Power your agent
คำสั่งของผู้เผยแพร่เอง ไม่ใช่เอนด์พอยต์ของ PlugMCP
Host a copy with our keys and logs.
npx -y [email protected]Claude Code ไม่มีลิงก์ติดตั้งสำหรับคำสั่งแบบโลคัล ให้คัดลอกคำสั่งด้านล่างแล้วรันในเทอร์มินัล
claude mcp add mcp-postgres-server -- npx -y mcp-postgres-server@0.3.1รันในเทอร์มินัล
{ "mcpServers": { "mcp-postgres-server": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
URL แบบรีโมตหรือคำสั่งบนเครื่องของคุณ? การติดตั้งสองแบบต่างกันอย่างไร
รันบน PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
เปิดจากผู้เผยแพร่
A Model Context Protocol (MCP) server for PostgreSQL: local, Docker, RDS, Neon, and Supabase databases.
The server is small and auditable, with four runtime dependencies: the MCP SDK, , , and (plus , an optional dependency used only for SSH tunneling).
MCP server for PostgreSQL: local, Docker, RDS, Neon, Supabase, or behind an SSH bastion.
pgpg-connection-stringzodssh2Requires Node.js 20 or newer.
The preferred way to configure the server is a single DATABASE_URL:
{
"mcpServers": {
"postgres": {
"type": "stdio",
"command": "npx",
"args": ["-y", "mcp-postgres-server"],
"env": {
"DATABASE_URL": "postgres://user:password@localhost:5432/mydb",
"PG_ALLOW_WRITE": "false"
}
}
}
}
With PG_ALLOW_WRITE set to "false" the server has read-only access to the
database. This is the default; set it to "true" only if the model must write.
The same JSON works in any MCP client that speaks stdio: VS Code, Cursor, Claude Code, Codex, Windsurf.
Alternatively, set the individual PG_* variables; they are used when
DATABASE_URL is not set:
{
"mcpServers": {
"postgres": {
"type": "stdio",
"command": "npx",
"args": ["-y", "mcp-postgres-server"],
"env": {
"PG_HOST": "your_host",
"PG_PORT": "5432",
"PG_USER": "your_user",
"PG_PASSWORD": "your_password",
"PG_DATABASE": "your_database",
"PG_ALLOW_WRITE": "false"
}
}
}
}
npm install mcp-postgres-server
Or run directly with:
npx mcp-postgres-server
Local Postgres:
DATABASE_URL=postgres://mcp_readonly:secret@localhost:5432/mydb
Postgres in Docker: if the database runs in a container with a published
port, connect to localhost:<published-port> as usual. If the MCP server
itself runs inside a container and the database runs on your host machine,
use host.docker.internal instead of localhost:
DATABASE_URL=postgres://mcp_readonly:[email protected]:5432/mydb
Amazon RDS:
DATABASE_URL=postgres://mcp_readonly:[email protected]:5432/mydb?sslmode=require
Neon:
DATABASE_URL=postgres://mcp_readonly:[email protected]/mydb?sslmode=require
Supabase:
DATABASE_URL=postgres://postgres.xxxxxxxx:[email protected]:5432/postgres?sslmode=require
Tool availability depends on configuration:
Execute a read-only SQL statement. Accepts SELECT, WITH ... SELECT,
EXPLAIN, and SHOW. One statement per call - multi-statement input is rejected
by the extended query protocol. In read-only mode (the default) the statement runs
as BEGIN READ ONLY, the query, and ROLLBACK - three commands, roughly two
network round trips with pipelining - so the database itself refuses any write.
With PG_ALLOW_WRITE=true the statement is sent directly, without that wrapper, so a
write run through query would execute - use execute for writes.
Supports PostgreSQL-style $1, $2 prepared-statement parameters; values are bound
by the driver and never spliced into the SQL text.
use_mcp_tool({
server_name: "postgres",
tool_name: "query",
arguments: {
sql: "SELECT * FROM users WHERE id = $1",
params: [1]
}
});
Returns compact JSON: {"rows": [...], "rowCount": n, "returnedRows": n, "truncated": false}.
