PostgreSQL MCP server & Claude connector

Does PostgreSQL have an official MCP server or Claude connector?

Community only

As of October 2026, no official PostgreSQL MCP server was verified; the PostgreSQL project publishes none. The best-known server, the modelcontextprotocol reference implementation, is archived and had a documented read-only bypass. Maintained community options such as Postgres MCP Pro run locally with a connection string. Use a read-only database role regardless.

Last checked October 18, 2026

Verdict and evidence

What we checked: Postgres MCP Pro (crystaldba/postgres-mcp)
Published by: Crystal DBA (community)
Runs: Runs locally
Sign-in: API key or token
Stage: unknown
Plan: Free, open source (MIT). Needs a Postgres connection string.

Evidence

crystaldba/postgres-mcp (github.com, seen October 18, 2026)

What an AI can do in PostgreSQL

Read

List schemaslist_schemas
Get object detailsget_object_details
Explain a queryexplain_query
Top slow queriesget_top_queries
Database health analysisanalyze_db_health

Run

Execute SQL (read-only in restricted mode)execute_sql

From the publisher’s documentation for the version we checked. Not every tool is listed.

Setup

Claude (claude.ai / Desktop)

Docker-based entry in claude_desktop_config.json. Prefer --access-mode=restricted and a read-only role.

{
  "mcpServers": {
    "postgres": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "DATABASE_URI",
        "crystaldba/postgres-mcp",
        "--access-mode=unrestricted"
      ],
      "env": {
        "DATABASE_URI": "postgresql://username:password@localhost:5432/dbname"
      }
    }
  }
}

Source

Safety check

Flag
Publisher verified
Community project owned by the crystaldba GitHub organization, not by the PostgreSQL project.
Flag
Auth model
Database URI with username and password passed via DATABASE_URI environment variable; use a least-privilege role.
Flag
Write and delete access
README config examples use --access-mode=unrestricted (full read/write, including schema changes). --access-mode=restricted limits to read-only transactions, but the README says it may not be safe for production and that unsafe stored-procedure languages can circumvent it.
Pass
Tool-description injection scan
Read the README tool table; no text addressed to the AI.
Pass
Repo maintenance
Pushed 2026-08-17, not archived, 3,403 stars, MIT.

Other options

Built and maintained by third parties, not PostgreSQL. Check the safety notes before connecting one to a real account.

Reference PostgreSQL MCP server (archived)

Model Context Protocol project (Anthropic-led reference servers) · Runs locally · API key or token

Run a read-only SQL query

⚠ Publisher verified: Published in the modelcontextprotocol org as a reference implementation, not by the PostgreSQL project.
⚠ Auth model: Connection string with credentials on the command line.
⚠ Write and delete access: Advertised as read-only via READ ONLY transactions, but Datadog Security Labs showed that stacked statements such as 'COMMIT; DROP SCHEMA public CASCADE;' escape the read-only transaction. Fixed in the git repo on 2025-05-29 per that report; the last npm release was reported unpatched.
⚠ Repo maintenance: Archived; last push 2025-05-28.

modelcontextprotocol/servers-archived (github.com, seen October 18, 2026)
MCP vulnerability case study: SQL injection in the PostgreSQL MCP server (securitylabs.datadoghq.com, seen October 18, 2026)

FAQ

Is there an official PostgreSQL MCP server?

No official MCP server from the PostgreSQL project was verified as of October 2026. Available servers are community-maintained.

What happened to the reference Postgres MCP server?

It was moved to modelcontextprotocol/servers-archived and is archived. Datadog Security Labs reported a SQL injection that bypassed its read-only transaction.

Is it safe to give an AI agent write access to Postgres?

Risky. Use a dedicated least-privilege database role, restricted/read-only modes, and a non-production copy where possible. Do not rely on read-only transactions alone.

Does a Postgres MCP server work with Claude and Cursor?

Yes, local servers such as Postgres MCP Pro document stdio configs for Claude Desktop and other clients.

Which Postgres MCP server should I use?

Postgres MCP Pro is actively maintained and has a restricted mode; evaluate it against your own security needs and always connect with a read-only role.

Last reviewed October 18, 2026.

Compare PostgreSQL

Something changed?

Vendors ship MCP updates often. If PostgreSQL launched, changed or retired a server, tell us and we will re-check it against primary sources. Submit a correction.

New official MCP servers, weekly

One short email when vendors ship, change or retire an official server or Claude connector. Checked against primary sources, like every verdict here.