# SchemaStack > Tables, relationships and validation created visually — as real SQL schema, with previewed migrations, in a Postgres or MySQL database you own. Import an existing schema or start empty. Instant REST API, AI-agent access, no lock-in. SchemaStack is a hosted data platform where the spreadsheet builds the database: editing the UI creates real SQL schema — tables, foreign keys, constraints, indexes — in a PostgreSQL or MySQL database the customer owns, with every structural change previewed as a migration first. SchemaStack itself stores only metadata; customer records live in the customer's database and are never copied here, so leaving requires no export. AI agents connect through a governed OAuth flow or scoped API keys. Every page listed below is available as Markdown: append `.md` to its path, or send `Accept: text/markdown`. The exception is the status page, which is generated when it is viewed and has no snapshot. The site also answers programmatically — see Interfaces. ## Pages - [SchemaStack — Build like a spreadsheet. It builds your database.](https://schemastack.io/index.md): Tables, relationships and validation created visually — as real SQL schema, with previewed migrations, in a Postgres or MySQL database you own. Import an existing schema or start empty. Instant REST API, AI-agent access, no lock-in. - [About](https://schemastack.io/about.md): Learn about SchemaStack — our mission to give teams structured data management on their own infrastructure with no vendor lock-in. - [Careers](https://schemastack.io/careers.md): Join the SchemaStack team — we're building the future of structured data management. See open positions. - [Status](https://schemastack.io/status): Real-time health status of all SchemaStack services — API, database, messaging, and more. - [Terms of Service](https://schemastack.io/terms.md): SchemaStack Terms of Service — the rules and conditions for using our structured data management platform. - [Privacy Policy](https://schemastack.io/privacy.md): SchemaStack Privacy Policy — how we collect, use, and protect your personal data. - [SchemaStack vs Airtable — The Own-Your-Data Alternative](https://schemastack.io/vs-airtable.md): Looking for an Airtable alternative that keeps your data in your own Postgres or MySQL database, with a real REST API and no per-seat pricing? See how SchemaStack compares to Airtable. - [SchemaStack vs Retool — Which One Should You Ship For Your Client?](https://schemastack.io/vs-retool.md): Retool is for internal tools. SchemaStack is for client-facing collaborative data tools — with guest access, a real REST API, and your client's data staying in their own Postgres. Honest head-to-head comparison. - [SchemaStack vs NocoDB — Hosted, With an AI Layer](https://schemastack.io/vs-nocodb.md): NocoDB is open source and you host it. SchemaStack is hosted for you, runs on your own Postgres or MySQL, and adds an MCP server that previews schema migrations before they run. An honest comparison. - [SchemaStack vs Baserow — Your Database, Not Ours](https://schemastack.io/vs-baserow.md): Baserow is an open-source Airtable alternative you host yourself. SchemaStack is hosted and writes straight into the Postgres or MySQL database you already own — with an AI layer for schema work. An honest comparison. - [SchemaStack vs Directus — The Spreadsheet That Builds the Schema](https://schemastack.io/vs-directus.md): Directus is a mature, source-available data platform you usually host yourself. SchemaStack is hosted and spreadsheet-first: the grid your team edits builds real SQL schema, with previewed migrations and governed AI-agent access. An honest comparison. - [SchemaStack + Supabase — A Team UX Layer for Your Supabase Database](https://schemastack.io/with-supabase.md): Already on Supabase? Give your non-technical teammates a spreadsheet-style editor, saved views, and real-time collaboration — without moving your data. SchemaStack connects directly to your Supabase Postgres. - [Blog](https://schemastack.io/blog.md): One feature per post: building real SQL schema from a spreadsheet, governing AI agents, guest access, the generated API — short deep-dives into what SchemaStack does. ## Blog Single-feature posts. Each states when and how its claims were last verified. - [The table that points at itself](https://schemastack.io/blog/self-referencing-tables.md): Categories with a parent category, employees with a manager, comments replying to comments — one table, one foreign key pointing home. You can build it from the picker now, and read a whole chain of it in the grid. - [Importing the same file twice](https://schemastack.io/blog/import-without-duplicating.md): Imports only ever added, so re-importing a corrected export gave you everything twice. Name the columns that identify a row and the second import skips or corrects instead of