A local copy of your DynamoDB tables, real items included

dbplex is a Mac app that copies the DynamoDB tables of one AWS region into DynamoDB Local on your Mac, with every item and their secondary indexes, and gives you a local endpoint for your app, your tests and your AI agent. Production is only read.

Download for Mac Try it in your browser

For Apple Silicon Macs. 7 days free with every feature. No card and no account.

Runs on: DynamoDB Local 3.3
Download: About 43 MB, plus Java 21
Needs: An access key, no Docker
Production: Only read. A Scan costs read capacity

What comes with a DynamoDB copy

Copied to your Mac

Tables and itemsEvery table in the region, read once with Scan.
Secondary indexesMade again on the copy.

Left behind, and why

StreamsNothing runs here when an item changes.
TTL stateNothing expires here.
Global table replicas, backups and auto scalingThey belong to the AWS account, not the data.
Temporary keysThey do not work for a pull. Use a user's access key.

After each pull the Connect tab lists what was left out.

What you paste

A region and an access key. Make a user for dbplex with read rights only.

RegionRequired

eu-west-1The region whose tables you want.

Access Key IDRequired

AKIA…The user needs dynamodb:ListTables, dynamodb:DescribeTable and dynamodb:Scan, plus kms:Decrypt for encrypted tables.

Secret Access KeyRequired

••••••••••••dbplex keeps it in your Keychain.

Read only. Nothing is ever written to production.

A pull scans every table in the region once, which costs read capacity and money on the account.

Then point your app at the copy

http://127.0.0.1:15000
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=local
AWS_SECRET_ACCESS_KEY=local

The port is the first free one from 15000, so yours may differ. The Connect tab shows the exact values.

Why not DynamoDB Local on its own?

DynamoDB Local is what dbplex runs. The difference is what is in it.

	DynamoDB Local alone	dbplex
Data	Starts empty. You write a script to scan and load.	Every table and item, with its secondary indexes.
Running it	Java and a jar you start yourself.	Downloaded and started with the copy.
Going back	Run the script again.	Save a state and restore it.
Fresh data	Run the script again.	One Refresh button.

What you can do with a DynamoDB copy

Browse tables and run API callsEvery table and item, and any API call in JSON, such as {"Scan": {"TableName": "users", "Limit": 10}}.
Save and restore statesSave before a risky change and go back to it.
Branch the copyWork on a second copy, from now or from the last pull, and keep the first as it is.
Back up the copyDaily or weekly, to a folder you choose. Each backup opens as a new copy.
Refresh from productionOne button scans every table again, which costs read capacity on the account.
Read the logsThe server log of the copy, in the Logs tab.

There is no schema graph, Changes tab or masking for DynamoDB.

A DynamoDB sandbox for your AI agent

Give Claude Code, Cursor, Codex or Windsurf a copy of production to test on, and let it break things. dbplex's built-in MCP server hands the agent your local DynamoDB copy, never production: it never sees your production credentials, and every tool it gets acts on local copies only.

Add it from the app's Settings. Streams and TTL are not copied, so nothing runs or expires on the copy by itself.

Call the API on real itemsOne DynamoDB operation in JSON, reads and writes, on the copy only.
Save a state before it tries somethingAnd restore it when the attempt goes wrong.
A branch for each agentEach agent clones the copy and works alone. A clone holds no credentials and can never reach production.
Start over with today's dataIt can refresh the copy from production, and never sees the credentials.
Read the logsThe newest lines of the server log.

When agents had production instead

Questions about DynamoDB in dbplex

Can dbplex change my DynamoDB production database?

No. It only reads production to make your copy, and it has no push, sync or way to write anything back. The credentials stay in your Mac's Keychain.

Which IAM rights does the key need?

dynamodb:ListTables, dynamodb:DescribeTable and dynamodb:Scan, plus kms:Decrypt for tables encrypted with your own key. Temporary keys do not work.

Does a pull cost money?

Yes. It scans every table in the region once, which costs read capacity, and so does each refresh.

Which endpoint does my app use?

The local endpoint the Connect tab shows, with AWS_REGION=us-east-1 and the access key and secret both set to local.

Do I need Docker for DynamoDB?

No. DynamoDB Local runs on Java 21, which dbplex downloads for you the first time.

Can my AI agent use the DynamoDB copy?

Yes. Add dbplex's MCP server to Claude Code, Cursor, Codex or Windsurf from the app's Settings. It can list tables, read items and call the API in JSON, and save, restore and branch the copy. Every tool acts on local copies only, and the agent never sees your production credentials.