Power your agent
Perintah milik penerbit sendiri. Bukan endpoint PlugMCP.
Host a copy with our keys and logs.
npx -y [email protected]Claude Code tidak punya tautan instal untuk perintah lokal. Salin perintah di bawah dan jalankan di terminal.
DATABASE_URL=<secret> PG_HOST=<value> PG_PORT=<value> PG_USER=<value> PG_PASSWORD=<secret> PG_DATABASE=<value> PG_ALLOW_WRITE=<value> PG_SSLMODE=<value> PG_SSL_CA=<value> PG_ENABLE_RUNTIME_CONNECT=<value> PG_MAX_RESULT_BYTES=<value> PG_STATEMENT_TIMEOUT=<value> PG_CONNECT_TIMEOUT=<value> PG_SSH_HOST=<value> PG_SSH_PORT=<value> PG_SSH_USER=<value> PG_SSH_PRIVATE_KEY=<value> PG_SSH_PASSPHRASE=<secret> PG_SSH_AGENT=<value> PG_SSH_PASSWORD=<secret> PG_SSH_FINGERPRINT=<value> PG_SSH_KEEPALIVE_INTERVAL=<value> claude mcp add io.github.antonorlov-mcp-postgres-server -- npx -y mcp-postgres-server@0.3.1Jalankan di terminal.
{ "mcpServers": { "io.github.antonorlov-mcp-postgres-server": { "command": "npx", "args": [ "-y", "[email protected]" ], "env": { "DATABASE_URL": "<secret>", "PG_HOST": "<value>", "PG_PORT": "<value>", "PG_USER": "<value>", "PG_PASSWORD": "<secret>", "PG_DATABASE": "<value>", "PG_ALLOW_WRITE": "<value>", "PG_SSLMODE": "<value>", "PG_SSL_CA": "<value>", "PG_ENABLE_RUNTIME_CONNECT": "<value>", "PG_MAX_RESULT_BYTES": "<value>", "PG_STATEMENT_TIMEOUT": "<value>", "PG_CONNECT_TIMEOUT": "<value>", "PG_SSH_HOST": "<value>", "PG_SSH_PORT": "<value>", "PG_SSH_USER": "<value>", "PG_SSH_PRIVATE_KEY": "<value>", "PG_SSH_PASSPHRASE": "<secret>", "PG_SSH_AGENT": "<value>", "PG_SSH_PASSWORD": "<secret>", "PG_SSH_FINGERPRINT": "<value>", "PG_SSH_KEEPALIVE_INTERVAL": "<value>" } } }}claude_desktop_config.json
URL remote atau perintah di mesin Anda? Perbedaan kedua cara instal
Dari penerbit
A Model Context Protocol (MCP) server for PostgreSQL: local, Docker, RDS, Neon, and Supabase databases.
The server is small and auditable, with four runtime dependencies: the MCP SDK, , , and (plus , an optional dependency used only for SSH tunneling).
MCP server for PostgreSQL: local, Docker, RDS, Neon, Supabase, or behind an SSH bastion.
Jalankan di PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
Bukapgpg-connection-stringzodssh2Requires Node.js 20 or newer.
The preferred way to configure the server is a single DATABASE_URL:
{
"mcpServers": {
"postgres": {
"type": "stdio",
"command": "npx",
"args": ["-y", "mcp-postgres-server"],
"env": {
"DATABASE_URL": "postgres://user:password@localhost:5432/mydb",
"PG_ALLOW_WRITE": "false"
}
}
}
}
With PG_ALLOW_WRITE set to "false" the server has read-only access to the
database. This is the default; set it to "true" only if the model must write.
The same JSON works in any MCP client that speaks stdio: VS Code, Cursor, Claude Code, Codex, Windsurf.
