Best PostgreSQL MCP Servers in 2026, Compared

Last updated: November 2026

A PostgreSQL MCP server is a small program that lets an AI client such as Claude, ChatGPT or Cursor list your tables, read their schemas and run SQL, using the Model Context Protocol (MCP). The servers differ in three ways: what they allow by default, how finely you can limit them, and whether they run only on your laptop or also as a remote connector.

This guide compares eight options using their own READMEs and docs, checked on November 13, 2026. The sources are listed at the end. One disclosure: we build Automata, one of the eight. We list it alongside the others and say where the others are better.

PostgreSQL MCP server comparison table

"Only if you host it" means the server can serve HTTP, but you must deploy it at a public HTTPS address and add authentication before Claude.ai or ChatGPT can reach it. Each server's section below has the exact settings.

Which one should you pick?

Production read-only analytics. You want a server where read-only is the default, not a flag you might forget. pgEdge and Automata both start read-only. With any server, connect as a database role that can only SELECT, and point it at a read replica if you have one. The role is what actually enforces the limit. Server settings only add a second layer on top.

DBA work and performance tuning. Use Postgres MCP Pro. None of the other servers here match its tuning tools. It recommends indexes from your workload (pg_stat_statements), simulates hypothetical indexes with hypopg, and checks index, vacuum, buffer cache, replication and sequence health. Run it in restricted mode against production.

Several databases. Use DBHub. One process connects to PostgreSQL, MySQL, MariaDB, SQL Server, Oracle and SQLite, and a TOML file can configure several connections at once. Google's MCP Toolbox covers even more sources, including BigQuery, Spanner, MongoDB and Redis, but it is heavier to set up.

Already on Supabase or Neon. Use your platform's server. Both are hosted, sign in with OAuth, and also manage things a plain Postgres server can't: branches, migrations, edge functions and project settings. Turn on read-only mode and scope the server to one project.

Teams that need per-table scoping and remote clients. You need two things: a table allowlist the server enforces, and an HTTPS endpoint that Claude.ai and ChatGPT can reach. Automata's PostgreSQL MCP server gives each connector token its own table list, so a finance analyst and a support lead can use different tokens on the same database. pgEdge can do similar scoping if you set up separate Postgres roles or row-level security policies yourself.

The PostgreSQL MCP servers, one by one

1. Postgres MCP Pro (crystaldba/postgres-mcp)

What it does: It is a performance-focused Postgres server. Tools cover schema listing, execute_sql, explain_query (including hypothetical indexes), workload and query index analysis, and analyze_db_health.

Setup: docker pull crystaldba/postgres-mcp, then pass your connection URI and --access-mode.

Strengths: It has the deepest tuning features in this list. Its index advisor searches many candidate indexes against your real workload. Restricted mode runs queries in read-only transactions and limits execution time. It is MIT-licensed.

Limitations: The default access mode is unrestricted (read/write), so copying an example config gives the AI write access. There are no table-level controls. Remote use means running your own SSE or streamable HTTP endpoint. The last tagged release is v0.3.0 from May 2025, although commits continued into 2026.

2. DBHub (bytebase/dbhub)

What it does: It is a small server that works with several databases. It has two default tools, execute_sql and search_objects, plus optional explain_sql, health_check and custom tools you define in TOML.

Setup: npx @bytebase/dbhub@latest --transport stdio --dsn "postgres://…"

Strengths: It supports six database engines. Its token footprint is small: its own docs measure about 1.4k tokens for the default tools, against about 19k for MCP Toolbox and Supabase MCP. Read-only mode is enforced twice, by a keyword allowlist and by the database's own read-only mode. It also offers row limits, query timeouts, SSH tunnels and a built-in web workbench. It is the example the Claude Code docs use for Postgres.

Limitations: Read-only is opt-in per tool. There is no table allowlist; its docs tell you to rely on a least-privilege role. There's no hosted version. Bytebase's paid product is where its approval flows, data masking and audit logs live.

3. Microsoft postgres-mcp (microsoft/postgres-mcp)

What it does: It is a Postgres server for coding agents, covering queries, schema scripts, CSV bulk loading and performance diagnostics. It is marked "Preview".

Setup: npx -y @microsoft/postgres-mcp connection add local "postgresql://…", then point your client at npx -y @microsoft/postgres-mcp run.

Strengths: Passwords are stored in your OS keyring, not in config files. It supports Microsoft Entra ID for Azure. Its README says plainly that "the server doesn't decide what's allowed — your database does."

Limitations: It is stdio only, so it can't be a Claude.ai or ChatGPT connector. Write tools are allowed unless the profile sets access_mode: ro. It is early, with a small community so far.

