Railway
One-click deploy
Skip local setup entirely. Provision the full stack, including Postgres, Redis, and volumes, on Railway in a few minutes.
- No local Docker required
- Managed Postgres, Redis, and volumes
- Add or remove connectors anytime
PostgreSQL MCP server with per-table permissions
Let Claude, ChatGPT, and Cursor answer analytics questions straight from your database, using only the tables you choose. Everything else stays out of reach.
100% Free· Open source · Self-host or hosted
Example of the Claude chat app using the Automata PostgreSQL MCP server. The user asks Claude how monthly recurring revenue changed by plan over the last six months. Claude checks the database, lists the three tables in scope, is refused when it tries to query user_profiles because that table is outside the token's scope, then queries subscriptions and reports that Team revenue grew 76 percent while Starter has slipped since July.
The basics
What is a PostgreSQL MCP server?
A PostgreSQL MCP server connects your database to AI assistants through the Model Context Protocol. It gives tools like Claude and ChatGPT a small set of actions, such as listing tables, reading a schema, and running queries, so they can answer analytics questions from live data instead of you exporting CSVs and pasting results.
Automata is a free, open-source PostgreSQL MCP that adds the missing piece: a table allowlist and a query plan check before every tool call, so the AI only touches the tables you approve.
Why scope matters
Most PostgreSQL MCPs hand over the whole database.
Popular open-source servers run whatever SQL the model writes against every table the role can see. Automata enforces access table by table and checks each plan first.
| Capability | Typical PostgreSQL MCP | Automata |
|---|---|---|
| What the AI can read | Every table the database user can reach | Only the tables on the token allowlist |
| Writing data | Raw SQL, or a single read-only switch | A separate run-statement tool, off by default and capped by row count |
| Query checks | The statement is passed straight to the database | Every statement is checked against its EXPLAIN plan before it runs |
| Revoking access | Change the database password for every client | Revoke one token; other clients keep working |
| Remote clients (Claude.ai, ChatGPT) | Usually local stdio, with the connection string on your laptop | Streamable HTTP endpoint with bearer tokens; credentials stay on the server |
Token scope
PostgreSQL tables
analytics_ro@prod · table allowlist
- Read
public.subscriptions
Billing · 48k rows
- Read
public.invoices
Billing · 212k rows
- Read
public.events
Product analytics · 9.4M rows
- Blocked
public.user_profiles
Contains personal data
- Blocked
private.payroll
Finance
Enabled tools
- list-tables
- describe-table
- run-query
- run-statement
Out-of-scope query refused
public.user_profiles · table_outside_token_scope
Run it your way
Free, open source, and yours to inspect.
The control layer protecting your messages and data should not be a black box. Read the code, verify the checks, and deploy Automata wherever your security model requires.
Self-hosted
Free, forever
Run the Nuxt control plane and Postgres on your machine, VPS, or homelab. Add the WhatsApp or Telegram services only when you need those connectors.
- MIT licensed source
- Unlimited scoped connections
- Credentials stay on your infrastructure
Hosted
Invite only, for now
Use the same connector and permission model without operating the services yourself. Tell us which messengers and databases you need.
- Managed setup and updates
- The same granular scopes
- Direct access to the Automata team
Reference
PostgreSQL MCP tools
Five tools, each limited to the tables on the token. Disabled tools are never registered, so the AI cannot even try them.
get-database-inforeadReturns the server version, database name, connecting role, and the token table scope.
list-tablesreadLists only the tables in scope, with schema and name filters.
describe-tablereadReturns columns, keys, constraints, indexes, and comments for one in-scope table.
run-queryreadRuns one SELECT, WITH, VALUES, or TABLE statement in a read-only transaction, with paged results and a timeout.
run-statementwriteRuns one INSERT, UPDATE, DELETE, or MERGE. Disabled by default; oversized changes roll back in full.
Full parameters are in the MCP tools reference.
Setup
Connect PostgreSQL to Claude in three steps
- 1
Create a least-privilege role
Add a database role that can only SELECT from the schemas and tables you want the AI to analyze. The role is the real security boundary.
- 2
Add the connection and choose tables
Deploy Automata on Railway or your own server, paste the connection string, then create a connector token with a table allowlist. Write access stays off unless you add it.
- 3
Add the MCP URL to your client
Paste the endpoint into Claude, ChatGPT, Cursor, or any MCP client. Start with get-database-info to confirm it works.
Claude Code
claude mcp add --transport http automata \
https://your-automata.example.com/mcp/<connector-token>In Claude.ai or Claude Desktop, open Settings → Connectors → Add custom connector and paste the same URL. Clients that prefer headers can use /mcp with Authorization: Bearer. See all clients.
Use cases
What you can ask once PostgreSQL is connected
- “Break down monthly recurring revenue by plan for the last six months.”
- “Which signup cohorts have the lowest week-4 retention?”
- “Compare this week’s signups with the average week this quarter.”
- “What share of orders were refunded in each region last month?”
FAQ
PostgreSQL MCP questions
What is a PostgreSQL MCP server?
A PostgreSQL MCP server exposes a database to AI assistants through the Model Context Protocol, so tools like Claude or ChatGPT can inspect the schema and run queries instead of you exporting CSVs and pasting results.
Is the Automata PostgreSQL MCP free?
Yes. Automata is MIT licensed and free to self-host, including a one-click Railway template. A hosted version is available by invitation.
Can the AI change my data?
Only if you allow it. New PostgreSQL tokens start with read tools enabled and run-statement disabled. When you do enable it, it accepts only INSERT, UPDATE, DELETE, or MERGE, rolls back changes over the row limit, and refuses whole-table updates or deletes unless explicitly allowed.
How does Automata keep queries safe?
Each statement is limited to one statement and checked with EXPLAIN before it executes. DDL, TRUNCATE, COPY, and unsafe functions are refused, and every table in the plan must be on the token allowlist.
Is the token scope enough on its own?
No. Plan checks cannot see everything triggers or user-defined functions might do, so connect with a least-privilege role rather than a superuser or owner. The role is the boundary; the token scope guards against model mistakes.
How large can query results be?
Results come back in pages of up to 1,000 rows, with long cell values clipped. Read queries time out after 10 seconds by default and can be raised to 30.
Which AI clients work with it?
Any client that supports remote MCP servers over HTTP, including Claude (web, desktop, and Claude Code), ChatGPT connectors, Cursor, and custom agents.
Should I self-host or use the hosted version?
Self-host if your database should only ever be reached from infrastructure you control. Choose hosted if you want the same table-level permissions without operating the services yourself.