Pgmoat

io.github.Kitalon-Labs-LLC

Governed, read-only Postgres access for AI agents: SQL safety, RLS, budgets, tamper-evident audit.

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "io.github.kitalon-labs-llc-pgmoat": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ],9      "env": {10        "PGMOAT_DATABASE_URL": "<secret>"11      }12    }13  }14}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y [email protected]

Credentials from the publisher

PGMOAT_DATABASE_URL — Postgres connection URL (use a read-only role)

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1PGMOAT_DATABASE_URL=<secret> claude mcp add io.github.kitalon-labs-llc-pgmoat -- npx -y pgmoat@0.1.1

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.kitalon-labs-llc-pgmoat": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ],9      "env": {10        "PGMOAT_DATABASE_URL": "<secret>"11      }12    }13  }14}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 0.1.1
API key: PGMOAT_DATABASE_URL
Last checked: 2026-10-28

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Pgmoat?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Pgmoat need an API key?

The publisher lists these environment variables: PGMOAT_DATABASE_URL.

What transport does Pgmoat use?

Pgmoat runs locally over stdio.

When was Pgmoat last checked?

Last checked 2026-10-28. Governed, read-only Postgres access for AI agents: SQL safety, RLS, budgets, tamper-evident audit.

From the publisher

Documentation

pgmoat

Governed Postgres access for AI agents.

pgmoat is an open-source MCP server that gives AI agents read-only access to Postgres. It checks every query with the real Postgres parser, hides the tables and columns you mark hidden, applies row limits and timeouts, binds Row-Level Security to the caller's identity, and writes a tamper-evident audit log.

Requires Node.js 22.12 or newer and Postgres 15 to 18.

Quickstart

Run it against your database with safe defaults, no config file needed:

npx -y pgmoat postgresql://readonly_user:password@localhost:5432/mydb

Add it to Claude Code:

claude mcp add pgmoat -- npx -y pgmoat postgresql://readonly_user:password@localhost:5432/mydb

Or to Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "pgmoat": {
      "command": "npx",
      "args": ["-y", "pgmoat", "--url-env", "PGMOAT_DATABASE_URL"],
      "env": { "PGMOAT_DATABASE_URL": "postgresql://readonly_user:password@localhost:5432/mydb" }
    }
  }
}

Passing the URL through --url-env keeps the password out of process listings.

Use a dedicated read-only role. pgmoat warns at startup if the role is a superuser or can write.

Add descriptions and hide sensitive data

export PGMOAT_DATABASE_URL=postgresql://readonly_user:password@localhost:5432/mydb
npx pgmoat init          # writes pgmoat.yaml; auto-hides columns like password_hash and token_hash
npx pgmoat validate      # checks the file against the schema and the database
npx pgmoat doctor        # checks the role for unsafe privileges
npx pgmoat start         # starts the server with ./pgmoat.yaml

A pgmoat.yaml looks like this:

version: 1
server:
  name: mydb
connection:
  url: ${PGMOAT_DATABASE_URL}
  schemas: [public]
mode: read-only
budgets:
  max_rows: 200
  max_query_ms: 5000
tables:
  users:
    description: "One row per login account"
    columns:
      password_hash: { hidden: true }
      email:         { sensitive: high }

Commands

Command	What it does
`pgmoat <postgres-url>`	Start with safe defaults (no config file)
`pgmoat init`	Create `pgmoat.yaml` from your database
`pgmoat start`	Start the MCP server from `pgmoat.yaml`
`pgmoat validate`	Check `pgmoat.yaml` against the schema and the database
`pgmoat doctor`	Check the database role for unsafe privileges
`pgmoat audit verify`	Verify the audit log hash chain
`pgmoat schema-export`	Write the visible schema as Markdown

Run pgmoat --help for all options.

What pgmoat does not do

It does not stop prompt injection. It removes the write path, hides what you mark hidden, and labels returned data as untrusted, but an agent with other tools (web access, email) can still be tricked into sending readable data elsewhere.
It does not replace Postgres permissions. The strongest control is a dedicated role with only the grants it needs.
It does not make RLS policies correct. It sets the session variables your policies read. A flawed policy stays flawed.
It does not guarantee audit delivery to a remote destination during an outage. It buffers, alarms, and records drops.

Docker

docker run -i --rm \
  -e PGMOAT_DATABASE_URL="postgresql://readonly_user:[email protected]:5432/mydb" \
  ghcr.io/kitalon-labs-llc/pgmoat:latest

Contributing

See CONTRIBUTING.md. Report vulnerabilities privately as described in SECURITY.md.

License

Pgmoat

io.github.Kitalon-Labs-LLC

Governed, read-only Postgres access for AI agents: SQL safety, RLS, budgets, tamper-evident audit.