4. pgEdge Postgres MCP Server (pgEdge/pgedge-postgres-mcp)

What it does: It is a Go server with an optional natural-language CLI and web chat client. It offers query, schema, EXPLAIN and hybrid vector search tools.

Setup: Run the binary or Docker image with a YAML config. See its Quick Start.

Strengths: Queries run in read-only transactions by default. The HTTP mode has built-in authentication with API tokens, user accounts and OAuth, which works for Claude Desktop and the Claude mobile apps. Each authenticated user can map to its own Postgres role, so row-level security and column grants apply automatically. It uses the PostgreSQL License.

Limitations: Its README warns it is "NOT FOR PUBLIC-FACING APPLICATIONS", because the server can read your entire schema and data. Table scoping depends on your Postgres roles and policies; the server has no allowlist of its own. There's no hosted version. It supports PostgreSQL 14 and later.

5. The official reference server (@modelcontextprotocol/server-postgres)

What it does: It has one query tool, plus table schemas exposed as MCP resources.

Status: Archived since May 2025. It now lives in modelcontextprotocol/servers-archived, and npm marks it "Archived and unmaintained; no security guarantees."

Why to avoid it: It wraps each query in BEGIN TRANSACTION READ ONLY, but accepts multiple statements in one call. In August 2025, Datadog Security Labs showed that a COMMIT in the input ends the read-only transaction, and any statements after it then run with the role's full privileges. Many old tutorials still recommend this package. Choose a maintained server instead.

6. MCP Toolbox for Databases (googleapis/mcp-toolbox, formerly genai-toolbox)

What it does: It is Google's open-source server for many data sources. --prebuilt=postgres gives you about 30 tools, from execute_sql and list_tables to locks, bloat, replication and query statistics.

Setup: Run the toolbox binary with --prebuilt=postgres and POSTGRES_* environment variables.

Strengths: You can write a tools.yaml that exposes only specific parameterized queries, so the AI can run exactly those queries and nothing else. That is the tightest scoping in this list, if you're willing to write the queries. It handles connection pooling, IAM auth and OpenTelemetry. It's Apache 2.0, and Google Cloud offers managed MCP servers for Cloud SQL and AlloyDB.

Limitations: The prebuilt execute_sql runs anything the role is allowed to run. The prebuilt tool set is large, which costs context tokens. It is most at home on Google Cloud.

7. Supabase MCP and Neon MCP

Supabase MCP is a hosted server at https://mcp.supabase.com/mcp with OAuth sign-in. Besides SQL, it manages tables, migrations, branches, edge functions and logs. Adding read_only=true runs queries "as a read-only Postgres user", and project_ref= limits it to one project. Supabase's docs advise connecting to a production project "only when the task requires production evidence." Self-hosted Supabase gets a smaller tool set.

Neon MCP is a hosted server at https://mcp.neon.tech/mcp (MIT-licensed source). It manages projects, branches and migrations through the Neon API and runs SQL. Read-only mode comes from readonly=true in the URL, or from unticking "Allow writes" at sign-in. You can also pin a project and a Postgres role. Neon's README says it is "intended for local development and IDE integrations only" and does not recommend it for production.

Both: they are the easiest choice if you already use the platform, but neither works with a Postgres database hosted elsewhere, and neither has table-level permissions.

8. Automata

What it does: Automata is an MIT-licensed MCP server, hosted or self-hosted, that connects Claude (Claude.ai, Desktop and Code), ChatGPT and Cursor to PostgreSQL. It also connects to WhatsApp, Telegram and email. The Automata PostgreSQL MCP server has five tools: get-database-info, list-tables, describe-table, run-query and run-statement.

Setup: Add a connection string (ideally a least-privilege role), choose the tables, and paste the connector URL into Claude or ChatGPT.

Strengths:

• Each connector token is bound to one database and starts read-only.
• A token can be limited to specific tables, and every query's plan is checked against that allowlist before a row is read.
• Read queries run one statement at a time in a read-only transaction, so the stacked-COMMIT attack above doesn't work.
• Writes need the separate run-statement tool, granted explicitly, and an update that touches more rows than the cap is rolled back.
• It is a remote connector, so it works in Claude.ai and ChatGPT and not only in desktop apps.
• Each person or agent can get a separate token that can be revoked on its own.

Limitations:

• It has no index tuning or health checks. Postgres MCP Pro is much better there.
• Among databases it supports only Postgres, so DBHub or MCP Toolbox are better for MySQL or SQL Server.
• Queries that call user-defined functions are refused, because the plan check can't see which tables a function reads.
• The hosted free plan covers one connection. Pro costs $19/month.
• On the hosted version, queries pass through Automata's servers. Self-host it if that's a problem.
• It is a younger project than most here, with a smaller community.

