CrescoDB for VS Code
Three things the editor is uniquely placed to do. This is not another database GUI: the CrescoDB dashboard already exists and is better at that.
1. Catch an exposed table before you ship it
schema.cresco gets underlined the moment you save it. A table holding email addresses that anyone can read is a red squiggle on the line that made it public, with the reason in the hover.
This runs cresco audit, the same check cresco deploy uses to refuse a deploy. The editor and the deploy can never disagree, because there is only one implementation.
The status bar shows the count. Click it to re-check.
2. Fix it from the lightbulb
A linter that only points at the problem is half a feature. Every finding carries a correction on the line it is reported:
| The finding |
The fix offered |
| Anyone can read this table, and it holds email addresses |
Signed-in only, or signed-in and each user sees only their own rows |
| Anyone can write or delete here |
Require a signed-in user, or admins only for deletes |
| Any signed-in user can read everyone's rows |
Scope rows to their owner, picking from the columns you actually have |
| This table declares no access at all |
Write the current defaults down, so the next reader can see what you meant |
"read": ["public"] |
Use "*", which is what actually means anyone. "public" is not a role, so it silently locks the table to nobody. |
| Auth is switched off |
Turn it on |
With more than one critical finding, Fix every critical access finding applies them all at once.
The edits are surgical. Only the access block changes, so your formatting survives and a one-key fix stays a one-key diff.
3. Connect your AI agent in one click
CrescoDB: Connect my AI agent (MCP) writes the MCP config for Claude Code, Cursor, VS Code agent mode, or Claude Desktop.
Your agent then gets typed access to the project: read the real schema, add a model, run the API it just generated, and ask whether anything is unsafe to deploy. It stops guessing from what you paste into chat.
Existing MCP servers in that file are preserved. If the file is not valid JSON we refuse to touch it and tell you, rather than replacing whatever was in there.
4. See the shape of your backend
A tree of models and fields in the Explorer. A lock icon for private tables, an open lock for public ones, and per-user tables show the column that scopes them. Click a model to jump to it in the schema.
Commands
|
|
| CrescoDB: Check access control |
Run the audit now |
| CrescoDB: Fix every critical access finding |
Apply every preferred fix in one pass |
| CrescoDB: Connect my AI agent (MCP) |
Write the config for your agent |
| CrescoDB: Start dev server |
cresco dev in a terminal |
| CrescoDB: Open dashboard |
Studio, on the port from your config.json |
| CrescoDB: Turn on auth |
cresco add auth in a terminal |
| CrescoDB: Show logs |
Why the audit could not run |
| CrescoDB: Eject |
Write a folder that runs without CrescoDB at all |
Settings
crescodb.auditOnSave (default on): re-check on every save of schema.cresco. This is the whole point: the warning arrives while you are still editing the table, not after you deploy it.crescodb.cliPath: path to cresco if it is not on your PATH.crescodb.studioUrl: where cresco dev is serving, if it is not the port in your config.json.
Requirements
The cresco CLI: npm install -g crescodb.
The extension only does anything in a project that has a schema.cresco, including one in a subfolder. Run cresco init and it wakes up on its own, with no reload.
If the audit cannot run, the status bar says so rather than looking clean, and CrescoDB: Show logs says why.
