Every table as REST and MCP tools, permissioned and audited.

The table is the last segment of the path. fc picks columns, oy orders, ps and pg page. No route was written for this; none is written for the other ten relations either.

GET /minimal/api/rest/auto/v1/acme/people/pg/acme/employee?fc=id,full_name,department_id&oy=id.as&ps=5&pg=0 HTTP/1.1
Host: api.acme.example
LB-Access-Token: <your-access-token>

[
  { "id": 1, "full_name": "Rafael Delacroix", "department_id": 11 },
  { "id": 2, "full_name": "Rafael Müller", "department_id": 7 },
  { "id": 3, "full_name": "Rafael Novak", "department_id": 8 },
  { "id": 4, "full_name": "Kwame Haddad", "department_id": 6 },
  { "id": 5, "full_name": "Rafael Haddad", "department_id": 6 }
]

Filters are column=operator.value — department_id=gt.6, full_name=like.Raf*. Page size and page number are mandatory, so no call ever reads a table whole by accident. Vol. I, Chapter 5 is the full query language.

The same path, a DELETE, sent with a token minted for hr-analyst. The table’s permission template lists hr-admin alone on delete. The refusal names the roles the caller held, not the rows it would have touched.

DELETE /minimal/api/rest/auto/v1/acme/people/pg/acme/employee?id=eq.5 HTTP/1.1
Host: api.acme.example
LB-Access-Token: <token · roles hr-analyst · key_type -r-->

{
  "code": 403,
  "status": "Forbidden",
  "message": "insufficient permissions for this operation on this table, got [hr-analyst]"
}

Three gates, checked in order: a lock mask says whether anyone may delete here at all; the template says which roles may; a row scope, if set, says which rows. The token itself could not have helped — -r-- is read-only, and a token never carries more than its minter held. Vol. I, Chapter 6.

An agent that has the skill file knows the session rule, the order to discover a project in, and which headers to send. It opens a session, lists the databases and tables its token can see, then reads the same five rows. Every call on the right is from Vol. I, Chapter 7.

mkdir -p .claude/skills/minimal-core
curl -o .claude/skills/minimal-core/SKILL.md \
  https://littlebitlabs.com/skills/minimal-core/SKILL.md

start_ai_session    {name, context}
  → session_id 01M20681V68Y5421QC5N23F9DB
meta_list_databases
  → [{"type":"pg","schema":"acme"}]
meta_list_tables    {type: pg, schema: acme}
  → employee, department, salary, … 11 tables
auto_read_rows      {type: pg, schema: acme, table: employee,
                     page_size: 5, page_number: 0, query: {oy: "id.as"}}
  → 5 rows, recorded to the session

MCP invents no capability of its own: everything an agent can reach this way, a backend can reach over REST, refused for the same reasons. What MCP adds is the session — a persistent record of what the agent actually did. The skill file is one page, written from the same chapters. Vol. I, Chapter 7.