Agentic Database Strategy

How Redis can turn provisioning, MCP, skills and distribution into an agent state-platform growth loop.

EXECUTIVE THESIS Redis does not primarily have an MCP gap. It has a packaging, control-plane and distribution gap. The public portfolio already contains rich Redis operations, RedisVL retrieval, agent skills, Agent Memory, Context Retriever and Redis Cloud APIs—but an agent cannot discover one governed endpoint, create a database, receive scoped credentials, mutate safely, control cost, recover and graduate to production. [S35–S45]

Decision requested

Fund a staged Agent Platform program whose first milestone is a hosted Redis Cloud MCP with OAuth, safe provisioning and official distribution, and whose long-term product thesis is Redis as the Agent State Plane—not a relational database imitation.

• Approve a 0–90 day cross-functional launch team spanning Cloud, IAM/Security, AI product, Developer Experience, Partnerships and Growth.
• Treat marketplace submission as a product-readiness gate, not a marketing task: hosted transport, modern authorization, destructive-action annotations, test cases, support and maintenance are prerequisites. [S01–S10]
• Pair provisioning with an expiring claim-later sandbox and an agent-platform commercial program; otherwise Redis will improve compatibility without creating a differentiated acquisition loop. [S25, S32, S34]

Executive summary

The competitive leaders built in layers. They first made a useful database experience available through APIs and developer tools; then let agents create and change infrastructure; then added safer authorization, branching or recovery; then packaged durable knowledge as skills/plugins; and finally secured embedded-platform or official assistant distribution. The MCP server is the interface—not the whole strategy.

RECOMMENDED STRATEGIC POSITION "The governed state plane for production agents." Provisioning is the acquisition door. The durable value is coordinated operational state, working memory, retrieval, streams, semantic caching and event context with enterprise policy.

Directional scorecard

Scoring is an outside-in, evidence-weighted decision aid—not a market-share or revenue estimate. The detailed 12-criterion matrix and source URLs are in the accompanying workbook.

1. Market thesis: the winning product is a loop

Agentic database adoption is a systems problem spanning product, safety, developer experience, distribution and economics. A server that exposes query tools can improve an existing workflow; a complete growth loop lets an agent discover the service, create a resource, receive constrained authority, build an application, recover from errors, transfer ownership and grow usage into paid production.

• 1. Discovery: the database appears in the assistant, editor, plugin marketplace, template or generated-app platform at the moment of need.
• 2. Provisioning: the agent can create the correct resource without copying credentials through a dashboard.
• 3. Useful mutation: the agent can add schema or data structures, query, migrate and debug with precise tool contracts.
• 4. Safety and recovery: authority is scoped; writes, cost and destructive actions are constrained; changes are inspectable and reversible.
• 5. Graduation: a scratch or preview workload can be claimed, transferred, governed and expanded into a paid production account.

The competitors differ in their emphasis, but their launch sequences converge on this loop. Supabase leads on breadth and official distribution. Neon leads on branching and embedded agent-platform economics. Upstash leads on immediate, claim-later activation. Redis leads on the breadth of state and context services an agent ultimately needs—but has not yet connected those capabilities into the same loop.

What "agent-created database" should mean for Redis

2. Competitor growth strategies

Supabase: build the full AI tooling ladder, then win official distribution

Fact. Supabase evolved from AI-assisted SQL and prompt-to-database experiences into an MCP with more than 20 tools, then a hosted OAuth server with project scoping, database-role read-only mode and feature groups. It subsequently packaged MCP plus skills as plugins and launched official Claude and ChatGPT integrations. [S11–S17]

Fact. The tool surface includes account/project creation, schema and migrations, SQL, branches, logs, configuration, storage and advisors. Project creation separates cost estimation from explicit confirmation. Read-only mode removes write tools and executes SQL as a read-only Postgres user. The server also wraps query output to reduce prompt-injection risk while acknowledging that the mitigation is not foolproof. [S13–S14]

Inference. Supabase's strategy is to be the default full-stack backend generated by an agent, then expand from a free project into database, auth, storage, functions and platform usage. "Supabase for Platforms" makes this loop available white-label through the Management API or remote MCP; vendor-reported adoption by major app builders should be treated as directional rather than independently verified. [S18]

LESSON FOR REDIS Completeness compounds: remote authorization, lifecycle tools, skills, platform APIs and official listings reinforce one another. Redis should not submit a narrow data-plane MCP and expect the same distribution outcome.

