miu-db

README

miudb

A headless database CLI for humans and agents.

miudb is the Go core for miu-db. It keeps the database layer focused on connections, credentials, tunnels, adapters, query execution, schema inspection, MCP, and machine-readable output.

Install

brew install vanducng/tap/miudb

Or install with Go:

go install github.com/vanducng/miu-db/cmd/miudb@v0.2.0

Windows release archives are published on GitHub Releases as zip files. In PowerShell:

$version = "v0.2.0"
$asset = "miudb_windows_x86_64.zip"
Invoke-WebRequest "https://github.com/vanducng/miu-db/releases/download/$version/$asset" -OutFile $asset
Expand-Archive $asset -DestinationPath ".\miudb" -Force
.\miudb\miudb.exe version --output json

Use miudb_windows_arm64.zip on Windows ARM64.

Verify:

miudb version --output json
miudb commands --output json

Native Store

The default native config lives under:

~/.config/miu/db/connections.json

Sensitive values are classified before persistence. New connections store database and SSH passwords outside connections.json by default using the miudb OS Keychain/keyring service.

miudb connections add \
  --name local-app \
  --db-type sqlite \
  --path ./app.db \
  --secret-store keyring \
  --output json

miudb connections list --output json
miudb connections test local-app --output json
miudb query run --connection local-app --sql 'select 1 as one' --output json

Supported secret stores for new connections:

• keyring: OS Keychain/keyring service named miudb by default.
• file: ~/.config/miu/db/credentials.json with mode 0600.
• inline: keep the value in the connection file.
• none: discard the supplied secret and require another resolver later.

If credentials.json is absent, miudb also reads an existing credentials-export.json in the same directory for migrated connections.

Future secret providers can plug into the same SecretRef model, including 1Password and Bitwarden.

Share and Import

To onboard a new machine or teammate, share a connections JSON file and import it. Import merges by name: matching connections are overwritten and the existing connections.json is backed up first to connections.json.bak-<timestamp>.

miudb connections import ./shared-connections.json --output json
miudb connections import ./shared-connections.json --dry-run --output json

Secrets are imported as they appear in the file. A self-contained file with inline passwords needs no extra setup on the target machine; treat it as a secret (mode 0600, secure channel only). Use --dry-run to preview the added/overwritten connections before writing.

Adapters

Daily-driver adapters:

• SQLite
• PostgreSQL
• MySQL
• Snowflake
• BigQuery

SSH tunnel-backed connections are supported for TCP adapters.

MCP

Use miudb as a local stdio MCP server for coding-agent hosts:

miudb mcp serve --transport stdio

The MCP server exposes redacted connection inventory, schema inspection, bounded read-only query execution, pagination, and miudb:// resources. See docs/mcp.md for Codex, Claude Code, Cursor, and VS Code setup.

Development

go test ./...
go build -buildvcs=false -o ./.miu-db/miudb ./cmd/miudb
./.miu-db/miudb commands --output json

See docs/golang-architecture.md and docs/agent-cli.md.