# Build with an AI agent (/core/build/build-with-an-agent)
**Target audience**: makers and admins who build with Toucan AI. Available with the Grow plan.
The **Maker MCP** lets you build on Toucan AI from the AI agent you already use, such as Claude, Cursor or VS Code, instead of the Toucan interface. You describe what you want. The agent reads your data through Toucan, so what it builds respects your definitions and your access rules.
It covers three jobs, each described below:
* [Model your data](#model-your-data): domains, measures, dimensions, metrics and joins.
* [Secure your data](#secure-your-data): row-level and column-level access per end user.
* [Build a data app](#build-a-data-app): a small web app over your data, formerly called a custom front.
Looking for the other direction, letting your users ask questions from your product? See [Integrate Toucan into your own AI chat](/core/embed/embedding-overview/how-to/integrate-into-your-ai-chat), or [which MCP do I need](/overview/which-mcp-do-i-need).
## How it works [#how-it-works]
The Maker MCP is a server your agent connects to. It exposes Toucan **tools** (read data, write a domain, publish a data app) and **prompts**, ready-made briefs that tell the agent how to do a whole job, such as *Build a data app*.
* **You sign in once, in your browser.** There is no key to copy. The agent never sees your password.
* **One connection is one person in one organization.** It carries the account that approved it and the organization that was active in Toucan at that moment.
* **Only makers and admins can connect.** The tools can simulate any end user's attributes, so an explorer account is refused.
* **Prompts guide, tools enforce.** Safeguards live in the tools: you cannot apply an access policy that was not previewed, whatever the agent was told.
* **Writes are logged.** Every change an agent makes is recorded against your account.
An agent acts with your permissions. Read what it proposes before you approve a write, especially anything that changes who can see which data.
## Connect your agent [#connect-your-agent]
Open **Applications** in the sidebar and select **Connect an agent**, or **Build with your AI agent** if you have no data app yet. Toucan fills in the server address for your environment and a name for your organization. If you don't see the button, either your role is not maker or admin, or data apps are not enabled for your organization: contact your Toucan representative, or connect with the server address below, which gives your agent every tool except the data app ones.
The server address is `https://toucanai.cloud/api/maker-mcp`. Connect **before** you start the agent: an agent cannot add a server to a session that is already running.
| Client | How to connect |
| -------------------------- | --------------------------------------------------------------------------------------------------------- |
| **Claude Code** | Run `claude mcp add --transport http toucan-maker https://toucanai.cloud/api/maker-mcp` |
| **Claude desktop and web** | Use the **Add to Claude** link in the dialog. |
| **Cursor, VS Code** | Use the **Add to Cursor** or **Add to VS Code** link in the dialog. |
| **ChatGPT, other agents** | Paste the server address in the connection settings. In ChatGPT, turn on developer mode first. |
Any client that supports remote MCP servers with OAuth sign-in works. Need another tool, such as Codex? [Ask us](mailto\:help@toucantoco.com) and we will add instructions.
The first call opens your browser, asks you to sign in to Toucan if needed, and shows a consent screen with the agent's name, your account, the organization it will be tied to and the permissions it asks for. Select **Allow** once.
**Use one name per organization.** Register the server per project under a name that says which login and organization it carries, for example `toucan-greenflow`. Agent prompts are named after the server, so the slash command becomes `/toucan-greenflow:build_custom_front`. To point an agent at another organization under the same name, switch organization in Toucan and authorize again.
To revoke a connection, open your account settings, go to the **Security** tab, and select **Remove access** next to the agent under **Connected applications**. It stops working on the next request.
## Model your data [#model-your-data]
Your agent can read what your organization already has, then add to it.
**Read**
* `list_databases` lists the databases, tables and columns you are allowed to see, with the ids every query needs.
* `list_domains` and `get_domain` read your domains: their tables and joins, dimensions, metrics and measures.
* `run_data_query` runs a query against your semantic layer and returns the first 100 rows, with the same security as production.