Neon: turn architecture into agent-safe growth infrastructure

Fact. Neon launched its MCP in December 2024 with project/branch creation and deletion, SQL/schema inspection and a branch-based migration workflow. Its serverless Postgres architecture makes one database per app and one branch per preview economically and operationally plausible. [S20–S22]

Fact. Integrations with Replit Agent and Databutton demonstrate automated provisioning, schema creation, quotas, cost tracking and ownership transfer. Neon then introduced an Agent plan with custom project/branch limits, higher rate limits and credits for agent platforms, followed by agent skills and a Codex plugin. [S23–S27]

Inference. Neon subsidizes the generated-project funnel because each successful application can become a long-lived paid database. Branching is simultaneously a developer-experience feature, safety mechanism and distribution enabler.

LESSON FOR REDIS The partner product must include fleet controls, quotas, metering and ownership transfer. A direct MCP alone will not win the highest-volume agent builders.

Upstash: remove every second before first value

Fact. Upstash supports Redis, QStash and adjacent primitives through an MCP, but its current official direction favors a local stdio server plus an agent skill and JSON-oriented CLI. Read-only API keys disable mutating tools; the CLI covers create/delete, dry-run, plans, budgets, backups and restore. [S29–S33]

Fact. Its standout acquisition mechanism is a no-signup, no-card endpoint that returns a free Redis database and credentials in agent-readable form, expires after 72 hours and can be claimed later. [S32]

Inference. Upstash optimizes for generated, intermittent serverless workloads: immediate activation, low entry price, explicit budget caps and adjacent messaging/workflow services. Its tradeoff is weaker hosted OAuth and official marketplace distribution than Supabase.

LESSON FOR REDIS Copy the claim-later mechanism—not Upstash's entire positioning. Redis can combine immediate activation with richer production governance and a broader agent state thesis.

3. Safety and governance: technical enforcement is the product

The most important distinction is whether a protection changes what the agent can do or merely tells the user to be careful. Leading implementations combine documentation with scoped endpoints, restricted credentials, filtered tool sets, explicit cost confirmation and reversible development environments.

Recommended default policy

• Default new agent resources to development mode, strict budget, explicit TTL and no public network exposure unless needed.
• Default credentials to one database and one capability group; expose a readable scope statement to the agent before the first write.
• Require confirmation for spend, deletion, credential escalation, network exposure, bulk writes and production connections.
• Make recovery automatic: capture a restore point before high-risk changes and return a rollback handle in the tool response.
• Treat tool output as untrusted input. Redact secrets and PII, cap response size and keep raw values out of telemetry by default.

4. Distribution and listing map

The original premise is directionally correct but requires qualification. Redis is not absent from agent tooling: it publishes MCP and skills and documents manual integrations. The gap is official, low-friction distribution and a hosted control-plane endpoint suitable for custom remote MCP catalogs. As of the assessment date, no official Redis ChatGPT app, Claude connector or documented Grok catalog entry was verified. This is a time-stamped "not found," not proof of universal absence.

OpenAI path

Fact. Current OpenAI plugin submission accepts skills, an MCP server or both. It requires a publicly accessible MCP domain, verified publisher identity, listing metadata, tool annotations, test prompts/cases and policy attestations. Sensitive customer data and write actions should use OAuth 2.1 under the MCP authorization model. Published plugins can work across ChatGPT and Codex. [S01–S04]

Anthropic path

Fact. Anthropic provides a connector review form and directory policy. Remote servers should use Streamable HTTP, include read-only/destructive annotations and titles, provide privacy/support/troubleshooting information, supply working prompts and test access, and maintain a control endpoint and ongoing support. Acceptance is not guaranteed. [S05–S07]

xAI / Grok path

Fact. Grok supports built-in, catalog and custom MCP connectors; custom servers must be publicly reachable. Business and Enterprise administrators can provision connectors. [S08–S10]

Inference / unresolved. No public third-party catalog-submission procedure comparable to OpenAI or Anthropic was found in the reviewed xAI documentation. Redis should publish a custom-MCP guide and pursue a direct partnership rather than waiting for a self-service listing path.

