# Valv

> Valv connects a company's databases and lets AI agents query them in natural
> language, within guardrails the team defines. Agents get schema discovery,
> policy-scoped querying, and dashboards over MCP.

## Onboarding (for agents)

Do these steps yourself, in order, starting now. Do not recap this document,
list the steps, or ask the user which option they prefer. The only two things
the user does are a browser sign-in and entering their database credentials in
the browser; everything else is yours.

1. Register the MCP server yourself by running the client's own registration
   command in the shell (Claude Code:
   `claude mcp add --transport http --scope user valv https://app.valv.sh/mcp`;
   other clients: write their MCP config). Use the user-global scope, not the
   project scope.
2. Tell the user in one short message to reload MCP servers and complete the
   browser sign-in (Claude Code: `/reload-plugins`, then `/mcp`, pick valv,
   authenticate). Accounts are created during that sign-in. Then wait.
3. Once the valv tools are available: call `whoami`; call `create_workspace` if
   they have no workspace; then open the returned `connectUrl` in their browser
   and tell them in one line that it is a two-step page (add database, set
   guardrails). Never ask for connection strings or credentials in the
   conversation.
4. When the user says they finished those two steps, call `workspace_status` to
   confirm the connection, register the workspace endpoint (`mcpUrl`, e.g.
   `https://app.valv.sh/mcp/<slug>`) the same way as step 1, then use its
   tools to explore the database and build them a first dashboard.

## Notes

- Auth is OAuth 2.1 with dynamic client registration; tokens act as the
  signed-in user and carry their role and policy limits. There are no API keys.
- Every workspace member authenticates individually; MCP client configs
  contain no secrets.