Setoku: Open-Source Self-Hosted Model Context Protocol Knowledge Server for Team Data
Setoku delivers an Apache-2.0 self-hosted Model Context Protocol server and Claude Code plugin that provides read-only AI access to internal databases. It combines deterministic query execution in ClickHouse and Postgres with a human-governed knowledge store to prevent prompt injection context corruption.
Impact: High
Why it matters
You can give Claude Code and Cursor safe, read-only analytics access to production mirrors without leaking database credentials or exposing schema context to third-party cloud servers.
TL;DR
- 01Setoku secures database context by running single-tenant on self-hosted Docker nodes with read-only database privileges.
- 02Prompt injections cannot corrupt persistent enterprise knowledge because changes require human approval in an external admin console.
- 03Claude Code plugins like `/setoku:onboard` automate context ingestion directly from codebase repositories.
Key facts
- License
- Apache-2.0
- Deployment Model
- Self-hosted Docker (Single-tenant)
- Supported Engines
- PostgreSQL, ClickHouse
- Security Boundary
- Read-only engine enforcement + revocable per-user tokens
Self-Hosted Architecture and Security Hardening
Setoku deploys as a single-tenant stack on a basic Linux host or ~$5 VPS using Docker. All internal databases (PostgreSQL, ClickHouse) remain behind a private network, exposing only a lightweight proxy with individual HTTPS connector tokens per user. Read-only limits are enforced directly at the database engine level rather than through SQL parsing, backed by row result caps, statement execution timeouts, and an append-only audit log.
Claude Code Plugin and Context Governance
Developers integrate Setoku into their local coding environment using the official Claude Code plugin market. Agents inspect canonical metric definitions and known schema gotchas via find_context and get_metric tools before formulating queries. To mitigate malicious prompt injections, agent-proposed knowledge changes are queued in an out-of-band admin web console, requiring manual operator approval before entering the persistent knowledge store.
Try it in 2 minutes
git clone https://github.com/Hedgy-Labs/setoku /opt/setoku
cd /opt/setoku && SETOKU_ADMIN_USER=admin ./deploy/bootstrap.sh
/plugin marketplace add Hedgy-Labs/setoku
/setoku:onboardbash
✓ When to use
- Providing Claude Code or Cursor read-only analytics access to production database mirrors
- Preventing vendor context lock-in by self-hosting metric definitions and team knowledge
- Building live interactive dashboards from natural language queries without managing frontend code
✕ When NOT to use
- Scenarios requiring write access or transactional mutations on production databases
- Teams unable or unwilling to self-host Linux/Docker infrastructure
What to do today
- Clone Hedgy-Labs/setoku onto a test VPS and execute `./deploy/bootstrap.sh` to initialize the single-tenant container stack.
- Install the plugin in Claude Code via `/plugin marketplace add Hedgy-Labs/setoku` and run `/setoku:onboard`.
- Configure a read-only PostgreSQL replica connection string to query analytics through Model Context Protocol.
Sources