5. Redis current state and gap assessment

Redis has more agent-relevant capability than its competitive score suggests. The lower score reflects journey completeness and distribution, not core technology. Public assets include:

• mcp-redis with operations across strings, hashes, lists, sets, sorted sets, JSON, streams, pub/sub, indexes, vectors and server diagnostics. It currently connects to an existing Redis URI and documents stdio transport. [S35–S36]
• Agent skills for core Redis, connection management, search, semantic caching, clustering, security, observability and Iris. [S37]
• RedisVL MCP with deterministic single-index retrieval and read-only/read-write modes. [S38]
• Redis Cloud APIs, access management and data RBAC capable of provisioning and governing resources outside MCP. [S39–S42]
• Redis Iris, Context Retriever and Agent Memory, which provide a coherent production-agent context thesis with managed MCP/REST surfaces and governed retrieval. [S43–S45]

DO NOT BUILD A generic "Redis can also be a database an agent creates" story without a clear state/context thesis. That would concede the relational application-backend category to stronger full-stack platforms and underuse Redis's unique value.

6. Prioritized roadmap

Horizon 1: 0–90 days — package, host, secure and submit

• Package a single Redis Agent Platform entry point. Impact: High; effort: Medium. Owner: Product marketing + DevRel. Metric: One canonical agent hub; setup completion rate; support deflection
• Launch a hosted Redis Cloud MCP v1 using Streamable HTTP and OAuth 2.1. Impact: Very high; effort: High. Owner: Cloud platform + Security. Metric: Median zero-to-DB <3 minutes; >90% scoped tokens; no critical security findings
• Add safe control-plane tools: estimate/confirm cost, create/list/describe/delete, backup/restore, and scoped credential issuance. Impact: Very high; effort: High. Owner: Cloud product + IAM. Metric: 100% destructive/cost tools annotated and confirmation-gated; recovery drill pass rate
• Bundle MCP + skills as plugins for Codex, Claude Code, Cursor and VS Code/Copilot. Impact: High; effort: Medium. Owner: DevRel + Ecosystem. Metric: Four verified installs; <5-minute activation; monthly active installs
• Submit to OpenAI and Anthropic; publish a Grok custom-MCP guide and pursue direct xAI business development. Impact: High; effort: Medium. Owner: Partnerships + Ecosystem. Metric: Submissions accepted or actionable review feedback; platform-sourced activations
• Ship an agent safety/evaluation suite. Impact: High; effort: Medium. Owner: Security + Developer Experience. Metric: Positive/negative, prompt-injection, PII, cost and rollback tests run on every release

90-DAY EXIT CRITERION A new user can discover Redis from a supported agent, authorize with OAuth, create a budgeted development database, receive a scoped identity, create a JSON/search/stream workload, inspect it, restore or delete it, and complete the journey in under three minutes—without copying a long-lived credential.

Minimum hosted MCP v1 tool contract

Horizon 2: 3–9 months — create the acquisition and production bridge

• Create an expiring, claim-later Agent Sandbox Redis database. Impact: Very high; effort: High. Owner: Growth + Cloud. Metric: Prompt-to-working DB <60 seconds; claim and retained-workload conversion
• Introduce agent identities, short-lived credentials, tool groups, budgets and per-action audit logs. Impact: Very high; effort: High. Owner: IAM + Security. Metric: >95% agent sessions use scoped identities; audit completeness; policy-denial precision
• Add agent-safe change management: clone/snapshot workspace, backup-before-write and rollback token. Impact: High; effort: High. Owner: Cloud data plane. Metric: Rollback success <5 minutes; share of mutations protected
• Launch an agent-platform program with credits, fleet APIs, quotas, metering and ownership transfer. Impact: Very high; effort: High. Owner: BD + Cloud product. Metric: Signed platforms; DBs created per partner; 90-day paid conversion; gross-margin guardrail
• Unify Redis, RedisVL, Context Retriever and Agent Memory MCP discovery behind one gateway. Impact: High; effort: High. Owner: AI platform architecture. Metric: One endpoint; task-success rate; reduced duplicate tools; migration adoption