duplicating. - [A key that can't see the whole workspace](https://schemastack.io/blog/mcp-key-scoping.md): An MCP key you hand an agent isn't all-or-nothing. It carries one of three access levels, capped by what the workspace allows, and can be narrowed to named views with a role on each — so a key scoped to one table is refused every other table's data, reads included. - [The join table is a real table](https://schemastack.io/blog/join-tables.md): A many-to-many in SchemaStack is a genuine join table — composite key, two cascading foreign keys — and when it carries columns of its own, a role or a rate, it stays a first-class table you drill through rather than a detail hidden from you. - [The export is a snapshot, not the exit](https://schemastack.io/blog/export-downloads.md): You can export a view to a CSV whenever you like — filtered, streamed by a worker, downloaded from a link only you can open. But it's a convenience, not the escape hatch, because the escape hatch is that the data was already in a Postgres database you own. - [The widget is not the column type](https://schemastack.io/blog/column-widgets.md): A widget decides how a value is typed in and drawn — a date picker, an email link, a currency reading. It sits on top of a plain database column, and the formatting it adds lives in the browser, so the API and the export still see the raw value underneath. - [Rules the API can't skip](https://schemastack.io/blog/validation-rules.md): A validation rule that lives in a form protects the form. Attach it to the column instead and every writer gets the same answer — the REST API, the grid, the import, the Zap, the agent. - [Someone else's keystroke](https://schemastack.io/blog/realtime-collaboration.md): What it takes for a colleague's edit to land in your grid without a refresh — two scoped streams, a keepalive that outlives sleeping laptops, and the three tests that turned out to pass whether any of it worked or not. - [The arrangement you keep rebuilding](https://schemastack.io/blog/filter-presets.md): You filtered, sorted three ways, hid four columns and widened two. A preset saves that whole arrangement — and shares it, so the answer to "how are you looking at this?" is a name instead of a screenshot. - [One cell, five columns](https://schemastack.io/blog/display-groups.md): An address reads as one thing and stores as five. Display groups give you the single cell without giving up the columns underneath it — the query still sorts, filters and exports the parts. - [Your database, wired to 7,000 apps](https://schemastack.io/blog/zapier-integration.md): SchemaStack has a Zapier integration — three triggers, two actions and a search — so a row in a database you own can start a workflow, or be what a workflow writes to. - [Why your green rule never fires](https://schemastack.io/blog/row-styles.md): Two conditional style rules, one row, and the order you put them in decides the colour — plus the four places the styling engine quietly disagrees with the filters on your API. - [The other table's data, without writing the join](https://schemastack.io/blog/relationship-columns.md): A foreign key holds a number. Point a column at the relationship and the grid shows the related row's name, or a count of the rows on the far side, or several values at once — and it will walk more than one hop to get there. - [Polling is not real-time, and here is what that costs](https://schemastack.io/blog/polling-is-not-realtime.md): The grid updates the instant a row changes; a Zap finds out on its next poll. Both are correct, and knowing which is which decides what you should build on. - [The list that isn't in your email tool](https://schemastack.io/blog/own-the-list.md): Signups usually live inside whichever tool captured them. Put them in a database you own instead and every tool becomes downstream — replaceable without an export, queryable without asking. - [The column that isn't there](https://schemastack.io/blog/formula-columns.md): Write an expression and a column appears in the grid — computed on every query, stored nowhere, with nothing to migrate and nothing that can go stale. - [Half our readers aren't people](https://schemastack.io/blog/written-for-machines.md): Every page on this site has a Markdown twin at the same address, the API surfaces are described in a machine-readable catalog, and authentication is published as a document an agent can follow — all generated at build time, so none of it can fall behind. - [Sometimes the right answer is no](https://schemastack.io/blog/migration-dry-run.md): Before altering a column, SchemaStack counts the rows, classifies the operation against the engine you actually run, estimates how long it will take and names what it will lock — and while it runs, the API says 503 rather than hanging. - [Everything you can ask the API