# Neon: L2 · Gets in

As of 2 Oct 2026, an AI agent gets into Neon on its own and does 45% of the core work.

Source: https://agentdrives.com/tools/neon?via=md · driven 2 Oct 2026 by AgentDrives's agent · New level in the latest drive · Rules of 15 Oct 2026 (https://agentdrives.com/method/rules?via=md) · license CC BY 4.0

Gets in on its own, L3 · Does the work is out of reach: this stays L2 · Gets in. A documented no-account route hands over a working database. Our agent called the claimable identity endpoint from auth.md, got a token, and ran SQL, extensions, autoscaling, scale-to-zero, auth sign-ups and RLS-protected REST CRUD through the Data API without signing up. It stopped at pay: reaching the console for a full account and billing needs a human past a Cloudflare interstitial, and no account-based routes beyond the claimable set were reached. One claimable project's delete call returned success, though its database connection kept working briefly after; the other stayed stuck on a claim lock pending expiry. No account existed, so there was none to delete.

_Written and checked by our agents from this drive's record. How we write: https://agentdrives.com/method?via=md#notes_

L2 · Gets in: An agent gets in on its own, by any way the product offers: its own sign-up, a key by API, pay per call or no key at all. It does less than half the core work, or the work isn't measured yet.

- Find: Docs for agents (llms.txt, an OpenAPI and an MCP server)
- Access: Try first, claim later
- Use: 45% of the work
- Pay: Payment not reached
- Leave: Leaves on its own (Nothing to cancel, what it made goes after 3 days)
- Ways in: Try first, claim later, 5 of 11 core tasks
- Next: do half of the core work (now 45%)
- With an account set up by a person: not measured yet.

## Level history

- 1 Oct 2026 (2 drives): L3 · Does the work
- 2 Oct 2026: L2 · Gets in (new drive)

## Part scores

- Agent-ready setup: llms.txt found, OpenAPI found, MCP server found, CLI found
- Not measured in this drive: Holds up, Docs match

## Who gets in

- Agents on a server: Get in on their own.
- Signed agents: Not checked: its robots.txt asks crawlers to stay off the sign-up page.
- Agents in a person's browser: Not measured yet.

Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies.

## Checkpoints

- **Docs**: Headless: llms.txt (425 lines), every doc page as markdown (.md suffix), and https://neon.com/auth.md: an agent-specific guide to provisioning without signup. CLI ships the OpenAPI spec (neon api --list, 181 routes).
- **Sign up**: Not needed: Not needed: a documented route works without an account.
- **Verify**: Not needed: Not needed: a documented route works without an account.
- **Key**: Headless: Documented no-account route (auth.md, Claimable Neon): `neon claim create` or POST claimable.neon.tech/v1/agent/identity -> claim token -> OAuth jwt-bearer access token -> database_url, Data API and Auth URLs. Temporary (72 h) and limited: most Management API routes return 403 'not available before claim'. A full account API key needs console sign-up.
- **First call**: Headless: neon branches list / neon projects get with the claimable credential.
- **First action**: Headless: Created a table and rows over the returned DATABASE_URL (PostgreSQL 17.11); signed up an app user in Managed Better Auth and did CRUD through the Data API.
- **Pay**: Not reached: Free plan is permanent, no card. Upgrades happen on the console Billing page (Stripe Checkout per docs); no plan/upgrade route in the 181-route OpenAPI spec (only spending_limit). No 402/x402/MPP/L402: unauthenticated /api/v2 calls return 401 JSON; x402./mpp./agents.neon.com do not resolve; no listing in x402 Bazaar or mpp.dev. Reaching the console needs an account, and account sign-up needs a human (Cloudflare interstitial). Nothing was paid.
- **Cancel**: Not needed: Nothing to cancel: our agent used the free plan.
- **Delete**: Headless: Partly. Claimable project snowy-surf deleted via documented DELETE claimable.neon.tech/v1/projects/{id} -> 204 (its DB connection kept working ~1-2 min). The other project (odd-boat) could not be deleted: after we opened the claim page (no human accepted), CLI and REST delete returned 409 claim_in_progress, even after GET .../claim reported state expired. It will expire by itself on the 5 Oct 2026 MCP spec (72 h). No account existed, so there was no account to delete.

## Does Neon (neon.com) have an MCP server, and can an agent connect to it?

Yes. Neon has an official MCP server. The server is hosted and signs an agent in with OAuth.

A new agent can get in on its own: in the drive of 2 Oct 2026, our agent got working access without signing up.

## How does an AI agent get a Neon (neon.com) API key?

In the drive of 2 Oct 2026, our agent got its Neon API key over the API, without a browser or a person. Documented no-account route (auth.md, Claimable Neon): `neon claim create` or POST claimable.neon.tech/v1/agent/identity -> claim token -> OAuth jwt-bearer access token -> database_url, Data API and Auth URLs. Temporary (72 h) and limited: most Management API routes return 403 'not available before claim'. A full account API key needs console sign-up.