Alternatively, set the individual PG_* variables; they are used when
DATABASE_URL is not set:
{
"mcpServers": {
"postgres": {
"type": "stdio",
"command": "npx",
"args": ["-y", "mcp-postgres-server"],
"env": {
"PG_HOST": "your_host",
"PG_PORT": "5432",
"PG_USER": "your_user",
"PG_PASSWORD": "your_password",
"PG_DATABASE": "your_database",
"PG_ALLOW_WRITE": "false"
}
}
}
}
npm install mcp-postgres-server
Or run directly with:
npx mcp-postgres-server
Local Postgres:
DATABASE_URL=postgres://mcp_readonly:secret@localhost:5432/mydb
Postgres in Docker: if the database runs in a container with a published
port, connect to localhost:<published-port> as usual. If the MCP server
itself runs inside a container and the database runs on your host machine,
use host.docker.internal instead of localhost:
DATABASE_URL=postgres://mcp_readonly:[email protected]:5432/mydb
Amazon RDS:
DATABASE_URL=postgres://mcp_readonly:[email protected]:5432/mydb?sslmode=require
Neon:
DATABASE_URL=postgres://mcp_readonly:[email protected]/mydb?sslmode=require
Supabase:
DATABASE_URL=postgres://postgres.xxxxxxxx:[email protected]:5432/postgres?sslmode=require
Tool availability depends on configuration:
Execute a read-only SQL statement. Accepts SELECT, WITH ... SELECT,
EXPLAIN, and SHOW. One statement per call - multi-statement input is rejected
by the extended query protocol. In read-only mode (the default) the statement runs
as BEGIN READ ONLY, the query, and ROLLBACK - three commands, roughly two
network round trips with pipelining - so the database itself refuses any write.
With PG_ALLOW_WRITE=true the statement is sent directly, without that wrapper, so a
write run through query would execute - use execute for writes.
Supports PostgreSQL-style $1, $2 prepared-statement parameters; values are bound
by the driver and never spliced into the SQL text.
use_mcp_tool({
server_name: "postgres",
tool_name: "query",
arguments: {
sql: "SELECT * FROM users WHERE id = $1",
params: [1]
}
});
Returns compact JSON: {"rows": [...], "rowCount": n, "returnedRows": n, "truncated": false}.
When the serialized rows exceed PG_MAX_RESULT_BYTES, only the rows that fit are returned
(returnedRows < rowCount), truncated is true, and a hint suggests adding LIMIT/WHERE
or selecting fewer columns.
List all schemas in the connected database.
use_mcp_tool({
server_name: "postgres",
tool_name: "list_schemas",
arguments: {}
});
List tables in the connected database. Accepts an optional schema parameter (defaults to 'public').
// List tables in the 'public' schema (default)
use_mcp_tool({
server_name: "postgres",
tool_name: "list_tables",
arguments: {}
});
// List tables in a specific schema
use_mcp_tool({
server_name: "postgres",
tool_name: "list_tables",
arguments: {
schema: "my_schema"
}
});
Get the structure of a specific table (columns, types, nullability, defaults, primary keys). Accepts an optional schema parameter (defaults to 'public').
use_mcp_tool({
server_name: "postgres",
tool_name: "describe_table",
arguments: {
table: "users",
schema: "my_schema" // optional
}
});
PG_ALLOW_WRITE=trueExecute an INSERT, UPDATE, DELETE, or DDL statement. Always registered, but
in read-only mode (the default) it refuses with an error naming PG_ALLOW_WRITE
and changes nothing - the statement never reaches the database. With
PG_ALLOW_WRITE=true it runs: same $1, $2 parameter handling as query, one
complete statement per call, and the connecting role governs what it may do.
Returns {"rowCount": n, "command": "INSERT"}.
use_mcp_tool({
server_name: "postgres",
tool_name: "execute",
arguments: {
sql: "INSERT INTO users (name, email) VALUES ($1, $2)",
params: ["John Doe", "[email protected]"]
}
});
PG_ENABLE_RUNTIME_CONNECT=trueConnect to a different PostgreSQL database at runtime using provided
credentials. Not registered by default - prefer configuring credentials
through the environment so they never pass through model-visible arguments.
