How to Connect ChatGPT to PostgreSQL (Safely, With Read-Only Access)

Last updated: November 2026

ChatGPT connects to PostgreSQL through a custom MCP connector: a remote MCP server that sits between ChatGPT and your database, added under Plugins in ChatGPT on the web. At the time of writing, OpenAI offers custom MCP servers on paid plans, with full read-and-write support on Business, Enterprise and Edu and read-only tools on Pro, and not on the Free plan. The safe way to connect ChatGPT to PostgreSQL is to give it a read-only database role, ideally on a replica, and a connector that limits it to specific tables.

This guide does that with Automata, a free, MIT-licensed, open-source PostgreSQL MCP server that runs hosted or self-hosted. The role and the safety advice apply to any server you choose.

What you need

• A ChatGPT plan that supports custom MCP servers, used on the web. OpenAI's help article "Connecting custom MCP servers in ChatGPT" is the source of truth, and its plan list has changed several times in 2026. If you can see Add custom MCP server under Plugins, your plan supports it. On Business, Enterprise and Edu, an admin may need to allow it first.
• A PostgreSQL database that Automata can reach over the network: self-managed, RDS, Cloud SQL, Supabase, Neon or similar. A read replica is better than your primary.
• A connection string for a least-privilege role, which you create in step 1.
• About 20 minutes.

How to connect ChatGPT to PostgreSQL

ChatGPT never talks to Postgres directly. It calls tools on the MCP server, and the server runs SQL as the role you give it:

Each layer can say no. The role decides what is possible at all. Automata decides which tables this particular token may touch, and refuses anything else before a row is read. Setting it up takes four steps.

Step 1: Create a read-only Postgres role

Create a dedicated role for ChatGPT. Never connect as a superuser or the database owner: a superuser bypasses permission checks and row-level security, which makes every other safeguard decorative.

-- A dedicated login with no special powers
CREATE ROLE chatgpt_reader LOGIN PASSWORD '<strong-password>'
  NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS
  CONNECTION LIMIT 5;

-- Reach the database and one schema
GRANT CONNECT ON DATABASE app TO chatgpt_reader;
GRANT USAGE ON SCHEMA public TO chatgpt_reader;

-- Grant specific tables, not the whole schema
GRANT SELECT ON public.customers, public.orders, public.order_items TO chatgpt_reader;

-- Read-only by default, with a time limit on every query
ALTER ROLE chatgpt_reader SET default_transaction_read_only = on;
ALTER ROLE chatgpt_reader SET statement_timeout = '15s';

About ALTER DEFAULT PRIVILEGES: it grants access to tables created in the future. That is the opposite of least privilege for a schema like public, where next month's payments table would become visible without anyone deciding it should. Use it only for a schema you created specifically to share, such as a reporting schema of views:

GRANT USAGE ON SCHEMA reporting TO chatgpt_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA reporting TO chatgpt_reader;

-- Future tables and views that app_owner creates in reporting are readable too
ALTER DEFAULT PRIVILEGES FOR ROLE app_owner IN SCHEMA reporting
  GRANT SELECT ON TABLES TO chatgpt_reader;

For sensitive columns, grant columns instead of tables, for example GRANT SELECT (id, plan, country, created_at) ON public.customers TO chatgpt_reader;. A query that asks for a column the role lacks then fails inside Postgres itself.

For production, connect to a read replica. default_transaction_read_only is a default that a session can change. A hot standby rejects writes at the server level whatever the session says, and it keeps heavy analytical queries off your primary.

The least-privilege role docs cover column grants, row-level security and verifying the role.

Step 2: Add the database to Automata and create a scoped token

Hosted: sign up at mcp.getautomata.app. The free plan covers one connection and one connector token; Pro is $19/month. Self-hosted: deploy Automata with the getting started guide. ChatGPT connects from OpenAI's servers, so a self-hosted instance needs a public HTTPS URL, or OpenAI's Secure MCP Tunnel for a private one.

1. Create a PostgreSQL database connection and paste the role's connection string, preferably the replica's host:

   postgresql://chatgpt_reader:<password>@replica.example.com:5432/app?sslmode=require

   Automata tests the connection before saving. Percent-encode @ or # in the password (%40, %23). On Supabase, use the Session pooler string from Connect, not the IPv6-only db.<ref>.supabase.co host.

2. Create a connector token for ChatGPT (New connector token):

   • Name: something you will recognise when revoking it, such as chatgpt.
   • Expires: 30 or 90 days is a sensible default.
   • Actions: leave the defaults. PostgreSQL tokens start read-only, with get-database-info, list-tables, describe-table and run-query. Do not add run-statement.
   • Tables: choose Only selected tables and pick only what ChatGPT needs. Names are case-sensitive.

3. Click Create token and copy it. Automata shows the token once.

ChatGPT cannot attach an Authorization header to a custom MCP server, so use Automata's path-token URL, where the token is part of the address:

https://mcp.getautomata.app/mcp/<connector-token>

Step 3: Add the connector in ChatGPT

These steps follow OpenAI's documentation at the time of writing. ChatGPT's menus have moved several times in 2026, so the labels may differ slightly in your account.

