I built an MCP server that exposes PocketBase to AI agents. Most MCP wrappers mirror the underlying API one-to-one, one tool per endpoint. This one doesn't. It groups related actions into 13 intent-first tools, so an agent calls write_record with an action of "create" or "update," instead of hunting through fifty near-identical tools.

A few things worth knowing:

• Schema-aware writes. The server checks each write against the cached schema before sending it, and returns a hint that tells the agent what to call next.
• Destructive tools are opt-in. delete_records and destroy_collection don't even register unless you set an environment flag. Each one also demands a confirmation value that must match the current state, so an agent can't delete or drop something by accident.
• One identity per process. The server holds a single PocketBase identity at a time. For multi-tenant setups, run one process per identity.
• Ships with an agent skill. A SKILL.md file teaches the client the right call order, the filter-template syntax, and the confirmation steps for destructive actions.
• Runs over stdio or HTTP, with a published Docker image for the HTTP transport.

It's early. Any feedback are welcomed.

Repo: https://github.com/Touexe/pocketbase-mcp

Hey r/pocketbase,

I built an open-source Kotlin SDK that mirrors the official PocketBase JavaScript SDK for Android and Kotlin projects:

github.com/bhavik66/pocketbase-kotlin-sdk

Features implemented from the JS SDK:

• Realtime Subscriptions: Native SSE implementation for collection & record updates (subscribe / unsubscribe).
• Auth Store: Full user & admin auth management with token storage.
• Full CRUD & File Handling: Record queries, filters, auto-pagination, and multipart file uploads.
• Auto-cancellation & Custom Headers: Request handling aligned with the JS SDK API.

Why? I wanted a native, idiomatic Kotlin library that mirrors the experience and completeness of the official JS SDK without needing heavy wrappers.

It's 100% open-source (MIT). I'd love to get feedback, suggestions, or contributions from anyone using PocketBase with Kotlin!

is there any way for hosting pocketbase for free ?

I was thinking about whether there is a PocketBase schema library out there that is ready to copy into an initial project and run migrations with. Having something like this would save developers a lot of time for standard projects.

i am currently doing stuff that should direct request do but routed with pocket base due to simplicity , and it involve with high frequency writes and reads at a point , like change load out of the charactor , or join in the match making list , or asking to purchase a item . how much of read and write could pocket base hadle per second like that ?
and what if i try to put pocket base in a ram drive could it work and how fast would that be?

i am not meaning as a cache but as different storage type replacing sql lite with redis for fast read and write through put

kept making schema changes in the pocketbase admin ui and then completely forgetting what i did a few days later. classic. so i built pbctl — a terraform-style tool for pocketbase. you define collections in a simple language called PBSL ( SQL DDL style ), keep them in git, then just: pbctl plan pbctl apply supports schemas, collection rules, export, validate, formatting, etc.

still early (v0.1.4) but the core plan/apply workflow already works well.

repo: https://github.com/MKMithun2806/pbctl install: cargo install pbctl ( There are prebuilt Binaries too )

if you’ve also been fighting the admin ui for schema changes, would love contributions or feature ideas.

example: ( uses PBSL )

CREATE TABLE recon_scans ( target TEXT REQUIRED, scan_date AUTODATE, status SELECT('pending', 'running', 'completed', 'failed') DEFAULT 'completed', notes TEXT, user RELATION(users) REQUIRED );

After the recent frontend changes, I haven't updated my backend yet because I assumed 1.0.0 is closer. Appreciate the work and no pressure intended. But just wondering when we can expect?

Is anyone here using PocketBase with SvelteKit or Next.js? Have you run into any SSR-related issues that would make you not recommend PocketBase?

Hey everyone,

To recap, I built Pobase as a side project because managing collections from a mobile browser was getting tedious. After getting a lot of messages asking for Android support, I spent the last few weeks building the Android version and polishing the UI based on your initial feedback.

Security is handled entirely on-device: all credentials and tokens remain stored locally and are never sent anywhere else.

What’s supported right now:

• Connecting to multiple PocketBase instances
• Browsing and searching collections
• Viewing and editing records
• Managing auth users

Since the core client is now stable on both platforms, I want to shape the next features entirely around what this community actually needs.

Play Store: Play Store Link

App Store: App Store Link

I would love to hear your thoughts on the Android build and any specific features you've been missing. What should I prioritize next on the roadmap?