for](https://schemastack.io/blog/filtering-and-sorting.md): Twelve filter operators in bracket notation, multi-field sorting against a whitelist, depth-capped relationship expansion and field selection — the full query surface, including the parts that behave badly. - [Your spreadsheet, in a real database](https://schemastack.io/blog/csv-import.md): A CSV becomes typed SQL columns with real constraints — and the rows that don't fit are caught and named before they land, instead of becoming nulls you find in six months. - [When someone ALTERs your table behind our back](https://schemastack.io/blog/schema-drift.md): SchemaStack isn't the only thing touching your database. Here's how it notices when the schema moved without it, what the report tells you, and what sync will and won't reconcile. - [Revoking an agent's access, instantly](https://schemastack.io/blog/instant-revocation.md): Access tokens are stateless, so revoking one is usually a polite request that takes effect when it expires. Here's the approach that doesn't work, and the one we shipped. - [The REST API you didn't write](https://schemastack.io/blog/instant-rest-api.md): Every workspace publishes a full REST API generated from its schema — filtering, sorting, pagination, relationship expansion and an OpenAPI document — with no code generation step and nothing to deploy. - [Bring the database you already have](https://schemastack.io/blog/import-existing-schema.md): Point SchemaStack at an existing Postgres or MySQL database and it reads the schema you already run — tables, columns, types, keys, indexes — then gets out of the way. - [The spreadsheet that builds your schema](https://schemastack.io/blog/spreadsheet-builds-schema.md): Add a column in the grid and a real column appears in your database — with the migration previewed first, rows, locking behaviour, SQL and all. - [Share one table, not your workspace](https://schemastack.io/blog/guest-links.md): Guest links give a client, contractor or auditor live access to exactly one view — read or edit, time-limited, revocable, no account required. - [Your users, their login, their rows](https://schemastack.io/blog/external-idp-rls.md): Point a workspace at your Auth0, Clerk or Firebase and your end-users call the generated REST API with their own identities — row-level security narrows every query to their rows. - [Add your database to Claude with one URL](https://schemastack.io/blog/agent-connector.md): Paste one URL into Claude or ChatGPT and an agent can work in your workspace — after a consent screen, inside scopes that never reach your schema, and revocable in one click. ## Documentation - [What is SchemaStack?](https://docs.schemastack.io/guide/what-is-schemastack): The problem it solves and where it sits in a stack - [Getting started](https://docs.schemastack.io/guide/getting-started): First workspace, first schema, first records - [Key concepts](https://docs.schemastack.io/guide/key-concepts): Organisations, workspaces, views, columns, constraints - [Connecting your database](https://docs.schemastack.io/guide/connecting-your-database): Connection strings, SSL modes, provider specifics - [AI integration (MCP)](https://docs.schemastack.io/guide/ai-integration): The MCP server, its access levels and its full tool list - [Workspace API](https://docs.schemastack.io/api/): The REST API generated for every workspace - [API authentication](https://docs.schemastack.io/api/authentication): API keys, permission levels, rotation - [Filtering, sorting, pagination](https://docs.schemastack.io/api/filtering): Query syntax for the generated endpoints - [Data ownership](https://docs.schemastack.io/guide/data-ownership): What is stored here and what stays in your database - [Changelog](https://docs.schemastack.io/changelog): Dated record of every shipped change ## Interfaces - [MCP server](https://schemastack.io/mcp): Streamable HTTP, protocol 2025-03-26, ~57 tools. Requires an mcp_ key - [Workspace API](https://data.schemastack.io/api/v1/{orgSlug}/{workspaceSlug}/{Entity}): REST CRUD generated per workspace. Requires an sk_live_ key or an OAuth token - [Authentication guide for agents](https://schemastack.io/.well-known/auth.md): Which credential each surface takes and how a human issues it - [Platform status](https://schemastack.io/status): Live service health, refreshed every five minutes - [Sitemap](https://schemastack.io/sitemap.xml): Canonical list of public pages ## Notes - No credential on this platform is self-service. An MCP or API key is issued by a signed-in human from the admin app; there is no registration endpoint and no anonymous tier. - MCP access is `DISABLED` per workspace by default. A valid key against an unconfigured workspace is refused deliberately, not transiently. - Writes through the API or MCP act on a production database belonging to the customer. There is no undo for data writes.