NexQL Postgres MCP

nexql-mcp

Standalone Postgres MCP server — schema-aware, read-only by default, installable everywhere.

NexQL Pro ships an in-process MCP server locked to VS Code (pro/src/mcp/). This repo extracts that capability into an independent Rust binary any MCP client can spawn: Claude Desktop, Cursor, VS Code Copilot, Zed, etc.

Status: Phases 0–6 + Phase 7 extension cutover (stdio spawn) + Phase 8 HTTP (bearer, sessions, rate limit) + Phase 9 write/admin tools landed. 55 tools across Schema, Query, Context, Perf, Write, and Admin. Full OAuth gateway stays pro-only; session-store LRU eviction cap not yet implemented. See docs/CUTOVER.md.

Why this exists

Competing Postgres MCP servers expose connect → run query → return rows. Models hallucinate table names against schemas that do not exist. NexQL's moat is the offline schema index (TF-IDF, join graph with inferred FKs, value profiles, optional embeddings, RRF fusion) built in pro/src/features/dbindex/. This repo ports that index plus 54 query/schema/DBA/meta tools from Pro into a fast, trivially installable binary.

Architecture

crates/

├── nexql-mcp/ CLI, subcommands, wiring (binary) ├── nexql-proto/ MCP JSON-RPC types, transports ├── nexql-tools/ tool registry, schemas, executors ├── nexql-index/ dbindex port (builder, store, lexical, joins, embed) ├── nexql-conn/ connection resolution, pool, credentials └── nexql-policy/ access modes, allow/deny, PII, caps, audit npm/ npx shim (per-platform optionalDependencies) mcpb/ one-click Claude Desktop bundle docs/ per-client setup, tool reference

Layering is one-directional: policy + conn are leaves → index → tools → binary. nexql-tools never depends on nexql-proto.

Scope boundary: nexql-mcp manages objects *within* a connected database (tables, indexes, columns, …), not the database catalog itself. CREATE DATABASE / DROP DATABASE are rejected in every access mode — permanent, intentional scope, not a gap. See docs/tools/README.md and docs/REFERENCE.md.

Install

Claude Desktop — one download

Get the bundle for your computer from [nexql-mcp.astrx.dev/install](https://nexql-mcp.astrx.dev/install), double-click it, and paste your database URL. No terminal, Node or PATH setup. The install form also has an "Allow changes to data" switch (off by default) and an optional schema list.

npx — recommended for every other client

npx -y nexql-mcp@latest postgres://dev@localhost:5432/appdb doctor

-y skips the "ok to proceed?" confirmation prompt; @latest always resolves the newest published release instead of whatever npx happens to have cached — always use both together. This is the desired way to run nexql-mcp: no separate install step, nothing added to PATH, works identically whether a human is typing it or an AI agent is running it on your behalf. Requires Node.js (npx ships with it) — nothing else.

# Verify

npx -y nexql-mcp@latest --version

Setup

npx -y nexql-mcp@latest setup # initialize connections and db profiles

Wire your MCP client (or run the guided wizard)

npx -y nexql-mcp@latest init cursor # Cursor npx -y nexql-mcp@latest init claude-desktop # Claude Desktop npx -y nexql-mcp@latest init vscode-copilot # VS Code Copilot npx -y nexql-mcp@latest tui # interactive profile + client wiring

Client config (command/args) uses the same pattern — no install step for the client to rely on either:

{

"mcpServers": { "nexql-mcp": { "command": "npx", "args": ["-y", "nexql-mcp@latest", "--profile", "mydb"] } } }

If you are an AI coding agent setting this up on a user's behalf: run npx -y nexql-mcp@latest init --apply — non-interactive, no browser needed, writes the merged client config directly (.mcp.json for claude-code, claude_desktop_config.json for claude-desktop, etc. — see docs/clients/README.md for exact paths per client). Or drive nexql-mcp setup's HTTP API directly: POST /api/v1/clients/preview → POST /api/v1/clients/apply (bearer token printed to stderr on startup). Prefer this over hand-writing claude mcp add-style shell commands or hand-parsing/merging the client's JSON config yourself.

Per-client config paths and paste blocks: docs/clients/README.md.

npm install -g nexql-mcp also works if you'd rather have a permanent nexql-mcp on PATH than repeat npx -y nexql-mcp@latest — same shim, same @nexql/mcp- - prebuilt binaries, no Rust toolchain needed either way.

Linux system requirements: prebuilt GNU/Linux binaries target glibc 2.35+ (Ubuntu 22.04, Debian 12, RHEL 9, and newer). If npx/npm fails with GLIBC_2.39 not found, use one of the fallback methods below (cargo install builds from source; Docker sidesteps glibc entirely). Musl/static Linux builds are not published yet.

Other install methods (fallback)

Reach for one of these only if npx isn't an option — an offline/air-gapped environment, a CI image that wants a pinned binary baked in, no Node.js available, or you simply prefer a permanent install. All ship the same binary as the npm package.