1. Open ChatGPT on the web and go to Plugins.
2. Select the plus button, then Add custom MCP server.
3. Enter a name, such as Automata Postgres, and a description, such as "Read-only access to our sales tables."
4. Under Connection, enter the path-token URL from step 2 as the server URL.
5. Set authentication to No authentication. Automata checks the token in the URL on every request.
6. Review the risk warning, select I understand and want to continue, then Create as a plugin.
7. Check the tools ChatGPT discovered. A read-only token shows four: get-database-info, list-tables, describe-table and run-query. If you see run-statement, the token can write; go back to step 2.
8. Install the plugin.

If Add custom MCP server is missing, some accounts have shown a Developer mode toggle under Settings → Security and login; turn it on and look again. In a Business, Enterprise or Edu workspace, ask an admin to allow custom MCP servers.

Automata marks its four read tools with MCP's readOnlyHint annotation. ChatGPT treats any tool without it as a write action and asks for confirmation before calling it.

Step 4: Test it

Start a new chat, type @ in the prompt box and select the plugin. Then try:

• "List the tables you can see."
• "Show me the schema of the orders table."
• "What were our top 10 customers by revenue last quarter?"

For the revenue question, ChatGPT should describe customers and orders, then run one SELECT with a join, a date filter and LIMIT 10. Expand the tool call to read the SQL. It is the quickest way to catch a wrong join or date column before you trust the number.

Now try a table you did not share:

Show me the last 20 rows of the payments table.

Automata refuses it before any row is read, and ChatGPT relays the refusal:

This connector token is not scoped to public.payments. The tables it may reach are:
public.customers, public.orders, public.order_items. Ask the account owner to add
public.payments to the token's allowed tables, or rewrite the query to use only the
tables above.

The check reads the query plan, not the SQL text, so a view or CTE that reaches payments is refused too. Asking ChatGPT to update or delete rows also fails: the token has no write tool, run-query runs in a read-only transaction, and the role has no write privileges.

Safety checklist

• Least-privilege role. A dedicated role with SELECT on named tables or columns, never a superuser or owner.
• Read-only by default. Keep run-statement off. If you ever need writes, use a separate role, a separate token and a low row cap. Writes over the cap roll back in full.
• Table allowlist. Scope the token to the tables ChatGPT needs. Everything else is invisible to list-tables and refused by run-query.
• Replica. Point production access at a read replica so writes are impossible at the server level and slow queries don't hit your primary.
• Rotate and revoke tokens. One token per client, with an expiry. Revoke it in Automata the moment the URL appears in a log, screenshot or shared chat; your database credentials don't change.
• Prompt injection from your own data. Text stored in your tables, such as support tickets, reviews or notes fields, can contain instructions aimed at the AI. Reading a row is enough to put them in front of the model. Keep database conversations free of plugins that can send or post data outward, and read what ChatGPT plans to do before approving any action.
• Data leaves your infrastructure. Read-only stops changes, not disclosure. Every row ChatGPT reads is sent to OpenAI as part of the conversation. Exclude or mask personal and regulated data with column grants or views.

Other ways to connect ChatGPT to Postgres

Automata has limits too: no index tuning, PostgreSQL only among databases, and it refuses queries that call user-defined functions, because the plan check can't see inside them. The PostgreSQL MCP servers comparison covers each option in more depth.

Troubleshooting

More fixes are in the troubleshooting guide.

Frequently asked questions

Can ChatGPT connect to a PostgreSQL database?

Yes. You connect ChatGPT to PostgreSQL through a custom MCP connector: a remote MCP server that ChatGPT calls over HTTPS and that runs SQL against your database. You add it under Plugins in ChatGPT on the web. ChatGPT cannot open a database connection by itself.

Is it safe to give ChatGPT database access?

It is reasonably safe when the limits are enforced outside the model: a read-only role with access to specific tables, a read replica, and a connector that checks every query against a table allowlist. It is not safe to hand ChatGPT an owner or superuser connection string and ask it to behave. Remember that any row ChatGPT reads is sent to OpenAI.

Can ChatGPT write to my database?

Only if you allow it. With Automata, a PostgreSQL token starts read-only and writes need the run-statement tool granted explicitly, with a row cap that rolls back oversized changes. ChatGPT also asks for confirmation before calling any tool that isn't marked read-only. For most uses, keep writes off.

Do I need ChatGPT Plus or Pro?

You need a paid plan. At the time of writing, OpenAI's help center lists custom MCP servers for Pro (read-only tools) and for Business, Enterprise and Edu (reads and writes, as a beta), while OpenAI's developer docs have also listed Plus. Check "Connecting custom MCP servers in ChatGPT" for your plan. The Free plan doesn't support custom MCP servers.

Does this work with Supabase, Neon or RDS?

Yes. Any PostgreSQL database Automata can reach over the network works, including Supabase, Neon, Amazon RDS, Aurora and Cloud SQL. Create the read-only role with the SQL above, use the provider's read replica where available, and connect with sslmode=require. On Supabase, use the Session pooler connection string.

Is connecting ChatGPT to PostgreSQL free?

The software can be. Automata is MIT-licensed and free to self-host, and its hosted service has a free plan for one connection; Pro is $19/month. You still need a ChatGPT plan that supports custom MCP servers.

Next steps

• Set up other AI clients with the MCP clients guide.
• Go deeper on the threat model in the Claude Postgres guide; the role and the risks are the same for ChatGPT.
• Look up each tool's limits in the MCP tools reference.