Session limits (statement_timeout, idle_in_transaction_session_timeout) are
re-applied after every reconnect; read-only reads enforce read-only in their own
BEGIN READ ONLY transaction.
use_mcp_tool({
server_name: "postgres",
tool_name: "connect_db",
arguments: {
host: "localhost",
port: 5432,
user: "your_user",
password: "your_password",
database: "your_database"
}
});
To reach a database only accessible through a bastion, see SSH tunneling (adds PG_SSH_* variables).
PG_ALLOW_WRITE=true)BEGIN READ ONLY), never by client-side SQL parsingpg driver never leaks past itDATABASE_URL support with SSL (sslmode=disable|allow|prefer|require|verify-ca|verify-full, custom CA)$1-style placeholders, bound by the drivertruncated flag instead of flooding the model's contextPG_SSH_*) with mandatory host-key verification, loaded only when configuredFull details, including the threat model and disclosure process, are in SECURITY.md. The short version:
A least-privilege database role is the real boundary. The MCP works with existing credentials; creating or changing roles is not required. A dedicated role is what actually guarantees writes are impossible. On PostgreSQL 14+, the following is a starting point:
CREATE ROLE mcp_readonly LOGIN PASSWORD 'change-me';
GRANT CONNECT ON DATABASE your_database TO mcp_readonly;
GRANT pg_read_all_data TO mcp_readonly; -- adds read privileges
ALTER ROLE mcp_readonly SET default_transaction_read_only = on; -- read-only by default
(On PostgreSQL 13 or older, grant SELECT explicitly instead of
pg_read_all_data - see SECURITY.md.) The server warns on
stderr if you connect as a superuser. Read grants do not revoke existing
privileges, and defaults remain mutable; available functions, ownership and
inherited privileges also matter.
The engine enforces read-only. There is no client-side SQL parsing. In
read-only mode every read runs in a rolled-back BEGIN READ ONLY transaction,
so PostgreSQL itself - which alone knows what a function, view, or rule does -
refuses any write with SQLSTATE 25006 and reverts any session change the
statement made. The extended protocol rejects multi-command strings.
Honest framing: the read-only transaction is defense-in-depth on top of the role, not a replacement for it. Read-only mode stops a confused or prompt-injected model from writing to your database; it does not stop prompt injection carried in the row data a query returns. Don't point this server at production - use a replica, a snapshot, or a tightly scoped role. See SECURITY.md.
Set PG_SSH_HOST (plus auth and host-key verification) to reach a database that is only accessible
through a bastion (an SSH jump host). The connection string / PG_* fields then describe the
database as seen from the bastion:
{
"mcpServers": {
"postgres": {
"type": "stdio",
"command": "npx",
"args": ["-y", "mcp-postgres-server"],
"env": {
"DATABASE_URL": "postgres://mcp_readonly:[email protected]:5432/mydb?sslmode=verify-full",
"PG_SSH_HOST": "bastion.example.com",
"PG_SSH_USER": "jump",
"PG_SSH_PRIVATE_KEY": "/home/me/.ssh/id_ed25519",
"PG_SSH_FINGERPRINT": "SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
}
}
}
connect_db behave exactly as on a direct connection, and no extra SQL is sent per query.PG_SSH_FINGERPRINT - the tunnel will not
connect without it, so a man-in-the-middle bastion is refused. Get the fingerprint over a channel
you trust, most trustworthy first:
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
(no network involved);~/.ssh/known_hosts, if you already reach the host over ssh:
ssh-keygen -lF bastion.example.com;ssh-keyscan bastion.example.com | ssh-keygen -lf - (trust this only
when run from a network position you trust - it accepts whatever the host returns).verify-full, the certificate is checked against
the database's own hostname (e.g. db.internal), not the loopback the tunnel binds locally, and
rejectUnauthorized is pinned on so an inherited NODE_TLS_REJECT_UNAUTHORIZED=0 cannot disable it.ssh2 is an optional dependency, loaded only when PG_SSH_HOST is set, so a direct connection
never initializes it. npm installs optional dependencies by default; run
npm install --omit=optional to skip it entirely (a direct connection does not need it).A tunneled connection that fails reports a stable SSH_* code - see Error Handling.