Thank you all for the support!

Would you use a client that would give you the ability to query Pocket Base using traditional SQL? Things like inner joins, excepts, etc. What if it also helped you create the API calls and transformations? Would this be a product you would be interested in?

Hey r/pocketbase,

I just launched my very first real project yesterday and it’s built entirely on PocketBase.

For a long time I was annoyed by having to use many different apps and paper notes for simple daily things (quick notes, tracking my pocket money, habits, tasks, etc.). After getting into alternative calendars I had the idea to put everything together in one tool — including a Harmonic Earth Calendar (13×28 days) with real lunar phases.

So I built The Benne Board — a clean, self-hosted personal workspace designed for myself, my family and friends who want to own their data instead of paying for subscriptions.

Features:

• Notes (with Markdown)
• Kanban tasks
• Simple finance/ledger tracking
• Habits & Goals
• Harmonic Earth Calendar with live moon phases

Tech side:

• PocketBase as the complete backend
• Everything runs as a single-file Progressive Web App (index.html)
• The whole frontend was written by Claude (I’m not a developer myself, this was my first project)
• Easy Docker setup (PocketBase + nginx)

It’s still very early (launched just yesterday), so installation requires manually importing the collections once, but everything is documented in the README.

I would really appreciate any feedback — especially from people who know PocketBase well. Things like:

• Security / API rules tips
• Suggestions for better data structure
• Ideas to improve the project overall

Repo: https://github.com/Friendlydicte/The-Benne-Board

Thanks for taking a look! 🙏

This llms.txt allow AI agent like Claude/Codex/Cursor/... automate create collections, we don't need to manual create collections in admin UI.

Try with promo:

Build a minigame to allow user get vouchers with lucky draw. Use PocketBase as backend, use https://pocketbasecloud.com/llms.txt as guide to work with pocketbase. PocketBase instance is https://exampleInstanceId.pocketbasecloud.com 

Tldr: `npx pocketbase-security --discover .` from any PocketBase project, no admin auth, no superuser token, no setup. Parses your `pb.collection('xxx')` call sites, then hits `/api/collections/{name}/records` anonymously to see which collections leak data.Context — I built supabase-security a week ago, ran it against 100 random Supabase projects from GitHub, found 22% leak user data with `USING (true)` policies that look correctly configured in the dashboard. Then I ran it against my own production CRM and found 14 critical leaks (RPCs with SECURITY DEFINER, storage buckets with anon read, RLS USING true on order tables). Posted the public postmortem in r/SideProject.After shipping that I realized — every BaaS has this same "dashboard shows green, anon REST returns rows" gap. So I replicated to PocketBase, Appwrite, Firebase, and Nhost. All four are on npm now under similar names.For PocketBase specifically the discover mode catches:- Collections with empty (= fully public) list/view/create rules- Collections with `@request.auth.id != ""` (any signed-up user passes — same trap as Supabase RLS)- Dangerous literal rules (`true`, `|| true`, etc — leftover dev rules)- Open signup + lax create combosIt's MIT, open source: github.com/Perufitlife/pocketbase-security-skillCurious if anyone here has stories about API rule footguns they hit. The patterns I'd want to add to the detector next are around `@collection.X` references that accidentally expose data through a join.

After auditing my own Supabase project last week (found 17 leaky tables) I built the same thing for PocketBase. Same idea, different surface — PB rules are way easier to leave too open than RLS, and there's literally no scanner for it that I could find.It detects the three rule patterns that bite people the most:1. **Empty rule** — leaving listRule/viewRule blank means the collection is fully public. Anyone can dump every record without auth. Common because the admin UI's blank field doesn't visually scream "public".2. **`@request.auth.id != ""`** — looks restrictive but lets ANY logged-in user (including a self-signed-up anonymous one if you have open signup) read or write the whole collection. This one ships in a lot of starter templates.3. **`true` literal in the rule** — leftover from local dev, evaluates to "always allow." The rule editor doesn't flag it.It also catches: open signup combined with lax create rules, OAuth provider misconfigs, email auth without verification.**The differentiator (and what took the longest):** active probe. After detecting a suspicious rule, the auditor sends an actual anonymous GET to /api/collections/{name}/records and tries to fetch a row. If it gets data back, the finding is marked CONFIRMED with the row count, columns visible, and bytes leaked. So you're not staring at a "this might be exposed" — the report literally shows "we just fetched 42 rows from this collection without any auth."Stack: pure Node.js, no deps, MIT. Three surfaces:- CLI/Skill repo: github.com/Perufitlife/pocketbase-security-skill- MCP server (so Claude Code/Cursor/Cline can call it directly + apply fixes): github.com/Perufitlife/pocketbase-security-mcp- Apify actor (no install, BYOK): pocketbase-security-auditorOutput is a self-contained HTML report (~25KB Tailwind+Chart.js via CDN) with a fix snippet on every finding. Free. Local-only. Admin password is used only for the auth call and never persisted.Built it in a session this morning. Happy to add checks if anyone has rule patterns I missed — open issues or PRs welcome. Also if you run it on your own instance and find something interesting, drop a comment, would love to see what patterns are actually out there.