Horizon 3: 9–18 months — own the Agent State Plane

• Productize Redis as the Agent State Plane: operational state, memory, retrieval, streams and semantic cache templates. Impact: Very high; effort: High. Owner: AI product + Cloud. Metric: Attach rate across two or more state services; production retention; expansion revenue
• Build enterprise agent governance: policy packs, fleet observability, incident response and recovery controls. Impact: High; effort: High. Owner: Enterprise platform + Security. Metric: Policy coverage; mean time to detect/rollback; enterprise pipeline and wins
• Secure strategic provisioning partnerships with agent builders and project marketplaces. Impact: Very high; effort: High. Owner: Corporate development + Partnerships. Metric: Three tier-1 integrations; database creation volume; partner-sourced ARR

Commercial growth loop

Recommendation. Create a two-sided program for direct agents and embedded agent builders:

Direct: expiring claim-later sandbox → claimed free database → governed paid database → attached memory/retrieval/stream services.

Embedded: partner creates one database per generated app/agent → Redis funds a bounded free allowance → partner transfers ownership → successful workload expands into paid usage.

Enterprise: agent identity and policy pack → fleet observability → governed production state → cross-service expansion and support.

Success metrics

Activation: median prompt-to-working database; setup completion; OAuth success; first useful write/query.

Safety: percentage of scoped/short-lived identities; confirmation coverage; policy denial precision; restore success and time.

Distribution: approved listings, install-to-activation conversion, platform-sourced databases and active agent clients.

Growth: claim rate, 30/90-day retained workloads, paid conversion, databases per partner and partner-sourced ARR.

Differentiation: multi-service attach rate, Agent Memory/Context Retriever adoption, production retention and expansion.

7. Differentiated product thesis

CATEGORY CLAIM Redis is the governed state plane that lets production agents remember, retrieve, coordinate and react in real time.

This claim is stronger than "Redis is fast" and more defensible than "Redis is another database an agent can create." It connects core Redis capabilities to the actual runtime needs of autonomous systems:

Reference journeys to publish

Scratch to shipped: an agent creates an expiring Redis database, builds a small application, then the developer claims and governs it.

Production memory: an enterprise agent gets scoped Agent Memory and Context Retriever access with audit, retention and PII controls.

Real-time multi-agent operations: agents coordinate through streams and shared state, with idempotency, replay and incident recovery.

Benchmark callouts

Convex defaults production MCP access toward read-only and requires explicit dangerous flags for production writes; its plugins combine MCP, hooks/monitors, skills and scoped deploy keys. Pinecone exposes a dedicated managed remote MCP endpoint for each Assistant. Turso articulates a database-per-agent architecture and exposes in-process schema/query tools. [S46–S50]

These benchmarks reinforce three principles: safe defaults should be enforced in the tool surface; every managed resource should have an immediately usable remote agent endpoint; and database-per-agent economics and lifecycle must be designed intentionally.

8. Operating model and immediate decisions

Internal validation questions

• Which public Redis MCP surface is intended to become the canonical hosted endpoint, and who owns cross-surface naming/versioning?
• Can Redis Cloud issue short-lived, single-database credentials without exposing account API keys?
• What copy/snapshot/restore primitives can support a low-cost agent workspace and rollback token?
• What are current setup conversion, agent-client usage and retention signals across mcp-redis, RedisVL, Agent Memory and Context Retriever?
• Which platform partnerships and listing submissions are already in progress or contractually constrained?
• What sandbox abuse budget and gross-margin envelope can Finance support for claim-later acquisition?