Databases

Add to Cursor Add to VS Code Run on PlugMCP

GitHub npm

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "io.github.kitalon-labs-llc-pgmoat": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ],9      "env": {10        "PGMOAT_DATABASE_URL": "<secret>"11      }12    }13  }14}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y [email protected]

Credentials from the publisher

PGMOAT_DATABASE_URL — Postgres connection URL (use a read-only role)

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1PGMOAT_DATABASE_URL=<secret> claude mcp add io.github.kitalon-labs-llc-pgmoat -- npx -y pgmoat@0.1.1

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.kitalon-labs-llc-pgmoat": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ],9      "env": {10        "PGMOAT_DATABASE_URL": "<secret>"11      }12    }13  }14}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 0.1.1
API key: PGMOAT_DATABASE_URL
Last checked: 2026-10-28

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Pgmoat?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Pgmoat need an API key?

The publisher lists these environment variables: PGMOAT_DATABASE_URL.

What transport does Pgmoat use?

Pgmoat runs locally over stdio.

When was Pgmoat last checked?

Last checked 2026-10-28. Governed, read-only Postgres access for AI agents: SQL safety, RLS, budgets, tamper-evident audit.

From the publisher

Documentation

pgmoat

Governed Postgres access for AI agents.

Requires Node.js 22.12 or newer and Postgres 15 to 18.

Quickstart

Run it against your database with safe defaults, no config file needed:

npx -y pgmoat postgresql://readonly_user:password@localhost:5432/mydb

Add it to Claude Code:

claude mcp add pgmoat -- npx -y pgmoat postgresql://readonly_user:password@localhost:5432/mydb

Or to Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "pgmoat": {
      "command": "npx",
      "args": ["-y", "pgmoat", "--url-env", "PGMOAT_DATABASE_URL"],
      "env": { "PGMOAT_DATABASE_URL": "postgresql://readonly_user:password@localhost:5432/mydb" }
    }
  }
}

Passing the URL through --url-env keeps the password out of process listings.

Use a dedicated read-only role. pgmoat warns at startup if the role is a superuser or can write.

Add descriptions and hide sensitive data

export PGMOAT_DATABASE_URL=postgresql://readonly_user:password@localhost:5432/mydb
npx pgmoat init          # writes pgmoat.yaml; auto-hides columns like password_hash and token_hash
npx pgmoat validate      # checks the file against the schema and the database
npx pgmoat doctor        # checks the role for unsafe privileges
npx pgmoat start         # starts the server with ./pgmoat.yaml

A pgmoat.yaml looks like this:

version: 1
server:
  name: mydb
connection:
  url: ${PGMOAT_DATABASE_URL}
  schemas: [public]
mode: read-only
budgets:
  max_rows: 200
  max_query_ms: 5000
tables:
  users:
    description: "One row per login account"
    columns:
      password_hash: { hidden: true }
      email:         { sensitive: high }

Commands

Command	What it does
`pgmoat <postgres-url>`	Start with safe defaults (no config file)
`pgmoat init`	Create `pgmoat.yaml` from your database
`pgmoat start`	Start the MCP server from `pgmoat.yaml`
`pgmoat validate`	Check `pgmoat.yaml` against the schema and the database
`pgmoat doctor`	Check the database role for unsafe privileges
`pgmoat audit verify`	Verify the audit log hash chain
`pgmoat schema-export`	Write the visible schema as Markdown

Run pgmoat --help for all options.

What pgmoat does not do

It does not stop prompt injection. It removes the write path, hides what you mark hidden, and labels returned data as untrusted, but an agent with other tools (web access, email) can still be tricked into sending readable data elsewhere.
It does not replace Postgres permissions. The strongest control is a dedicated role with only the grants it needs.
It does not make RLS policies correct. It sets the session variables your policies read. A flawed policy stays flawed.
It does not guarantee audit delivery to a remote destination during an outage. It buffers, alarms, and records drops.

Docker

docker run -i --rm \
  -e PGMOAT_DATABASE_URL="postgresql://readonly_user:[email protected]:5432/mydb" \
  ghcr.io/kitalon-labs-llc/pgmoat:latest

Contributing

See CONTRIBUTING.md. Report vulnerabilities privately as described in SECURITY.md.

Pgmoat

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Pgmoat?

Does Pgmoat need an API key?

What transport does Pgmoat use?

When was Pgmoat last checked?

Documentation

pgmoat

Quickstart

Add descriptions and hide sensitive data

Commands

What pgmoat does not do

Docker

Contributing

Links

License

Pgmoat

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Pgmoat?

Does Pgmoat need an API key?

What transport does Pgmoat use?

When was Pgmoat last checked?

Documentation

pgmoat

Quickstart

Add descriptions and hide sensitive data

Commands

What pgmoat does not do

Docker

Contributing

Links

License