Quick install script (Linux / macOS / Windows) — installs a permanent binary, no Node.js required

Linux & macOS — downloads the latest release, installs to /usr/local/bin (or ~/.local/bin if sudo is unavailable), then prints setup steps:

curl -fsSL https://raw.githubusercontent.com/NexQL-OSS/mcp/main/scripts/install.sh | bash

Pin a version:

curl -fsSL https://raw.githubusercontent.com/NexQL-OSS/mcp/main/scripts/install.sh | NEXQL_MCP_VERSION=v0.2.2 bash

Windows (PowerShell) — installs to %LOCALAPPDATA%\Programs\nexql-mcp and adds it to your user PATH:

irm https://raw.githubusercontent.com/NexQL-OSS/mcp/main/scripts/install.ps1 | iex

Pin a version:

$env:NEXQL_MCP_VERSION = "v0.2.2"; irm https://raw.githubusercontent.com/NexQL-OSS/mcp/main/scripts/install.ps1 | iex

Or download and run the scripts locally: scripts/install.sh · scripts/install.ps1. Once installed, drop the npx -y nexql-mcp@latest prefix and call nexql-mcp directly for every command above.

uv (PyPI)

uv installs CLI tools from PyPI into isolated environments — same prebuilt binary, no Rust toolchain.

Install uv itself (if needed):

curl -LsSf https://astral.sh/uv/install.sh | sh   # macOS / Linux

irm https://astral.sh/uv/install.ps1 | iex        # Windows

Install nexql-mcp:

uv tool install nexql-mcp

uv tool update-shell # once, if uv warns the tool bin dir is not on PATH

One-off without installing (uv's equivalent of npx -y):

uvx nexql-mcp postgres://dev@localhost:5432/appdb doctor

Pin a version:

uv tool install 'nexql-mcp==0.2.2'

Upgrade later:

uv tool upgrade nexql-mcp

PyPI status: wheels are not published yet. Until the first PyPI release lands, use npx or the quick install script above. Maintainer steps: docs/publish-pypi-uv.md.

cargo (crates.io) — builds from source

cargo install nexql-mcp

Needs clang/libclang first (pg_query's bindgen requires it):

sudo apt install clang libclang-dev   # Debian/Ubuntu

sudo pacman -S clang # Arch

Manual download — grab a release archive by hand

From the Releases page:

Extract and put nexql-mcp (or nexql-mcp.exe) on your PATH.

Docker

Prebuilt, published on every release to GHCR:

docker run --rm -i ghcr.io/nexql-oss/mcp:v0.6.0 postgres://dev@host.docker.internal:5432/appdb

or: ghcr.io/nexql-oss/mcp:latest

Or build locally from the distroless Dockerfile:

docker build -t nexql-mcp:0.6.0 .

docker run --rm -i nexql-mcp:0.6.0 postgres://dev@host.docker.internal:5432/appdb

Claude Desktop (MCPB one-click bundle)

Each release attaches a platform .mcpb bundle (nexql-mcp- .mcpb). nexql-mcp.astrx.dev/install picks the right one for your OS; they are also on the Releases page. Double-click to install into Claude Desktop. The install form maps to DATABASE_URL, NEXQL_MCP_ALLOW_WRITES and NEXQL_MCP_SCHEMAS. Built from mcpb/manifest.json via scripts/package-mcpb.sh.

Homebrew

No published tap yet — each release renders a formula (Formula/nexql-mcp.rb, via scripts/render-homebrew-formula.sh) and attaches it as a release asset for a future homebrew-tap repo to pick up. Until that tap exists, use npx or the quick install script above.

MCP Registry

Listed in the official MCP Registry as io.github.NexQL-OSS/nexql-mcp (server.json), published automatically after each release via GitHub OIDC (no stored credentials) — see .github/workflows/publish-mcp-registry.yml.

• mcp-name: io.github.NexQL-OSS/nexql-mcp

From source

export LIBCLANG_PATH="${LIBCLANG_PATH:-/usr/lib}"   # or your llvm lib dir

cargo build --release -p nexql-mcp ./target/release/nexql-mcp postgres://dev@localhost:5432/appdb

Updates

Once a day nexql-mcp asks the npm registry (registry.npmjs.org/nexql-mcp/latest) for the newest version. The request sends nothing about you or your database, only a nexql-mcp/ user agent. When a newer release is out, the chat gets a short notice with the upgrade command for the way you installed it: npx, npm, pnpm, bun, Volta, cargo, uv, pipx, pip, Homebrew, Docker, the install script or the Claude Desktop bundle. The model passes it on and, if it can run commands on your machine, offers to run it for you. nexql-mcp doctor prints the same line.

npx configs need nexql-mcp@latest. With no tag, npx -y nexql-mcp keeps running the copy npx cached first.

Turn the check off with --no-update-check, NEXQL_MCP_NO_UPDATE_CHECK=1, update_check = false in config.toml, or DO_NOT_TRACK=1. It is also off when CI is set, and fails quietly offline.

Set up a connection

Commands below assume nexql-mcp resolves on PATH. If you're running via npx instead, prefix each one with npx -y nexql-mcp@latest in place of nexql-mcp — see Install.

One-off, no config — pass a connection string directly:

nexql-mcp postgres://dev@localhost:5432/appdb

Saved profiles — put connections in `~/.config/nexql-m