Research limitations

The assessment uses public information and could not inspect internal roadmaps, contracts, usage telemetry, security architecture or marketplace review conversations. Vendor case studies and adoption figures are marked as vendor-reported. Platform catalogs are dynamic; "not verified" means no official listing was found in the reviewed public sources on August 17, 2026. Scores are directional judgments derived from documented capability, not laboratory benchmarks. Live end-to-end provisioning tests were not performed with paid accounts, so setup-time estimates are recommendation targets rather than measured results.

Appendix A — Evidence register

Classification: Primary = official documentation, repository, changelog, pricing or platform policy. "Primary / vendor case" supports product behavior but not independent proof of adoption. Evidence grades reflect source quality, not strategic importance.

• S01 OpenAI plugin submission — developers.openai.com/plugins/deploy/submission | Primary; grade High. Submission form, public MCP, skills/prompts/test cases, permissions.
• S02 OpenAI app review requirements — developers.openai.com/plugins/deploy/app-review | Primary; grade High. Tool annotations, test cases, policy and review.
• S03 OpenAI security and privacy — developers.openai.com/plugins/guides/security-privacy | Primary; grade High. Least privilege, confirmation, auditability, PII.
• S04 OpenAI authentication — developers.openai.com/plugins/build/auth | Primary; grade High. OAuth 2.1 and MCP authorization requirements.
• S05 Anthropic connectors directory FAQ — support.anthropic.com | Primary; grade High. Directory submission and review.
• S06 Anthropic MCP directory policy — support.anthropic.com | Primary; grade High. Transport, annotations, privacy, testing, maintenance.
• S07 Anthropic connectors directory — anthropic.com/news/connectors-directory | Primary; grade High. One-click connector discovery.
• S08 xAI connectors — docs.x.ai/grok/connectors | Primary; grade High. Built-in, catalog and custom MCP behavior.
• S09 xAI connector management — docs.x.ai/grok/connector-management | Primary; grade High. Business/Enterprise administration.
• S10 xAI custom MCP tunneling — docs.x.ai/grok/connectors/custom-mcp-tunneling | Primary; grade High. Public reachability requirement.
• S11 Supabase MCP launch — supabase.com/blog/mcp-server | Primary; grade High. Initial tools and launch scope.
• S12 Supabase remote MCP launch — supabase.com/blog/remote-mcp-server | Primary; grade High. OAuth, remote transport, scoping and safety.
• S13 Supabase MCP documentation — supabase.com/docs/guides/ai-tools/mcp | Primary; grade High. Current setup and safety guidance.
• S14 Supabase MCP repository — github.com/supabase-community/supabase-mcp | Primary; grade High. Tool surface, read-only, cost confirmation, injection mitigation.
• S15 Supabase plugins — supabase.com/docs/guides/ai-tools/plugins | Primary; grade High. MCP and skills bundle.
• S16 Supabase Claude connector — supabase.com/blog/claude-connector | Primary; grade High. Official Claude distribution.
• S17 Supabase ChatGPT app — supabase.com/blog/supabase-is-now-an-official-chatgpt-app | Primary; grade High. Official ChatGPT distribution.
• S18 Supabase for Platforms — supabase.com/blog/introducing-supabase-for-platforms | Primary / vendor claims; grade Medium-high. White-label provisioning and platform growth.
• S19 Supabase pricing — supabase.com/pricing | Primary; grade High. Free tier and paid packaging.
• S20 Neon MCP launch — neon.com/blog/let-claude-manage-your-neon-databases-our-mcp-server-is-here | Primary; grade High. Initial MCP tools and branch migration.
• S21 Neon MCP documentation — neon.com/docs/ai/neon-mcp-server | Primary; grade High. Current hosted MCP, OAuth and warnings.