SQL and connection failures are returned as tool results (isError: true)
with a message, the SQLSTATE code, and a hint. PostgreSQL's own server hint is
used when present; otherwise these fallbacks apply:
Over an SSH tunnel, a failure carries a stable code (and, where
the cause is determinate, a hint naming the setting to fix), so the failing phase is unambiguous:
A genuine PostgreSQL error through a healthy tunnel keeps its own code (e.g. 28P01 for wrong
database credentials), not an SSH code.
Not needed for new installs. Two behavior changes since 0.1.x:
execute tool is always visible but refuses
writes (with an error naming the flag) unless PG_ALLOW_WRITE=true, and every
read runs inside an engine-enforced READ ONLY transaction. If your workflow
writes to the database, set "PG_ALLOW_WRITE": "true" to restore 0.1.x behavior.connect_db is disabled by default. Runtime connection switching (passing
credentials through tool arguments) requires PG_ENABLE_RUNTIME_CONNECT=true;
otherwise connection details come only from the environment.Tool names, parameter names, and PG_* variables are unchanged. Result payloads
are now structured compact JSON for every tool (e.g. query returns
{rows, rowCount, returnedRows, truncated} instead of a bare row array) - see
CHANGELOG.md for the exact shapes before updating anything that
parses tool output.
MIT
MCP server for PostgreSQL: local, Docker, RDS, Neon, Supabase, or behind an SSH bastion.
{ "mcpServers": { "io.github.antonorlov-mcp-postgres-server": { "command": "npx", "args": [ "-y", "[email protected]" ], "env": { "DATABASE_URL": "<secret>", "PG_HOST": "<value>", "PG_PORT": "<value>", "PG_USER": "<value>", "PG_PASSWORD": "<secret>", "PG_DATABASE": "<value>", "PG_ALLOW_WRITE": "<value>", "PG_SSLMODE": "<value>", "PG_SSL_CA": "<value>", "PG_ENABLE_RUNTIME_CONNECT": "<value>", "PG_MAX_RESULT_BYTES": "<value>", "PG_STATEMENT_TIMEOUT": "<value>", "PG_CONNECT_TIMEOUT": "<value>", "PG_SSH_HOST": "<value>", "PG_SSH_PORT": "<value>", "PG_SSH_USER": "<value>", "PG_SSH_PRIVATE_KEY": "<value>", "PG_SSH_PASSPHRASE": "<secret>", "PG_SSH_AGENT": "<value>", "PG_SSH_PASSWORD": "<secret>", "PG_SSH_FINGERPRINT": "<value>", "PG_SSH_KEEPALIVE_INTERVAL": "<value>" } } }}Tool
Belum ada daftar tool. Server remote mendapatkannya setelah pemeriksaan kesehatan pertama.
FAQ
Salin konfigurasi stdio untuk Cursor, Claude Desktop, Claude Code, atau VS Code di halaman ini. Konfigurasi ini memakai instalasi dari penerbit, bukan proxy PlugMCP.
Penerbit mencantumkan variabel lingkungan berikut: DATABASE_URL, PG_HOST, PG_PORT, PG_USER, PG_PASSWORD, PG_DATABASE, PG_ALLOW_WRITE, PG_SSLMODE, PG_SSL_CA, PG_ENABLE_RUNTIME_CONNECT, PG_MAX_RESULT_BYTES, PG_STATEMENT_TIMEOUT, PG_CONNECT_TIMEOUT, PG_SSH_HOST, PG_SSH_PORT, PG_SSH_USER, PG_SSH_PRIVATE_KEY, PG_SSH_PASSPHRASE, PG_SSH_AGENT, PG_SSH_PASSWORD, PG_SSH_FINGERPRINT, PG_SSH_KEEPALIVE_INTERVAL.
PostgreSQL berjalan secara lokal melalui stdio.
Terakhir diperiksa 2026-11-09. MCP server for PostgreSQL: local, Docker, RDS, Neon, Supabase, or behind an SSH bastion.