When the serialized rows exceed PG_MAX_RESULT_BYTES, only the rows that fit are returned
(returnedRows < rowCount), truncated is true, and a hint suggests adding LIMIT/WHERE
or selecting fewer columns.
List all schemas in the connected database.
use_mcp_tool({
server_name: "postgres",
tool_name: "list_schemas",
arguments: {}
});
List tables in the connected database. Accepts an optional schema parameter (defaults to 'public').
// List tables in the 'public' schema (default)
use_mcp_tool({
server_name: "postgres",
tool_name: "list_tables",
arguments: {}
});
// List tables in a specific schema
use_mcp_tool({
server_name: "postgres",
tool_name: "list_tables",
arguments: {
schema: "my_schema"
}
});
Get the structure of a specific table (columns, types, nullability, defaults, primary keys). Accepts an optional schema parameter (defaults to 'public').
use_mcp_tool({
server_name: "postgres",
tool_name: "describe_table",
arguments: {
table: "users",
schema: "my_schema" // optional
}
});
PG_ALLOW_WRITE=trueExecute an INSERT, UPDATE, DELETE, or DDL statement. Always registered, but
in read-only mode (the default) it refuses with an error naming PG_ALLOW_WRITE
and changes nothing - the statement never reaches the database. With
PG_ALLOW_WRITE=true it runs: same $1, $2 parameter handling as query, one
complete statement per call, and the connecting role governs what it may do.
Returns {"rowCount": n, "command": "INSERT"}.
use_mcp_tool({
server_name: "postgres",
tool_name: "execute",
arguments: {
sql: "INSERT INTO users (name, email) VALUES ($1, $2)",
params: ["John Doe", "[email protected]"]
}
});
PG_ENABLE_RUNTIME_CONNECT=trueConnect to a different PostgreSQL database at runtime using provided
credentials. Not registered by default - prefer configuring credentials
through the environment so they never pass through model-visible arguments.
Session limits (statement_timeout, idle_in_transaction_session_timeout) are
re-applied after every reconnect; read-only reads enforce read-only in their own
BEGIN READ ONLY transaction.
use_mcp_tool({
server_name: "postgres",
tool_name: "connect_db",
arguments: {
host: "localhost",
port: 5432,
user: "your_user",
password: "your_password",
database: "your_database"
}
});
To reach a database only accessible through a bastion, see SSH tunneling (adds PG_SSH_* variables).
PG_ALLOW_WRITE=true)BEGIN READ ONLY), never by client-side SQL parsingpg driver never leaks past itDATABASE_URL support with SSL (sslmode=disable|allow|prefer|require|verify-ca|verify-full, custom CA)$1-style placeholders, bound by the drivertruncated flag instead of flooding the model's contextPG_SSH_*) with mandatory host-key verification, loaded only when configuredFull details, including the threat model and disclosure process, are in SECURITY.md. The short version:
A least-privilege database role is the real boundary. The MCP works with existing credentials; creating or changing roles is not required. A dedicated role is what actually guarantees writes are impossible. On PostgreSQL 14+, the following is a starting point:
CREATE ROLE mcp_readonly LOGIN PASSWORD 'change-me';
GRANT CONNECT ON DATABASE your_database TO mcp_readonly;
GRANT pg_read_all_data TO mcp_readonly; -- adds read privileges
ALTER ROLE mcp_readonly SET default_transaction_read_only = on; -- read-only by default
(On PostgreSQL 13 or older, grant SELECT explicitly instead of
pg_read_all_data - see SECURITY.md.) The server warns on
stderr if you connect as a superuser. Read grants do not revoke existing
privileges, and defaults remain mutable; available functions, ownership and
inherited privileges also matter.
The engine enforces read-only. There is no client-side SQL parsing. In
read-only mode every read runs in a rolled-back BEGIN READ ONLY transaction,
so PostgreSQL itself - which alone knows what a function, view, or rule does -
refuses any write with SQLSTATE 25006 and reverts any session change the
statement made. The extended protocol rejects multi-command strings.
Honest framing: the read-only transaction is defense-in-depth on top of the role, not a replacement for it. Read-only mode stops a confused or prompt-injected model from writing to your database; it does not stop prompt injection carried in the row data a query returns. Don't point this server at production - use a replica, a snapshot, or a tightly scoped role. See SECURITY.md.
