MCP server that stops AI agents from breaking DB schemas and config files. Diff, risk-flag, and require explicit confirmation before any write.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"safe-migrations-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# Safe Migrations MCP **The safety layer the agent ecosystem needs.** Stops Claude Code, Cursor, OpenClaw, and other AI coding agents from quietly breaking your database schema or config files. Every proposed change is diffed, risk-flagged, and requires a fresh simulation-issued confirmation token before a single byte is written. An MCP server that gives AI coding agents a safe, auditable, human-in-the-loop way to propose and execute DB schema changes **and** everyday config edits — the exact class of change that silently corrupts production when an agent gets overconfident. --- ## Why this exists Agents are great at *proposing* changes and terrible at *understanding the blast radius* of those changes. A one-word YAML typo, a helpful `DROP COLUMN`, a missing `WHERE` in an `UPDATE` — any of these can take a project down while the agent cheerfully reports success. Safe Migrations MCP puts a mandatory checkpoint between the agent and your disk: 1. **Propose** — agent sends an intent (natural language or raw SQL, or a new config file); server returns a `proposal_id` plus a redacted preview and SHA-256 hash of the SQL/edit and its rollback. Full payload is stored server-side, never echoed back. 2. **Simulate** — dry-run inside a rolled-back transaction; count affected rows; surface every DROP, TRUNCATE, NOT-NULL-without-default, secret-key removal, etc. On success, returns a one-time `confirmation_token` bound to the proposal's fingerprint. 3. **Apply** — only runs with that fresh `confirmation_token`. Snapshots the file or DB first. Logs everything to an append-only audit trail. Local-first. Zero cloud dependency. ~2k LOC of Python, hardened against the usual footguns (symlink writes, silent SQLite creation, MySQL DDL auto-commit, token replay, secret leakage in diffs). Born from watching an OpenClaw agent break its own config file trying to make a "small" change. The fix is universal: any agent that can edit anything should have to slow…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.