Command map
Bridge currently exposes these subcommands:| Command | Purpose |
|---|---|
init | Create a bridge.yaml file in the current directory |
connect | Add and verify a named provider in bridge.yaml |
remove | Remove a named provider from bridge.yaml |
status | Check the health of configured providers |
ls | List entries from a provider |
read | Read structured context from a provider |
generate mcp | Generate a bridge.mcp/v1 manifest from an OpenAPI spec, Postgres, or SQLite |
mcp serve | Serve a manifest as an MCP server over stdio |
mcp serve-http | Serve a manifest as an MCP server over HTTP |
update | Check for and install CLI updates |
completions | Generate shell completion scripts |
Command conventions
Most Bridge commands follow the same runtime pattern:- load
bridge.yamlfrom the current directory - resolve a named provider if the command needs one
- perform a provider operation inside the configured timeout
- print structured JSON on success
- successful commands print JSON to stdout
- failures print JSON to stderr
- failures exit with a non-zero status code
- exit code
1for most validation and provider errors - exit code
2for I/O, database, and timeout failures
Global options
All commands support the global--timeout flag:
| Flag | Default | Meaning |
|---|---|---|
--timeout <seconds> | 30 | Timeout for provider operations |
bridge --helpbridge --version
Typical workflow
Most teams use the commands in this order:bridge connect verifies targets by default.
If you are connecting a database, the flow stays the same:
bridge.yaml, connect with an environment variable name instead:
bridge init
Create a new bridge.yaml in the current directory.
Usage
What it does
- creates
bridge.yamlif it does not already exist - uses the current directory name as the default project
name - initializes
providersas an empty map
Success output
On first run:Typical use
bridge connect
Add a named provider connection to bridge.yaml.
Usage
<target> can be:
- a literal URI such as
file://./docs,sqlite://./local.db, orpostgres://localhost:5432/mydb - a bare environment variable name such as
DATABASE_URL
Examples
Flags
--type <provider>is required when<target>is an environment variable name--forcereplaces an existing provider with the same name--no-verifysaves the provider without checking connectivity first
What it does
- loads the current
bridge.yaml - interprets
<target>as either a literal URI or an environment variable name - infers the provider type from a literal URI scheme when possible
- refuses to overwrite an existing provider name unless you pass
--force - verifies the provider connection and health by default
- saves the updated config back to disk after successful verification
--no-verify, Bridge saves the provider immediately and returns saved_unverified instead of connected.
When <target> is an environment variable name, bridge connect writes it into bridge.yaml as ${TARGET} and requires --type <provider>. If that variable is not set in your current shell, Bridge still saves the placeholder but marks the connection as unverified because it cannot probe the backend locally.
If verification fails, Bridge leaves bridge.yaml unchanged and returns connection_verification_failed.
Success output
Verified connection:Supported URI schemes
Current built-in inference supports:file://...→filesystemsqlite://...→sqlitepostgres://...→postgrespostgresql://...→postgres
invalid_uri.
Environment-variable targets
When you pass a bare environment variable name such asDATABASE_URL, Bridge:
- requires
--type - stores
uri: ${DATABASE_URL}inbridge.yaml - resolves the actual value from the current process environment when it can verify the provider immediately
- resolves the value later from the process environment when you run
status,ls, orread
bridge connect, Bridge saves the placeholder and returns saved_unverified rather than failing the write.
Bridge does not automatically load a .env file.
Common failure cases
bridge.yamlis missing<target>is neither a supported URI nor a valid environment variable name--typeis missing for an environment-variable target- a provider with the same name already exists and you did not pass
--force - the backend cannot be reached or fails its health check during verification
- an environment variable referenced by
bridge.yamlis not set later at runtime
bridge remove
Remove a named provider connection from bridge.yaml.
Usage
Example
Success output
Failure behavior
If the provider name does not exist, Bridge returns aprovider_not_found error and includes the currently available provider names.
bridge status
Check the health of all configured providers.
Usage
What it does
For each provider inbridge.yaml, Bridge:
- expands environment variables in the URI
- creates the provider
- connects to it
- runs that provider’s health check
Success output
Notes
- the filesystem provider reports a directory status
- the SQLite provider runs a lightweight health query
- the Postgres provider runs a lightweight health query
- URIs are redacted in status messages so passwords are not exposed
- provider status is reported per entry, so one broken provider does not stop Bridge from checking the others
bridge ls
List entries from a provider.
