL schema for intelligent query building.

The source code includes a self-signed certificate for testing purposes. Nhost workers with configured access to AWS may use thecert.shscript to generate a real certificate from Let's Encrypt.

This will build the binary available as thenhostcommand in the terminal.

The certificate script now requires an explicit Kubernetes target. This is a deliberate breaking change for operators who previously ran it without arguments. From the repository root, enter the CLI development shell and run:

nix develop .#cli cd cli && ./cert.sh <namespace> <deployment>

The runtime needs Certbot and its Route53 plugin,kubectl,jq, anddig;shellcheckis included for linting the scripts but is not a runtime dependency. Equivalent host tools may be used instead of the Nix shell. The operator needs working AWS credentials for the Route53 certificate and an active Kubernetes context with Deploymentget,patch, and rollout status/watch access. The script never selects or changes a kubectl context.

The wildcard authentication hook patches the existingACME_CHALLENGE_*environment variables in the Deployment. Each of the nine supported variables must occur exactly once as a direct, non-emptyvaluein one container; duplicate variables,valueFrom, or a changed Deployment layout fail closed. Rapid challenge publication can cause intermediate rollout churn. Only the final invoked hook waits for the final generation and DNS readiness. Challenge values are intentionally retained. If Certbot reuses every cached authorization, it invokes no hook and publication is a valid no-op; if only some are cached, the final hook also validates every retained value.

The rollout timeout, global DNS timeout, and DNS poll interval default to 300, 300, and 2 seconds. Override them withACME_ROLLOUT_TIMEOUT_SECONDS,ACME_DNS_TIMEOUT_SECONDS, andACME_DNS_POLL_INTERVAL_SECONDS. The worst case is therefore roughly ten minutes after the quick patches. DNS uses the system resolver by default. SetACME_DNS_SERVERto a hostname or IPv4 resolver on standard port 53; an authoritative or suitable public resolver is preferred when recursive negative caching delays a new TXT record.

Do not run concurrent certificate requests against the same Deployment: its environment can store only one value for each service. A rollout-time UID or generation change also aborts the run. Validation values are public DNS data andkubectl set envnecessarily exposes the current value in that process's argument list; the hook suppresses value-bearing command output and does not create token state files, so operators should still restrict local process inspection and command tracing.

The Route53 certificate, certificate copy destinations, and final cleanup remain unchanged. Run the command fromcli/so its existing relative output paths continue to resolve.

Agent-operable cloud platform: database, AI, functions, containers, storage and auth over one remote MCP endpoint with 50 tools.

Immutable ledger database with live synchronization

Infino — keyword, vector, hybrid, and SQL retrieval over data on object storage, for AI agents.

Infino — keyword, vector, hybrid, and SQL retrieval over data on object storage, for AI agents.

A decentralized memory layer for AI agents providing secure, persistent storage for conversation history and knowledge.

Maintained Rust replacement for the archived @modelcontextprotocol/server-postgres. Writes are refused twice: sqlparser AST validation before execution, plus database-level default_transaction_read_only and a per-session statement_timeout. Single binary, stdio and Streamable HTTP, schema inspection, column redaction, EXPLAIN cost guard, hash-chained audit log, optional OAuth 2.1, distroless image. MIT.

Zillapi — Zillow Property Data MCP Server

Real-time Zillow property data — Zestimate, listings, photos, schools, taxes, price history — for AI agents via the Zillapi REST API. 4 MCP tools, OAuth 2.1. 3 Python agent skills, MIT-0. Free tier: 100 credits, no card. Corrected re-submission of the existing api.zillapi.com/mcp listing.

Securely retrieve credentials from 1Password for use by Agentic AI.

A self-hostable MCP server for Cloudflare Workers with OAuth login support, using Cloudflare KV for storage.