How We Use Claude Code + MCP on Client Projects

What MCP Actually Is

Model Context Protocol is an open standard that lets AI coding tools connect to external services. Think of it as a bridge between Claude Code and the tools your project actually depends on. Before MCP, the workflow looked like this: copy your database schema, paste it into the prompt, ask Claude to write a migration, then manually run it and verify the result.

With MCP, Claude Code can query your database schema directly, read your GitHub issues, inspect your Stripe configuration, and use all of that context when writing code. It is not just autocomplete with extra steps. It is a fundamentally different workflow where the AI has the same context your team does.

How We Set It Up

The setup lives in a JSON configuration file at the root of each project. You define which MCP servers to connect to, provide credentials, and specify any constraints. Each server entry includes the command to run, environment variables for authentication, and optional flags to restrict what the AI can do.

We keep per-project configs rather than a global setup. Every client project has different services, different database structures, and different security requirements. A global config would either be too permissive or too restrictive.

Security is non-negotiable. We use read-only database credentials for MCP connections, scope API tokens to the minimum required permissions, and never store production secrets in the config file itself. Those come from environment variables or a secrets manager.

Supabase: What We Actually Use It For

Supabase is the service where MCP delivers the most value. When Claude Code can see your actual schema, it writes migrations that reference real table names, real column types, and real relationships. No more guessing or hallucinating foreign keys that do not exist.

Schema changes. On a recent client project, we needed to add a multi-tenant permissions layer to an existing database. Claude Code inspected the current schema through MCP, identified the relationships between users, organizations, and resources, and generated a complete migration with the correct foreign keys and indexes. What would have taken 45 minutes of manual SQL writing took about 12 minutes, including our review.

RLS policies. Row Level Security is where we are most careful. Claude Code can draft RLS policies based on the schema and our instructions, but we always review these manually. A permissive RLS policy is a security vulnerability, not a bug. We use MCP to generate the first draft, then a senior engineer reviews every policy before it touches production.

Migrations. Having real schema context means migrations are correct on the first try more often. Before MCP, we would frequently get migrations that referenced columns with the wrong type or missed a NOT NULL constraint. Now Claude Code checks the actual schema before generating the migration, which cuts iteration cycles significantly.

GitHub: Workflow Integration

Connecting Claude Code to GitHub through MCP means it can read issues, understand the current state of pull requests, and create PRs with proper descriptions that reference the original issue.

• -Issues. Claude Code reads the issue description, comments, and labels, then uses that context when writing the implementation. Instead of re-explaining the requirements, you just point it at the issue number.
• -Code review. It can review open PRs with awareness of the project context, catching issues that a generic linter would miss, like queries that do not match the actual database schema or API calls using deprecated endpoints.
• -PR creation. After implementing a feature, Claude Code can create a pull request with a detailed description, link it to the original issue, and add appropriate labels. This saves the small but repetitive overhead of writing PR descriptions for every change.

Stripe: More Careful Territory

We connect Claude Code to Stripe through MCP, but with strict guardrails. Production Stripe access is read-only. Claude Code can inspect product configurations, subscription plans, and webhook setups, but it cannot create charges, modify subscriptions, or change pricing.

In test mode, we allow write access. This lets Claude Code create test products, set up webhook endpoints, and generate test data for integration testing. The key distinction is simple: anything involving real money stays read-only. Anything in the sandbox is fair game. This boundary has never caused friction because the read access alone is incredibly valuable for writing correct integration code.

What Works Well

• -Boilerplate with context. Writing CRUD endpoints, form validations, and API routes is dramatically faster when Claude Code already knows your schema, your existing patterns, and your service configurations. It does not just generate generic code. It generates code that fits your project.
• -Consistency. Because Claude Code sees your existing codebase and your service configurations simultaneously, the code it generates is consistent with your established patterns. Naming conventions, error handling approaches, and API response formats stay uniform.
• -Cross-layer debugging. When a bug spans the database, the API, and the frontend, having MCP access to all three layers means Claude Code can trace the issue across the full stack. It can check if the schema matches the query, if the API response matches the frontend expectations, and if the Stripe webhook payload matches your handler.
• -Documentation. Claude Code can generate accurate documentation because it reads the actual service configurations rather than relying on potentially outdated comments in the code.

What Still Needs Manual Work

• -Anything with financial consequences. Billing logic, subscription management, and payment flows always get manual review and manual testing. MCP gives Claude Code visibility into Stripe, but the decision-making for anything involving real money stays with humans.
• -Complex business logic. When the logic involves domain-specific rules, regulatory requirements, or nuanced edge cases that are not captured in the schema, Claude Code needs explicit guidance. MCP gives it data context, not business context.
• -Cross-service state management. When a user action needs to update Supabase, trigger a Stripe event, and create a GitHub issue simultaneously, the orchestration logic needs careful human design. Claude Code can implement each piece, but the coordination and error handling across services requires architectural decisions.
• -Performance optimization. MCP gives Claude Code schema access, but it does not give it query performance data. Index optimization, query planning, and caching strategies still need a human who understands the actual traffic patterns.
• -Security configuration. RLS policies, API token scopes, and CORS settings are always reviewed manually. Getting security wrong has consequences that no amount of time savings can justify.

The Setup Cost Is Worth It

Setting up MCP for a new client project takes about 30 minutes. You configure the JSON file, set up the credentials, test each connection, and verify the access scopes. That is it. No complex infrastructure, no additional servers, no ongoing maintenance.

On our last 8-week client project, we estimate MCP saved 10 to 15 hours of development time. Most of those savings came from eliminating the copy-paste-context loop for database work, faster PR creation and review cycles, and more accurate first drafts of integration code.

The real value is not just speed. It is accuracy. When Claude Code works with real context instead of pasted snippets, the code it generates is correct more often on the first try. Fewer review cycles, fewer back-and-forth corrections, and fewer bugs that slip through because the AI was working with outdated or incomplete information.