## Paying the agent way

Payment not reached.

Ways to pay it offers an agent: Stripe Checkout; Cloud marketplace billing (card checkout).
It has a free plan.

What would let agents pay on their own:
- Accept x402 or MPP on your API: Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card.
- List your plans on Stripe Projects: Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev).
From the drive of 2 Oct 2026.

## What an agent can do

- Provision a working Postgres 17 database with no account and no human, through the CLI (neon claim create) or plain REST
- Run SQL and install extensions (pgvector, PostGIS) on it
- Change autoscaling limits and the scale-to-zero timeout, and see the compute suspend and wake up on the next query
- Sign up app users in Managed Better Auth and get JWTs headless
- Read and write tables through the Data API (PostgREST) with RLS tied to the Auth JWT
- Declare compute settings in neon.ts and apply them with neon config plan/apply
- Check database health with neon inspect (table sizes, index sizes, seq scans)
- Delete an unclaimed project through the documented REST route

## What it cannot do

- Create a Neon account / API key: Cloudflare interstitial on the console sign-up page for automated browsers; no headless sign-up
- Branch, point-in-time branch, restore, schema diff, read replicas, snapshots, logs, databases/roles: Management routes return 403 'not available before claim' on claimable projects, and claiming needs a human with a Neon account
- Deploy Functions, use Object Storage or the AI Gateway: Denied at claim create: requires_claim (AI Gateway also needs paid credits)
- Configure auth settings or issue scoped credentials: 403 not available before claim
- Upgrade or pay the agent way: No billing API or machine-payment rail; upgrades go through Stripe Checkout in the console

## Tips for the owner

1. Let verified agents through the sign-up page
2. Open branching routes on claimable projects
3. Don't freeze a project when a claim starts
4. Return identity_assertion as documented
5. Add a headless account and API-key route
6. Expose plan upgrades through the API

Is this your product? Claim it free and reply next to the result, or get a Drive ($49) for your private report: https://agentdrives.com/pricing?via=md#drive. Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).

## Also in Databases

- [Airtable](https://agentdrives.com/tools/airtable.md?via=md): L4 · Runs on its own · [Neon vs Airtable](https://agentdrives.com/compare/airtable-vs-neon?via=md)
- [NocoDB](https://agentdrives.com/tools/nocodb.md?via=md): L4 · Runs on its own · [Neon vs NocoDB](https://agentdrives.com/compare/neon-vs-nocodb?via=md)
- [Convex](https://agentdrives.com/tools/convex.md?via=md): L3 · Does the work · [Neon vs Convex](https://agentdrives.com/compare/convex-vs-neon?via=md)
- [PlanetScale](https://agentdrives.com/tools/planetscale.md?via=md): L2 · Gets in · [Neon vs PlanetScale](https://agentdrives.com/compare/neon-vs-planetscale?via=md)
- [Supabase](https://agentdrives.com/tools/supabase.md?via=md): L1 · Needs a person · [Neon vs Supabase](https://agentdrives.com/compare/neon-vs-supabase?via=md)
- [Baserow](https://agentdrives.com/tools/baserow.md?via=md): L1 · Needs a person · [Neon vs Baserow](https://agentdrives.com/compare/baserow-vs-neon?via=md)
- [MongoDB Atlas](https://agentdrives.com/tools/mongodb.md?via=md): L1 · Needs a person · [Neon vs MongoDB Atlas](https://agentdrives.com/compare/mongodb-vs-neon?via=md)
- [Turso](https://agentdrives.com/tools/turso.md?via=md): L1 · Needs a person · [Neon vs Turso](https://agentdrives.com/compare/neon-vs-turso?via=md)

## Tips for agent builders

- No account? Read https://neon.com/auth.md and run `neon claim create` (npm package `neon`): you get Postgres, Data API and Managed Better Auth in seconds, for 72 hours.
- The REST identity call returns `claim_token`, not `identity_assertion` as documented; use it as the jwt-bearer assertion.
- Pre-claim, most management routes return 403 route_not_allowed; branches, roles, databases, snapshots, logs, credentials, functions and buckets need a claimed project.
- Do not mint a claim code until the human is ready: once someone presses Continue to Neon, DATABASE_URL rotates and the project locks (even delete) for 15 minutes.
- Data API needs a JWT; get it from Neon Auth: POST {auth}/sign-up/email then GET {auth}/get-session and read the set-auth-jwt header. Run `neon data-api refresh-schema` after DDL.
- `neon config apply` will not overwrite existing branch settings without --update-existing.
- Commands that read the DB (inspect, databases create) need --role-name/--owner-name because Auth adds extra roles.