pRESTd
pREST (PostgreSQL REST) is a production-ready API that delivers instant REST and Model Context Protocol (MCP) APIs on your existing or new SQL database — CRUD, custom SQL routes, auth, ACL, and a read-only MCP endpoint — without hand-writing a backend.
PostgreSQL 9.5+ is the default engine. MySQL 8.0.19+ is a separate native dialect from v2.5.0. Read-only MCP on MySQL is v2.5.1. Set engine = "mysql" to select it. An unset engine stays PostgreSQL. MariaDB, TiDB, and Aurora MySQL stay on the roadmap.
PostgreSQL 9.5+ (default). MySQL 8.0.19+ with
engine = "mysql".
Contributor License Agreement —
Documentation
Full documentation lives at docs.prestd.com.
Quick start
Install and run options (Docker, Homebrew, or Go) are documented in Get pREST. Point pREST at Postgres (PREST_PG_URL or pg.* / DATABASE_URL), then call:
GET /{database}/{schema}/{table}
MySQL 8.0.19+ uses the same path. {schema} is the MySQL database. Set the engine and a mysql:// URL. The port defaults to 3306 when unset. PREST_DB_* is read first, then the legacy PREST_PG_* names:
engine = "mysql"
[pg]
url = "mysql://user:pass@localhost:3306/mydb"
export PREST_ENGINE=mysql
export PREST_DB_URL='mysql://user:pass@localhost:3306/mydb'
A missing user or database fails startup. Postgres defaults (user postgres, database prest, port 5432) are not copied onto a MySQL engine. Guide: MySQL.
See Configuring pREST for auth, ACL, custom queries, and MCP.
Serving several databases
pREST can serve multiple databases in two modes:
Registry mode
Define a [[databases]] registry in prest.toml or use environment variables (DATABASE_ALIAS_<n> / DATABASE_URL_<n>). Aliases may differ from database names, and entries can be on the same host or different hosts:
[[databases]]
alias = "main"
url = "postgres://user:pass@localhost:5432/prest_main?sslmode=disable"
[[databases]]
alias = "tenant-1"
url = "postgres://user:pass@localhost:5432/tenant_1?sslmode=disable"
[[databases]]
alias = "reporting"
url = "mysql://user:[email protected]:3306/reports?tls=false"
Or via environment:
DATABASE_ALIAS_1=main
DATABASE_URL_1="postgres://user:pass@localhost:5432/prest_main?sslmode=disable"
DATABASE_ALIAS_2=tenant-1
DATABASE_URL_2="postgres://user:pass@localhost:5432/tenant_1?sslmode=disable"
An entry that is unreachable at start-up is logged and answers 503 ("database unavailable") until it comes up; start-up fails only when every entry is unreachable or the configuration is invalid.
No-registry mode
Use pg.database plus pg.allowed_databases on the [pg] host with the [pg] credentials. Both Postgres and MySQL are supported. On MySQL, {schema} must equal {database}:
[pg]
database = "prest"
allowed_databases = ["secondary-db"]
Or via environment (comma-separated for allowed databases):
PREST_PG_DATABASE=prest
PREST_PG_ALLOWED_DATABASES=secondary-db,another-db
# or for MySQL:
PREST_DB_DATABASE=mydb
PREST_DB_ALLOWED_DATABASES=other-db
Catalog and MCP
The /databases endpoint and MCP prest.list_databases show only the served databases. In registry mode, that is the configured aliases. Without a registry, that is pg.database plus pg.allowed_databases.
Postgres supports up to 64 open pools. MySQL creates one pool per served database.
Migrating from pg.single
The pg.single configuration key has been removed and is ignored with a warning. Behavior changes:
- Allow-listed names are always served. Previously,
pg.single = true(the default) required requests to be for the mainpg.database; allow-listed names were ignored. Now they are served whether the deprecated key is set or not. - A registry is no longer limited to
pg.database. Previously, with both a registry andpg.single = true, every request was restricted to the main database. Now a registry serves its configured aliases freely. /databasesand MCP list only served databases. Requests for unlisted databases return 400 "database not registered".- On MySQL without a registry,
/{database}/{other-schema}/…returns 404. On MySQL a schema is a database, so{schema}must equal{database}. Previously any database the MySQL user had grants on was reachable throughpg.database.
Passing values to query scripts
Values a _QUERIES script template interpolates become part of the SQL text, so
pREST screens them: anything carrying quotes, --, ::, or — for multi-word
values — a SQL keyword is refused, and a refused value that is interpolated fails
the request with 400.
Bind free-form values instead, and the screen does not apply at all. On PostgreSQL, a bound value travels to the database out of band, where it can never be parsed as SQL:
-- interpolated: screened, and rejected for values like 'compra do mes'
SELECT * FROM articles WHERE slug = '{{.slug}}'
-- bound: the caller's value arrives verbatim, whatever it contains
SELECT * FROM articles WHERE slug = {{sqlVal "slug"}}
That table is the PostgreSQL rendering. On MySQL, {{sqlVal "key"}} renders ?, {{sqlList "key"}} renders (?,?), and {{ident "key"}} renders backtick names such as `shop`.`users`. With the default prepare = false, MySQL interpolates those ? placeholders into the statement. prepare = true uses binary prepared statements, and then the values travel out of band.
sqlVal and sqlList also reach headers as {{sqlVal "header.X-Application"}}.
Credential headers (Authorization, Cookie, …) are always withheld.
Prefer binding for anything user-supplied — search phrases especially, since a
phrase containing a common word such as do, as or or is exactly what the
interpolation screen refuses.
1-Click Deploy
Heroku
Deploy to Heroku and get a realtime RESTful API backed by Heroku Postgres:
More: Deploy in Heroku.
Contributing
Contributions are welcome. See the Development Guide and Contributing to pREST. Please sign the CLA.
Questions? GitHub Discussions or Discord.
Testing
Run unit tests locally:
make test-unit
Run integration suites inside Docker (no local database required):
# Postgres (full stack: default, auth, multicluster, queries) — also: make test-integration
make test-integration-postgres
# TimescaleDB (Timescale-specific E2E only)
make test-integration-timescaledb
# MySQL 8 (./integration/mysql/... only). Default image mysql:8.4.
# Override: MYSQL_IMAGE=mysql:8.0 make test-integration-mysql
make test-integration-mysql
Or with Docker Compose:
docker compose -f integration/postgres/docker-compose.yml up -d --wait \
postgres postgres-b db-init prestd prestd-multicluster prestd-auth prestd-queries
docker compose -f integration/postgres/docker-compose.yml run --rm --no-deps tests
docker compose -f integration/postgres/docker-compose.yml down -v --remove-orphans
Postgres compose runs ./integration/suites/... and ./integration/postgres/....
TimescaleDB compose runs ./integration/timescaledb/... only (see .github/workflows/test-integration-timescaledb.yml).
MySQL compose runs ./integration/mysql/... only (see .github/workflows/test-integration-mysql.yml). CI runs mysql:8.0, mysql:8.4, and mysql:latest.
Network tests require PREST_TEST_URL (and flavor-specific URLs for the Postgres job); outside Compose those tests skip when the URLs are unset.
Example: Docker Build
Build the Docker image locally for development (compiles from source):
docker build -t prest/prest:latest .
For release builds, GoReleaser uses the same Dockerfile / Dockerfile.noplugins with a pre-built prestd binary. Local source builds can pass version metadata via build arguments:
docker build \
--build-arg VERSION=v1.0.0 \
--build-arg COMMIT=hash \
--build-arg DATE=2026-02-11 \
-t prest/prest:latest .