Usage
Examples
Success output
Filesystem example:table entry shape for ls.
Important runtime note
The current--help text says --from is optional, but the current implementation still requires it. If you omit --from, Bridge returns a provider error asking you to specify a provider name.
Typical use
Usels to discover valid paths before you call read.
Common failure cases
config_not_foundif there is nobridge.yamlin the current directoryprovider_not_foundif--fromnames a provider that is not configuredprovider_errorif the backend cannot connect or the configured root is invalidtimeoutif the provider does not respond before the configured timeout
bridge read
Read structured context from a provider.
Usage
Examples
Filesystem:Output
read always returns a structured ContextValue object with:
datametadata
Current path shapes
The meaning of<PATH> depends on the provider:
| Provider | Path shape | Example |
|---|---|---|
filesystem | relative file path under the provider root | README.md |
postgres | table name | users |
postgres | table plus primary key | users/42 |
sqlite | table name | users |
sqlite | table plus primary key | users/42 |
--limit
--limit is relevant for database-backed reads that return multiple rows.
- default:
100 - applies to whole-table Postgres and SQLite reads
- is ignored for single-row Postgres and SQLite reads
- if omitted, Bridge falls back to
100
Path semantics depend on the provider
- Filesystem paths are file paths under the provider root
- Postgres and SQLite paths are either
tableortable/primary_key
read, see Providers.
Common failure cases
provider_not_foundif the provider name passed to--fromis not configuredpath_traversalif a filesystem read escapes the provider rootprovider_errorif the file, table, or row does not existtimeoutif the provider does not finish the read before the timeout
bridge generate mcp
Generate a bridge.mcp/v1 manifest from an OpenAPI spec, a Postgres connection, or a SQLite connection.
Usage
Flags
| Flag | Required | Description |
|---|---|---|
--from openapi <path> | one of --from | Path to an OpenAPI 3.0 spec file (JSON or YAML) |
--from db | one of --from | Introspect a Postgres or SQLite connection from bridge.yaml |
--connection <name> | with --from db | Name of a Bridge provider in bridge.yaml |
--schema <schema> | no | Database schema to introspect. Defaults to public |
--name <name> | yes | Name for the generated MCP server |
--out <file> | yes | Output path for the manifest file |
--base-url-env <VAR> | OpenAPI only | Environment variable holding the API base URL |
--bearer-env <VAR> | no | Environment variable holding the bearer token |
--force | no | Overwrite an existing file at --out |
What it does
From OpenAPI: Bridge parses the spec, extracts GET operations, maps each operation to an MCP tool with an input schema, and writes the manifest. Operations that cannot be mapped are reported in theskipped field of the output. At least one base URL must be available — either from the spec’s servers array or via --base-url-env.
From database: Bridge connects to the named Postgres or SQLite provider, introspects the schema, and generates list_* and get_*_by_* tools for each table. The manifest stores the connection name, not the connection string, so it is safe to commit.
Success output
client_snippet is the exact config block to paste into Claude Desktop, Cursor, or any MCP client that uses the mcpServers format.
Examples
Limitations
- Only GET operations are supported from OpenAPI specs
- Only Postgres and SQLite are supported as database sources
bridge.yamlmust exist and the named connection must be reachable when using--from db
bridge mcp serve
Serve a bridge.mcp/v1 manifest as a live MCP server over stdio (JSON-RPC 2.0).
Usage
What it does
- reads and validates the manifest at the given path
- resolves any environment variables referenced in the manifest
- starts a JSON-RPC 2.0 MCP server on stdin/stdout
- handles
tools/listandtools/callrequests from MCP clients - for OpenAPI-backed tools: forwards calls as HTTP requests to the backend API
- for database-backed tools: executes parameterized SQL SELECTs against the configured database provider
Example
Configuration
Bridge looks forbridge.yaml in the manifest’s directory when resolving database connections. Place your manifest next to or below the bridge.yaml file that defines the relevant providers.
Environment variables referenced in the manifest (base_url_env, bearer_env, provider URIs with ${VAR}) must be set before running the server.