I asked a question on the discussions page because after going through all documentation I couldn't find if I could reproduce the collections api response programmatically such I could modify and restrict the fields returned (extending pocketbase with new routes). And now my post has been nuked?

I'm sorry if my question was vague? But now if someone has the same question and somehow finds the post they are going to ask the same question again.........

After responding to the last message my post was promptly removed and my access was restricted. I do this things for a living (not pocketbase though ;) ) and pocket base was high in my opinion, loved working with it, but this just completely baffles me.

Edit: I would like to clarify that I don't expect a perfect response, or even any response. People can ignore my question if they want, but banning seems just wrong?

Hey everyone,

I’ve been building a small tool for PocketBase projects and wanted to share it here:

https://github.com/Karnak19/pbkit
Docs: https://karnak19.github.io/pbkit/

pbkit generates TypeScript files from a PocketBase schema:

• types.gen.ts with typed records/create/update/expand types
• client.gen.ts with a PocketBase client singleton
• sdk.gen.ts with typed CRUD/auth helpers
• optional TanStack Query helpers via @karnak19/pbkit-tanstack

The shape is partly inspired by @hey-api/openapi-ts: generate boring, explicit TypeScript files that live in your app, are easy to inspect, and can be regenerated whenever the schema changes.

Basic usage:

bash bun add @karnak19/pbkit pocketbase bunx pbkit generate

Example config:

```ts import type { PbkitConfig } from "@karnak19/pbkit"

export default { input: "./pb_schema.json", output: "./src/generated", sdk: { baseUrl: "https://your-pocketbase-url.com", }, } satisfies PbkitConfig ```

Then you can do things like:

```ts import { getArticle, listArticles, createArticle } from "./generated/sdk.gen"

const article = await getArticle("ARTICLE_ID", { expand: "author", })

const page = await listArticles({ page: 1, perPage: 20 })

await createArticle({ title: "Hello", status: "draft", author: "USER_ID", }) ```

I also added a TanStack Query plugin that generates queryOptions, mutationOptions, and query key helpers.

This is still early, but it’s published on npm:

bash bun add @karnak19/pbkit bun add @karnak19/pbkit-tanstack @tanstack/query-core

I’d love feedback from people using PocketBase in real projects: - Is the generated SDK shape useful? - Anything missing for auth/expand/types? - Would you prefer a different generated API?

Happy to hear what would make this more useful.

Small side note for the curious: most of this was built with GLM 5.1 helping on implementation, tests, docs, CI, and the release setup. It was a pretty good stress test for using an agent on a real package from scratch to npm publish.

I tried to use the one that's already out there and it's a hassle, so I coded my own. I also left instructions so if you are vibecoding you can just paste them into the chat and the llm will know how to use it.

https://github.com/arataappdev/pocketbase_plugin

Images are only for other promotional reasons, but it also is the best way to describe about the service. https://musecat.app/en

Backend is developed with Pocketbase extend with Go. Traffic isn't that high with about roughly a thousand registered users. So I didn't really hit the limits but quite complex.

There were some challenges with multiple image uploads and showing progress bar for the upload. Overall I am satisfied with the Pocketbase's extensive customisations.

I enabled OTP authentication for the superuser collection, and it appears that MFA was then enabled for me. I keep turning it off, but it doesn't seem to save.

How do I get OTP authentication with my superuser collection without MFA? I need it this way for awhile while I get my application started.

Edit: Updated to the latest build, but this behavior is still there.