• S22 Neon MCP repository — github.com/neondatabase-labs/mcp-server-neon | Primary; grade High. Tool scopes and implementation.
• S23 Neon and Replit Agent — neon.com/blog/looking-at-how-replit-agent-handles-databases | Primary / vendor case; grade Medium-high. Agent-created database proof point.
• S24 Neon and Databutton — neon.com/blog/databutton-neon-integration | Primary / vendor case; grade Medium-high. Embedded provisioning, quotas and ownership transfer.
• S25 Neon Agent plan — neon.com/docs/changelog/2025-09-05 | Primary; grade High. Agent-platform limits and credits.
• S26 Neon agent skills — neon.com/docs/changelog/2026-01-23 | Primary; grade High. Skills launch.
• S27 Neon Codex plugin — neon.com/docs/ai/ai-codex-plugin | Primary; grade High. MCP plus skills distribution.
• S28 Neon pricing — neon.com/pricing | Primary; grade High. Free tier and agent plan.
• S29 Upstash MCP documentation — upstash.com/docs/agent-resources/mcp | Primary; grade High. MCP tools, API keys and read-only behavior.
• S30 Upstash MCP repository — github.com/upstash/mcp-server | Primary; grade High. Current implementation and telemetry.
• S31 Simplified Upstash MCP — upstash.com/blog/simplified-upstash-mcp | Primary; grade High. Shift from remote SSE to local stdio.
• S32 Upstash skills — upstash.com/docs/agent-resources/skills | Primary; grade High. Skill, CLI and no-signup scratch endpoint.
• S33 Upstash CLI — upstash.com/docs/agent-resources/cli | Primary; grade High. Lifecycle, dry-run, budget and backup tools.
• S34 Upstash Redis pricing — upstash.com/pricing/redis | Primary; grade High. Free tier, usage pricing and budgets.
• S35 Redis MCP documentation — redis.io/docs/latest/integrate/redis-mcp/ | Primary; grade High. Current Redis MCP installation and clients.
• S36 Redis MCP repository — github.com/redis/mcp-redis | Primary; grade High. stdio transport, tools and existing-database connection.
• S37 Redis agent skills — github.com/redis/agent-skills | Primary; grade High. Current skill catalog and packaging.
• S38 RedisVL MCP — redis.io/docs/latest/develop/ai/redisvl/0.17.0/concepts/mcp/ | Primary; grade High. Governed index retrieval and read-only mode.
• S39 Redis Cloud API — redis.io/docs/latest/operate/rc/api/ | Primary; grade High. Control-plane provisioning and management.
• S40 Redis Cloud access management — redis.io/docs/latest/operate/rc/security/access-control/access-management/ | Primary; grade High. Cost-authority roles.
• S41 Redis Cloud RBAC — redis.io/docs/latest/operate/rc/security/access-control/data-access-control/role-based-access-control/ | Primary; grade High. Data access governance.
• S42 Redis pricing — redis.io/pricing/ | Primary; grade High. Free and paid tiers.
• S43 Redis Iris launch — redis.io/blog/context-is-all-you-need/ | Primary; grade High. Context engine positioning.
• S44 Redis Context Retriever — redis.io/docs/latest/develop/ai/context-engine/context-retriever/ | Primary; grade High. Governed retrieval and access tags.
• S45 Redis Agent Memory — redis.io/docs/latest/develop/use-cases/agent-memory/ | Primary; grade High. Managed memory with REST/MCP.
• S46 Convex MCP — docs.convex.dev/ai/convex-mcp-server | Primary; grade High. Safe defaults and dangerous production flags.
• S47 Convex AI overview — docs.convex.dev/ai/overview | Primary; grade High. Plugins, skills and scoped deploy keys.
• S48 Pinecone Assistant MCP — docs.pinecone.io/guides/assistant/mcp-server | Primary; grade High. Dedicated managed remote MCP endpoints.
• S49 Turso database-per-agent guide — turso.tech/blog/a-complete-guide-to-database-per-agent-architecture | Primary / vendor guidance; grade Medium-high. Database-per-agent architecture.
• S50 Turso repository — github.com/tursodatabase/turso | Primary; grade High. In-process MCP schema/query tools.

Appendix B — Fact / inference / recommendation key