Wiring into Claude Desktop
Paste theclient_snippet from bridge generate mcp into your Claude Desktop config at ~/Library/Application Support/Claude/claude_desktop_config.json:
bridge mcp serve-http
Serve a bridge.mcp/v1 manifest as an MCP server over HTTP using the Streamable HTTP transport.
Usage
Flags
| Flag | Default | Env var | Description |
|---|---|---|---|
--bind <HOST:PORT> | 127.0.0.1:8080 | BRIDGE_MCP_BIND | Address to listen on |
--public-url <URL> | — | BRIDGE_MCP_PUBLIC_URL | Public base URL reported in health output and logs |
--max-header-bytes <N> | 32768 (32 KB) | BRIDGE_MCP_MAX_HEADER_BYTES | Max HTTP header bytes per request |
--max-body-bytes <N> | 1048576 (1 MB) | BRIDGE_MCP_MAX_BODY_BYTES | Max HTTP body bytes per request |
--read-timeout-secs <N> | 15 | BRIDGE_MCP_READ_TIMEOUT_SECS | Budget for reading an HTTP request off the wire |
--request-timeout-secs <N> | global --timeout | BRIDGE_MCP_REQUEST_TIMEOUT_SECS | Budget for handling a request after it is read |
--shutdown-grace-secs <N> | 10 | BRIDGE_MCP_SHUTDOWN_GRACE_SECS | Time to drain in-flight requests on shutdown |
--allow-origin <ORIGIN> | — | — | Extra Origins to accept (repeat for multiple) |
Endpoints
| Path | Method | Purpose |
|---|---|---|
/mcp | POST | MCP endpoint (Streamable HTTP transport) |
/healthz | GET | Liveness check. Returns 200 when the server is running. |
/readyz | GET | Readiness check. Returns 200 when the server can handle requests. |
CORS and origin policy
Requests with noOrigin header are always accepted (non-browser clients do not send one). Browser-originated requests must have an Origin that is either a loopback address or one of the values passed to --allow-origin.
Examples
Graceful shutdown
The server listens for SIGTERM and SIGINT. On receipt, it stops accepting new connections and waits up to--shutdown-grace-secs for in-flight requests to complete before exiting.
bridge update
Check for and install CLI updates.
Usage
Flags
| Flag | Description |
|---|---|
--check | Report whether an update is available without installing it |
What it does
Without--check, Bridge checks for a newer release and installs it if one is available.
With --check, Bridge reports the current version and the latest available version without making any changes.
Example
bridge completions
Generate shell completion scripts for supported shells.
Usage
bashelvishfishpowershellzsh
Examples
What it outputs
bridge completions writes the completion script text to stdout. You can then save or source that output using your shell’s normal setup flow.
Unlike provider commands, completions does not need bridge.yaml and does not talk to any backend.
See Installation for the current installer behavior, completion file locations, and manual setup examples for each shell.
Common error codes
The most useful error codes to know when scripting Bridge are:config_not_foundinvalid_urienv_var_not_setprovider_not_foundprovider_errortimeoutpath_traversalinvalid_identifier
Choosing the right command
- Use
initonce per project - Use
connectwhen adding or updating a backend - Use
removewhen cleaning up provider aliases - Use
statuswhen debugging connectivity - Use
lswhen discovering valid paths - Use
readwhen you want the actual context payload - Use
generate mcpwhen you want to expose a backend as an MCP server - Use
mcp serveto run an MCP server locally for Claude Desktop or Cursor - Use
mcp serve-httpto run an MCP server over HTTP for remote clients - Use
updateto keep the CLI current - Use
completionswhen improving your shell workflow
Related pages
Installation
See install methods, PATH behavior, and how the official installers set up completions.
Configuration
Learn how
bridge.yaml is structured and how commands resolve provider names.Providers
See what
filesystem, sqlite, and postgres actually return for ls, read, and status.MCP manifest
See the full
bridge.mcp/v1 format and what each field controls.Generate an MCP server
End-to-end guide for generating a manifest from an OpenAPI spec, Postgres, or SQLite.
Serve an MCP server
Run a manifest over stdio or HTTP and wire it into Claude Desktop or Cursor.
Security and errors
Understand timeout handling, error codes, secret redaction, and Bridge’s current guardrails.
CLI interface
See the higher-level JSON contract that sits behind these commands.