BoltSchema
Server Details
Query your Postgres from ChatGPT or Claude without exposing the database or handing over credentials. Run npx boltschema connect next to your database and it dials out over HTTPS — no inbound firewall rule, no open port, works with localhost and VPC-private databases. Read-only is enforced by a SQL guard, a Postgres READ ONLY transaction, and a scoped role generated for you.
- Status
- Healthy
- Uptime
- 50.6% over 42 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
TDQS
Scored across 2 tools
The two tools have clearly distinct purposes: one executes read-only SQL queries, the other retrieves database schema metadata. An agent can easily choose between them without overlap or confusion.
Both names follow a consistent snake_case, verb-first convention (execute_..., get_...). The slight adjective insertion in execute_read_only_query is still readable and predictable.
With only two tools, the surface feels thin for a database interaction server. While each tool is distinct and useful, the set lacks common auxiliary operations that would make it feel properly scoped.
Core read-only access is covered: schema retrieval and arbitrary SELECT queries. However, richer metadata (indexes, constraints, views, foreign keys) and query-plan inspection are absent, though agents could partly work around this via system catalogs.
Available Tools
2 toolsexecute_read_only_queryExecute read-only SQL queryAInspect
Runs a SELECT-style query against the connected Postgres database inside a READ ONLY transaction. Any query containing mutation keywords (DROP, DELETE, ALTER, INSERT, UPDATE, etc.) is rejected before execution.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | A single SQL statement to execute. | |
| limit | No | Maximum rows to return. Defaults to 100, hard cap 1000. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does meaningfully disclose two behavioral traits: queries execute inside a READ ONLY transaction, and statements containing mutation keywords are rejected before execution. It omits error surface (how a rejection is reported), timeouts, or result-shape behavior, so it is strong but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler, with the core guarantee (read-only execution) front-loaded ahead of the enforcement detail. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter query tool with fully documented params and no annotations, the description covers the essential safety contract an agent needs before calling it. The gaps are return-value shape and error reporting, which have no output schema to cover them, but neither blocks correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already documents both the sql statement and the limit (default 100, hard cap 1000). The description adds no syntax, multi-statement, or row-limit detail beyond that, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (runs), a resource (a SELECT-style query), and the execution target (connected Postgres database), so the agent knows exactly what the tool does. It does not mention the sibling get_database_schema, so it stops short of explicit differentiation at the 5 level.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the constraint that only SELECT-style reads are permitted, which tells the agent when this tool is appropriate versus a write path. However, it never says when to use get_database_schema first to discover tables, nor does it name any alternative for mutation needs, so the guidance stays implicit rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_database_schemaGet database schemaAInspect
Lists tables and their columns (name, SQL type, nullability) for all non-system schemas in the connected Postgres database.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses the return content and the scope boundary (excludes system schemas), but says nothing about permissions, latency/cost on large databases, or read-only guarantees, which are relevant for a catalog scan.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the verb and resource, with the scope qualifier ('non-system schemas') and returned fields attached efficiently. Nothing is wasted or padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read tool with no output schema, the description adequately covers what comes back and the schema scope. It is slightly thin on connection/error assumptions and on how the result should be interpreted before composing queries.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no parameter semantics to document; baseline 4 applies. The description appropriately spends its words on what is returned instead.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb ('Lists') and resource ('tables and their columns') and even enumerates the returned fields (name, SQL type, nullability). It does not name or contrast with the sibling execute_read_only_query, so it stops short of the 5 tier.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the tool exists for schema discovery prior to running queries against sibling execute_read_only_query, but the description never states when to prefer this over executing a query (e.g. postgres system catalogs could be queried directly). No exclusions or alternatives are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
- First observed
execute_read_only_query - First observed
get_database_schema
Related MCP Connectors
Query 40 databases from Claude, ChatGPT, or Cursor — on any device. Read-only, encrypted, audited.
Safe, read-only Postgres and MySQL access for AI agents. Audit log + column-level controls.
Query PostgreSQL databases in plain English — LLM-generated, safety-validated SQL.
Deterministic safety, correctness & cost gate that vets Postgres SQL before your AI agent runs it.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceConnects AI assistants to PostgreSQL databases with production-grade safety features including query validation, guarded writes, rate limiting, and audit logging.3MIT
- AlicenseNot gradedqualityCmaintenanceSecurely connect AI assistants to PostgreSQL databases with read-only access, schema discovery, querying, and performance analysis tools.6 npmMIT
- FlicenseAqualityBmaintenanceLets AI assistants like Cursor and Claude safely explore your database and answer questions about your data in plain English.41-
- AlicenseAqualityBmaintenanceEnables AI agents to query PostgreSQL databases securely with read-only defaults, PII masking, rate limiting, and human-approved, expiring mutation tokens.91Apache 2.0
Glama MCP Gateway
Add one secure layer between your agents and this server.