How to give an AI safe Postgres access

These steps matter more than which server you choose. Every server here runs SQL as the database role you give it. The role is the real security boundary.

1. Create a least-privilege role. Grant CONNECT, USAGE on the schema, and SELECT on only the tables the AI needs. Never use the postgres superuser or your application's role.

   CREATE ROLE ai_readonly LOGIN PASSWORD '…';
   GRANT CONNECT ON DATABASE app TO ai_readonly;
   GRANT USAGE ON SCHEMA public TO ai_readonly;
   GRANT SELECT ON public.orders, public.customers TO ai_readonly;
   ALTER ROLE ai_readonly SET default_transaction_read_only = on;
   ALTER ROLE ai_readonly SET statement_timeout = '15s';

2. Make read-only queries run in read-only transactions. Use the server's read-only mode (restricted in Postgres MCP Pro, readonly = true in DBHub, access_mode: ro in Microsoft's server, read_only=true in Supabase, readonly=true in Neon). The role setting above is a second layer underneath it.

3. Use a table allowlist where you can. Column grants, row-level security, views or a server-side allowlist keep tables like users.password_hash or payments out of reach, even if the AI writes a query you didn't expect.

4. Point it at a read replica. A replica can't take writes at all, and a slow AI-written query won't compete with production traffic.

5. Expect prompt injection. Text in your data, such as a support ticket that says "ignore previous instructions," can steer the model. Narrow permissions limit what a steered model can do.

For a step-by-step version for Claude, see How to give Claude read-only Postgres access safely.

Frequently asked questions

What is a PostgreSQL MCP server?

A PostgreSQL MCP server is a program that connects an AI client, such as Claude, ChatGPT or Cursor, to a Postgres database through the Model Context Protocol. It gives the AI tools to list tables, describe schemas and run SQL, and it runs those queries as the database role you configure.

Which Postgres MCP server is read-only?

pgEdge and Automata are read-only by default. Postgres MCP Pro (restricted mode), DBHub (readonly = true), Microsoft postgres-mcp (access_mode: ro), Supabase (read_only=true) and Neon (readonly=true) become read-only when you turn the setting on. Whichever you use, also connect with a database role that can only run SELECT.

Is it safe to connect Claude to my production database?

It can be, if you give it a least-privilege role that can only SELECT specific tables, use a server that runs queries in read-only transactions, and ideally point it at a read replica. Don't connect it as a superuser or your application's role, and don't use the archived reference server, whose read-only check can be bypassed.

Can ChatGPT connect to PostgreSQL?

Yes. ChatGPT connects to Postgres through a remote MCP server added as a custom connector in developer mode. The server needs a public HTTPS endpoint, so local stdio servers won't work. Hosted options include Supabase MCP, Neon MCP and Automata; self-hosted servers such as pgEdge work once deployed with authentication.

What is the best Postgres MCP server for performance tuning?

Postgres MCP Pro (crystaldba/postgres-mcp). It recommends indexes from your real workload, simulates hypothetical indexes with hypopg, reviews EXPLAIN plans, and checks index, vacuum, buffer cache and replication health.

Should I still use @modelcontextprotocol/server-postgres?

No. It was archived in May 2025 and npm marks it unmaintained, with no security guarantees. In 2025, Datadog Security Labs showed that a COMMIT inside a query escapes its read-only transaction. Use a maintained server instead.

Next steps

• See how table scoping works: Automata's PostgreSQL MCP server.
• Set up a safe role: the least-privilege PostgreSQL role guide.
• Connect Claude step by step: How to give Claude read-only Postgres access safely.
• Try Automata: sign up for hosted or self-host with Docker.

Sources

All checked on November 13, 2026.

• crystaldba/postgres-mcp: README, and server.py for the default access mode and transports.
• bytebase/dbhub: README, execute_sql read-only mode and command-line options.
• microsoft/postgres-mcp: README and security model.
• pgEdge/pgedge-postgres-mcp: README, authentication and row-level security guides.
• modelcontextprotocol/servers-archived and the npm package: archive status and deprecation notice.
• Datadog Security Labs: the read-only bypass in the reference server.
• googleapis/mcp-toolbox: README and the PostgreSQL prebuilt configuration.
• supabase/mcp and Supabase MCP docs: read-only mode, project scoping and production advice.
• neondatabase/mcp-server-neon: read-only mode, scoping and the production warning.
• ju-li/automata-mcp and Automata permissions docs.

These projects ship often. If something here is out of date or unfair to a project, tell us and we will correct it.