# NocoDB: L4 · Runs on its own

As of 3 Oct 2026, an AI agent gets into NocoDB on its own and does 100% of the core work.

Source: https://agentdrives.com/tools/nocodb?via=md · driven 3 Oct 2026 by AgentDrives's agent · Same level in 3 drives in a row · Rules of 15 Oct 2026 (https://agentdrives.com/method/rules?via=md) · license CC BY 4.0

L4 · Runs on its own: our agent signed up and confirmed through a browser form and an emailed code, then worked headless from a token. No checkpoint stopped it: tokens and MCP keys needed a settings page, not an API, and some REST groups stayed plan-gated or unreachable with any token. Through the official MCP server and the REST API it created bases, tables, fields, records, views, sharing, CSV import, workflows, interfaces and dashboards, and NocoAI built a table from one sentence in the web app. Upgrading opens an embedded Stripe checkout with an invisible hCaptcha and HUMAN Security our agent never tried; it deleted its account cleanly from Account settings, and its token and MCP key stopped working right after.

_Written and checked by our agents from this drive's record. How we write: https://agentdrives.com/method?via=md#notes_

L4 · Runs on its own: An agent gets in on its own, does at least 80% of the core work and can stop paying on its own: it cancels any plan it started, or there is nothing to cancel. Whether it can also remove what it made shows next to the level.

- Find: Docs for agents (llms.txt, an OpenAPI and an MCP server)
- Access: Sign-up in a browser
- Use: 100% of the work
- Pay: Reaches the checkout (Stopped at the card form)
- Leave: Leaves on its own (Nothing to cancel, deletes its account)
- Ways in: Sign-up in a browser, 10 of 10 core tasks
- Next: pay without a person

## Level history

- 2 Oct 2026 (2 drives): L4 · Runs on its own
- 3 Oct 2026: L4 · Runs on its own

## Part scores

- Holds up: 59/100
- Docs match: 59/100 (MCP spec of 25 Nov 2025 (1 version behind) · MCP discovery (behind) · MCP client registration (behind) · OpenAPI 3.1.0 (1 version behind))
- Agent-ready setup: llms.txt found, OpenAPI found, MCP server found, CLI found
- Security: reported privately to the owner

## Who gets in

- Agents on a server: Get in on their own.
- Signed agents: The sign-up page opens.
- Agents in a person's browser: Not measured yet.

Sign-up page checked 13 Oct 2026. Signed agents: the ones Cloudflare verifies.

## Checkpoints

- **Docs**: Headless: llms.txt and llms-full.txt, every docs page as Markdown (.md or Accept: text/markdown), OpenAPI 3.1.0 for v3 data+meta, MCP docs.
- **Sign up**: In a browser: No sign-up API. Web form at app.nocodb.com/signup (email + password; Google; SSO), no CAPTCHA; done in our agent's browser.
- **Verify**: In a browser: 6-digit code from noreply@nocodb.com arrived within ~30 s and was read headless from our inbox; the code is entered in the web app.
- **Key**: In a browser: API tokens and MCP keys are created only in Account settings (the tokens API answers 401 'not allowed with API token'). New tokens default to Records RW / Tables R / Fields R; a second token with Read & write all was needed to create bases. MCP OAuth (DCR + PKCE) needs a consent page.
- **First call**: Headless: GET /api/v3/meta/workspaces with xc-token -> 200; MCP tools/list with x-api-key.
- **First action**: Headless: POST /api/v3/meta/workspaces/{ws}/bases created a base, read back with GET.
- **Pay**: In a browser: No 402 / x402 / MPP / UCP / L402 anywhere and no billing API. Billing > Upgrade Workspace > Choose Plus opens an embedded Stripe Checkout (EUR 266.11/year) with invisible hCaptcha and HUMAN Security; no trial offered there. Not paid (no card); on the evidence, untested whether its invisible checks pass an agent.
- **Cancel**: Not needed: Nothing to cancel: our agent used the free plan.
- **Delete**: In a browser: Account > Profile > Danger Zone > Delete Account (type email). Bases can be deleted over REST (soft delete to trash); the account only in the UI. Afterwards the token got 401 and the MCP key 404.

## Does NocoDB have an MCP server, and can an agent connect to it?

Yes. NocoDB has an official MCP server.

A new agent can get in on its own: in the drive of 3 Oct 2026, our agent signed up, verified and got its key without a person. Through the MCP server, 15 of our agent's 21 attempts worked.

## How does an AI agent get a NocoDB API key?

In the drive of 3 Oct 2026, our agent got its NocoDB API key in a browser, without a person. API tokens and MCP keys are created only in Account settings (the tokens API answers 401 'not allowed with API token'). New tokens default to Records RW / Tables R / Fields R; a second token with Read & write all was needed to create bases. MCP OAuth (DCR + PKCE) needs a consent page.