Set PG_SSH_HOST (plus auth and host-key verification) to reach a database that is only accessible
through a bastion (an SSH jump host). The connection string / PG_* fields then describe the
database as seen from the bastion:
{
"mcpServers": {
"postgres": {
"type": "stdio",
"command": "npx",
"args": ["-y", "mcp-postgres-server"],
"env": {
"DATABASE_URL": "postgres://mcp_readonly:[email protected]:5432/mydb?sslmode=verify-full",
"PG_SSH_HOST": "bastion.example.com",
"PG_SSH_USER": "jump",
"PG_SSH_PRIVATE_KEY": "/home/me/.ssh/id_ed25519",
"PG_SSH_FINGERPRINT": "SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
}
}
}
connect_db behave exactly as on a direct connection, and no extra SQL is sent per query.PG_SSH_FINGERPRINT - the tunnel will not
connect without it, so a man-in-the-middle bastion is refused. Get the fingerprint over a channel
you trust, most trustworthy first:
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
(no network involved);~/.ssh/known_hosts, if you already reach the host over ssh:
ssh-keygen -lF bastion.example.com;ssh-keyscan bastion.example.com | ssh-keygen -lf - (trust this only
when run from a network position you trust - it accepts whatever the host returns).verify-full, the certificate is checked against
the database's own hostname (e.g. db.internal), not the loopback the tunnel binds locally, and
rejectUnauthorized is pinned on so an inherited NODE_TLS_REJECT_UNAUTHORIZED=0 cannot disable it.ssh2 is an optional dependency, loaded only when PG_SSH_HOST is set, so a direct connection
never initializes it. npm installs optional dependencies by default; run
npm install --omit=optional to skip it entirely (a direct connection does not need it).A tunneled connection that fails reports a stable SSH_* code - see Error Handling.
SQL and connection failures are returned as tool results (isError: true)
with a message, the SQLSTATE code, and a hint. PostgreSQL's own server hint is
used when present; otherwise these fallbacks apply:
Over an SSH tunnel, a failure carries a stable code (and, where
the cause is determinate, a hint naming the setting to fix), so the failing phase is unambiguous:
A genuine PostgreSQL error through a healthy tunnel keeps its own code (e.g. 28P01 for wrong
database credentials), not an SSH code.
Not needed for new installs. Two behavior changes since 0.1.x:
execute tool is always visible but refuses
writes (with an error naming the flag) unless PG_ALLOW_WRITE=true, and every
read runs inside an engine-enforced READ ONLY transaction. If your workflow
writes to the database, set "PG_ALLOW_WRITE": "true" to restore 0.1.x behavior.connect_db is disabled by default. Runtime connection switching (passing
credentials through tool arguments) requires PG_ENABLE_RUNTIME_CONNECT=true;
otherwise connection details come only from the environment.Tool names, parameter names, and PG_* variables are unchanged. Result payloads
are now structured compact JSON for every tool (e.g. query returns
{rows, rowCount, returnedRows, truncated} instead of a bare row array) - see
CHANGELOG.md for the exact shapes before updating anything that
parses tool output.
MIT
MCP server for PostgreSQL: local, Docker, RDS, Neon, Supabase, or behind an SSH bastion.
{ "mcpServers": { "mcp-postgres-server": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}เครื่องมือ
ยังไม่มีรายการเครื่องมือ เซิร์ฟเวอร์แบบรีโมตจะได้รายการหลังการตรวจสอบสถานะครั้งแรก
FAQ
คัดลอกคอนฟิก stdio สำหรับ Cursor, Claude Desktop, Claude Code หรือ VS Code ได้ในหน้านี้ คอนฟิกนี้ใช้การติดตั้งของผู้เผยแพร่ ไม่ใช่พร็อกซีของ PlugMCP
ระเบียนนี้ไม่ได้ระบุตัวแปรสภาพแวดล้อมที่จำเป็น
MCP Postgres Server ทำงานแบบโลคัลผ่าน stdio
ตรวจสอบล่าสุดเมื่อ 2026-11-13 MCP server for PostgreSQL: local, Docker, RDS, Neon, Supabase, or behind an SSH bastion.