pgmcp

pgmcp

pgmcp is a read-only PostgreSQL ops/DBA server for the Model Context Protocol, built on the official modelcontextprotocol/go-sdk. It answers the questions a DBA asks during an incident — which statements are slow, why this plan is slow, which indexes are dead weight, which tables autovacuum has fallen behind on, who is blocking whom, how far the standby is lagging — and it is read-only by construction rather than by convention: a dedicated database role that holds no write privilege, a BEGIN READ ONLY transaction with a statement timeout around every single statement, and a SQL parser guard that rejects anything that is not one SELECT/EXPLAIN/SHOW and every function that could mutate state from inside a read-only transaction. Tested against PostgreSQL 16; requires 13 or later.

Installation

Claude Desktop, one click: download pgmcp_ .mcpb from Releases and open it. Claude Desktop asks for a Postgres connection string, keeps it in the OS keychain, and launches the bundled binary itself — nothing on PATH, no config file to edit. One bundle covers macOS (universal) and Windows (x64).

Otherwise download a binary for your platform from Releases — darwin, linux and windows, amd64 and arm64, with checksums.

Or build from source with the Go CLI tool go:

go install github.com/pascalallen/pgmcp/cmd/pgmcp@latest

Or run the released image, which is distroless, non-root and multi-arch:

docker run --rm -i -e PGMCP_DATABASE_URL='postgres://…' ghcr.io/pascalallen/pgmcp

pgmcp is listed in the MCP Registry as io.github.pascalallen/pgmcp.

Before you point it at anything, create the read-only role — see Database role. It is the layer that still holds if the other two have a bug.

Usage

One MCP surface, two transports. Which one you run is configuration, not a different build.

Claude Code, stdio — the client launches the binary and talks over stdin/stdout:

claude mcp add pgmcp --transport stdio \

--env PGMCP_DATABASE_URL='postgres://pgmcp:…@db.internal:5432/app?sslmode=require' \ -- pgmcp

Claude Desktop, stdio — install the .mcpb bundle from Releases (see Installation), or write the same thing into claude_desktop_config.json by hand:

{

"mcpServers": { "pgmcp": { "command": "pgmcp", "env": { "PGMCP_DATABASE_URL": "postgres://pgmcp:…@db.internal:5432/app?sslmode=require" } } } }

HTTP — Streamable HTTP behind a static bearer key, for a shared deployment. pgmcp speaks plain HTTP and never terminates TLS itself; run it on loopback behind a reverse proxy.

PGMCP_DATABASE_URL='postgres://pgmcp:…@db.internal:5432/app?sslmode=require' \

PGMCP_AUTH_MODE=static \ PGMCP_API_KEYS="$(openssl rand -hex 32)" \ pgmcp --transport http --listen 127.0.0.1:8080

claude mcp add pgmcp --transport http https://pgmcp.example.com/mcp \

--header "Authorization: Bearer "

TLS termination, the proxy settings the streaming transport needs, JWT auth against an identity provider, and wiring pgmcp up as a claude.ai custom connector are all in docs/DEPLOYING.md.

Tools

Every tool is annotated readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, and returns a typed output schema.

query is the only tool that carries free-form SQL, and it is optional. --disable-query drops it from the catalogue entirely — a deployment that only needs the eight diagnostics tools can run without any ad hoc SQL surface at all. --query-schemas=public,app restricts it to named schemas instead — and bounds explain with it, since analyze=true executes the statement; read what that does and does not stop in docs/SECURITY.md.

Resources & prompt

Configuration

Every setting has a --flag and a PGMCP_ environment variable. Flags win over the environment, which wins over the default. Configuration errors exit 2 with every offending key named in one message; runtime failures exit 1.

The auth block applies to the HTTP transport only. Over stdio the operating system decides who the caller is: the parent process that launched the binary, and nobody else.

Security model

• Read-only three independent ways. A dedicated role with no write privilege (pg_monitor plus SELECT, and deliberately *not* pg_signal_backend); BEGIN READ ONLY with SET LOCAL statement_timeout and lock_timeout = '2s' around every statement the adapter runs, always rolled back; and a parser-level guard, because a read-only transaction alone does not stop pg_terminate_backend, pg_read_file, pg_sleep or setval.
• The SQL guard is allow-list first. One top-level statement, and it must be a SELECT, EXPLAIN or SHOW; no nested write statement anywhere in the tree; no FOR UPDATE/FOR SHARE locking clause; no SELECT INTO; and no call to a denied function — file access, backup and WAL control, replication slots, advisory locks, dblink, sequence mutation, stats resets.
• The schema allowlist is a guardrail, not a boundary. --query-schemas matches the schemas qualifying *table references* in the parsed statement, case-insensitively, and it bounds both tools that carry caller-supplied SQL — query and explain, so explain with analyze=true cannot execute against a schema you excluded. A view, a set-returning function, or a SECURITY DEFINER function inside an allowed schema can still read outside it. Database privileges are the boundary; the allowlist just narrows the obvious path.
• Authenticated, fail-closed, over HTTP. Static keys are compared in constant time against every stored hash without an early exit; JWTs are validated against a JWK set with asymmetric algorithms only (no alg=none, no HMAC confusion) and a required iss, aud and exp, and the verifier holds no keys until the JWKS arrives, so it starts closed rather than open. RFC 9728 protected resource metadata advertises where to get a token. The server refuses to start on a non-loopback address with auth off.
• Bounded. Per-principal rate limiting, a per-call timeout, a statement timeout and lock timeout inside the transaction, a row cap on the query tool, a cap on a result's structured content, and a 1 MiB request body limit.
• Nothing sensitive is logged. A tool call logs its name, duration, outcome and the caller's user id — never arguments, SQL text, result rows or error text. Parse failures come back as a fixed phrase rather than echoing the statement, and the DSN is redacted from connection errors.

The threat model, the full enumeration of the layers, and the limitations each one does *not* cover are in docs/SECURITY.md.

Testing

Run the test suite with the race detector and coverage:

go test -race -cover ./...

Integration tests need a Postgr