**Write** (creating and changing domains)
* `create_domain` and `update_domain` define a domain over some of a database's tables, joined into a tree. `find_domain_join_candidates` proposes the relationships that can join them.
* `create_domain_measure`, `create_domain_dimension` and `create_domain_metric` add the building blocks. Matching `update_…` tools change them.
Two rules protect your model. The agent asks for your approval before each write, and **it cannot delete anything**: a domain's tables and joins can only be added to.
For a precise result, start your request with the business meaning: *"Create a Sales domain over orders and customers, with revenue as the sum of order amount."*
## Secure your data [#secure-your-data]
Access policies decide which rows and columns each end user sees. They apply **live, to every user at once**, with no draft. For that reason the agent can only apply a change that it previewed first.
1. `list_user_attributes` shows how your end users are described (for example `company_id`), and `define_user_attribute` creates one if none matches.
2. `get_access_policy` reads a table's row-level and column-level policies. A change replaces the whole policy, so the agent starts from the stored one.
3. `preview_access_policy` saves nothing. For two to five sample users, and one with no attribute values, it shows the rows they see now and after the change, the columns they keep, a few sample rows, and warnings: a user left with no rows, a rule that loosens the current one, a hidden column that a domain uses.
4. `apply_access_policy` applies the change only if it matches a preview from the same maker, for the same table and change, in the last 30 minutes, and the stored policies haven't changed since.
Invoke the **Secure my data** prompt (`secure_my_data`) to walk through these steps with the agent: pick the key column, describe your users, preview, apply once you approve, then check the result as each user.
See [Row-level security](/core/build/security-and-governance/row-level-security-rls-operators) and [Column-level security](/core/build/security-and-governance/column-level-security-cls) for how policies work.
## Build a data app [#build-a-data-app]
A data app (formerly called a custom front) is a small web app that Toucan stores, serves and shows. It reads your data through Toucan, as the viewer, so row and column security apply automatically. It holds no key or token.
Two prompts drive the work:
* **Build a data app** (`build_custom_front`): the agent reads your organization's preferences and data, settles the query with you, writes the files, and shows you a draft.
* **Edit a data app** (`edit_custom_front`): the agent finds the app, reads its current code, and changes it.
Both take an optional *instructions* argument: what to show, for whom, and how it should look.
Every app has **versions**. The agent edits the **draft**, you review it at its address, then `commit_custom_front_version` freezes it and `publish_custom_front_version` serves it to readers. A draft can never be published directly, and the agent asks before publishing because it replaces what everyone sees. Values that people will want to change later, such as targets and labels, live in the app's store, and changing one takes effect immediately, with no publish.
An agent that can run a shell uploads files directly over HTTP (`get_custom_front_upload_url`), which is faster and cheaper for large files and built bundles than sending them through the conversation.
If your organization defines user attributes, tell the agent which values to preview with, for example *"company is Green Flow"*.
Tool names still say `custom_front`. They create and manage data apps. The [tools reference](/references/mcp-tools) lists them all.
## Coming soon [#coming-soon]
We are extending the Maker MCP so that an agent can run a whole project from start to finish:
* **Keep your schema fresh and choose which tables people and agents can see.**
* **Analyze your data with AI, review the proposals and define joins**, guided end to end.
* **Manage access to data apps and dashboards** for explorers, through user attributes.
## Troubleshooting [#troubleshooting]
| Symptom | What it means |
| -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **`401` on every call** | The agent has no valid credential. Authorize again. If it keeps failing, you may have lost the maker role, or the connection was removed. |
| **`403 access_denied` while authorizing** | The account is not a maker or admin of the organization, or no organization is active in Toucan. |
| **The agent lists database tools but no data app tools** | Data app tools are not available on this organization yet. Contact your Toucan representative, then reconnect: the tool list is set when the session connects. |
| **The wrong organization** | A connection carries the organization that was active when you approved it. Switch organization in Toucan and authorize again. |
| **A tool error message** | These say what to fix. Let the agent read it and retry. |
See [MCP access and security](/core/govern/security-model/mcp-access) for how authentication and permissions work.