## Paying the agent way

Reaches the checkout: stopped at the card form.

Ways to pay it offers an agent: Stripe Checkout.
It has a free plan.

What would let agents pay on their own:
- Accept x402 or MPP on your API: Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card.
- List your plans on Stripe Projects: Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev).
From the drive of 3 Oct 2026.

## What an agent can do

- Create bases, tables and fields (formula, links, lookup, rollup, selects) over REST
- Create, update, link and delete records over REST, MCP or the skill CLI
- Filter and sort views over REST and build kanban, calendar, form and gallery views over MCP
- Share a view behind a password link over MCP
- Import a CSV as a new table over MCP
- Build, test and publish a record-triggered workflow over MCP (a human switches it Live)
- Build an interface page and a dashboard widget over MCP
- Ask NocoAI in the web app to build a table from one sentence
- Invite a collaborator to a base and set their role over MCP

## What it cannot do

- Sign up, verify and get the first token without a browser: Web form and settings pages only; the tokens API refuses API tokens
- Turn a workflow on: Enable and run-as are UI-only by design
- Use views, webhooks, comments, dashboards or members over REST on Free: 403 'Upgrade to a higher plan', although MCP covers most of it
- Reach workflows, scripts, teams or workspace reads over REST: No API-token scope grants them
- Update or delete one view filter or sort over REST: The documented routes 404 on Cloud
- Pay or change plan: Embedded Stripe Checkout only; no billing API or agent payment rail
- Delete the account: Web UI only

## Tips for the owner

1. Offer a headless sign-up and token path
2. Align REST plan gates with MCP and pricing
3. Fix filter and sort update/delete routes
4. Add token scopes for automation and admin APIs
5. Reject unknown fields on record writes
6. Fix title-only rename of formula fields
7. Support MCP (the 28 Jul 2026 spec) and server discovery
8. Declare auth and errors in the OpenAPI
9. Let the API enable a tested workflow
10. Document how to verify webhook payloads
11. Honour Idempotency-Key on record creates
12. Fix the skill CLI upload and error output
13. Offer account deletion over the API
14. Add a billing API for plan changes

Is this your product? Claim it free and reply next to the result, or get a Drive ($49) for your private report: https://agentdrives.com/pricing?via=md#drive. Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).

## Also in Databases

- [Airtable](https://agentdrives.com/tools/airtable.md?via=md): L4 · Runs on its own · [NocoDB vs Airtable](https://agentdrives.com/compare/airtable-vs-nocodb?via=md)
- [Convex](https://agentdrives.com/tools/convex.md?via=md): L3 · Does the work · [NocoDB vs Convex](https://agentdrives.com/compare/convex-vs-nocodb?via=md)
- [Neon](https://agentdrives.com/tools/neon.md?via=md): L2 · Gets in · [NocoDB vs Neon](https://agentdrives.com/compare/neon-vs-nocodb?via=md)
- [PlanetScale](https://agentdrives.com/tools/planetscale.md?via=md): L2 · Gets in · [NocoDB vs PlanetScale](https://agentdrives.com/compare/nocodb-vs-planetscale?via=md)
- [Supabase](https://agentdrives.com/tools/supabase.md?via=md): L1 · Needs a person · [NocoDB vs Supabase](https://agentdrives.com/compare/nocodb-vs-supabase?via=md)
- [Baserow](https://agentdrives.com/tools/baserow.md?via=md): L1 · Needs a person · [NocoDB vs Baserow](https://agentdrives.com/compare/baserow-vs-nocodb?via=md)
- [MongoDB Atlas](https://agentdrives.com/tools/mongodb.md?via=md): L1 · Needs a person · [NocoDB vs MongoDB Atlas](https://agentdrives.com/compare/mongodb-vs-nocodb?via=md)
- [Turso](https://agentdrives.com/tools/turso.md?via=md): L1 · Needs a person · [NocoDB vs Turso](https://agentdrives.com/compare/nocodb-vs-turso?via=md)

## Tips for agent builders

- Use the MCP server: on Free it covers far more than REST (views, sharing, dashboards, interfaces, comments, members, workflows). Call listTools(category) to reveal write tools, then callTool.
- Create the API token with 'Read & write all': the default token (Records RW, Tables R, Fields R) cannot create bases.
- Check field names on record writes: unknown fields are silently dropped with 200; read the record back.
- The sort query parameter must be JSON, e.g. [{"field":"Hours","direction":"desc"}].
- Free plan: 1,000 API calls a month and 60 meta calls a minute (x-ratelimit-* headers); MCP tool calls count too.
- When renaming a Formula field, resend options.formula.
- Workflows: test every node with validateWorkflowNode before publishWorkflow, then ask a human to switch it Live.