Bridging the AI context gap: Why your IDE needs a platform contract

Key takeaway: Hosting an MCP (Model Context Protocol) server on Upsun lets AI IDEs like Cursor, Codex, Claude Code and Windsurf reach real infrastructure context (database schemas, service logs, environment variables), closing the gap between local coding assistants and your cloud environment.

The blind spot in AI-assisted development

The common cause of AI-generated bugs isn't faulty logic. It's missing context. When you ask an AI agent to "optimize this query," it reads the syntax but has no view of the state.

It doesn't know whether your Postgres table holds a hundred rows or a hundred million. It can't see your Redis eviction policy, and it has no idea how your network is routed.

The Model Context Protocol (MCP) is an open standard that connects LLMs to external data sources and tools. By tunneling an MCP server into your Upsun environment through the CLI, you make your live infrastructure a readable dependency for your AI.

I. Turning infrastructure into a readable dependency

Key takeaway: an MCP server tunneled into Upsun through the CLI reaches the same services and credentials your application already uses, so the AI grounds its suggestions in your real configuration.

The Upsun CLI opens a secure tunnel from your machine to your project's services, the same ones your application connects to through its relationships. Point a database-specific MCP server, such as the official PostgreSQL MCP server, at that tunnel, and it inherits a live connection without you hand-writing credentials.

That has two effects. The AI tool bases its output on your live environment configuration instead of guessing, which cuts down on hallucinated assumptions and failed deployments. And because connection strings are handled through the tunnel rather than typed into a prompt, the AI agent never has to guess how to connect to your data.

II. The secure "context tunnel"

Key takeaway: the Upsun CLI opens an encrypted connection between your local machine and an isolated cloud environment, so production-grade data isn't exposed to the public internet.

To connect a local instance of Cursor, Codex, Claude Code or Windsurf to your cloud context, you use the Upsun CLI to open a secure tunnel, then point a locally running MCP server at it. This connects your locally run MCP server to a specific preview environment.

• Data isolation: the AI agent only sees the context of the branch you're working on. Upsun provides network isolation and encrypted traffic, so your metadata stays inside the environment.
• Auditability: configuration is version-controlled in your config file, so changes the AI suggests are traceable back to a commit.

III. Why this matters for AI-assisted coding

Key takeaway: real infrastructure context lets AI agents check their suggestions against the actual state of a cloned environment.

Running an MCP server on Upsun gives high-velocity teams three things.

1. Schema literacy: the AI can query your real database schema to check that a generated migration won't break an existing foreign key relationship.
2. Environment awareness: the AI can read the environment variables and service configuration defined in your .upsun/config.yaml,  so the code it writes matches how your project is actually set up.
3. Validation against a clone: because Upsun can clone an environment, the AI works against a replica of your production data rather than guessing at it.

Beyond the local environment

Connecting Cursor to Upsun through MCP closes the context gap for an individual developer. 

As AI-generated code moves toward production, the same configuration the AI read in development is the configuration it meets in production, because both come from your version-controlled config file. 

The harder question is what happens when that code actually tries to deploy.

Frequently asked questions (FAQ)

Is it safe to connect my IDE to a database via MCP?

Yes. The Upsun CLI tunnel opens an encrypted connection to an isolated environment, and only a locally running MCP server talks to it. The AI agent only sees the data inside that environment, and that data doesn't cross the public internet unencrypted.

Does this work with production data?

Upsun can clone an environment, so the MCP server you tunnel in interacts with a replica of your production data. The AI works against realistic data without touching your live site.

How long does it take to set up?

A few minutes once you know the steps: add the service and its relationship to your .upsun/config.yaml, deploy, open a tunnel with the Upsun CLI, then point your editor's MCP configuration at the tunneled connection. Because a branch environment is a full clone, you're not maintaining a separate seed database on top of that.