Summary: A read-only PostgreSQL MCP server for safe querying, schema inspection, and migration-safety linting.
Run a single read-only SQL statement (SELECT/WITH/EXPLAIN/SHOW) and get rows back.
Get PostgreSQL query plans for SELECT/WITH statements without executing them.
List tables and views in a schema.
Describe a table's columns: name, data type, nullability, and default.
Check whether the connected role holds any write privileges (expected result: empty).
Statically check migration SQL (from a string or file) for dangerous DDL patterns such as non-concurrent index creation, unsafe ADD COLUMN NOT NULL, and table-rewriting alterations.
Provides read-only PostgreSQL database access, with tools for running read-only queries, explaining query plans, listing tables, describing table columns, and checking write privileges.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@pg-guard-mcp show me the columns of the users table"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A PostgreSQL MCP server that enforces read-only access at the protocol and privilege level — not by parsing the query string and hoping.
pip install pg-guard-mcp
# or, without installing anything permanently:
uvx pg-guard-mcpRelated MCP server: PostgreSQL MCP Server
The official @modelcontextprotocol/server-postgres shipped a read-only mode that a single COMMIT; could bypass: it wrapped the agent's query in BEGIN TRANSACTION READ ONLY and sent the whole thing as one string. Postgres accepts semicolon-separated multiple statements in that mode, so SELECT 1; COMMIT; DROP SCHEMA public CASCADE; closed the read-only transaction early and ran the drop as an ordinary write. The package was deprecated over it. (Datadog Security Labs writeup)
pg-guard-mcp exists because that bug class — "read-only" enforced only by string inspection — is still common across the MCP ecosystem. It defends in three independent layers, so no single mistake is fatal:
Protocol layer (the real boundary). Every query runs through Postgres's extended query protocol (Parse/Bind/Execute), never the simple query protocol. The extended protocol structurally rejects more than one statement per Parse message — Postgres itself refuses it, before any of our code runs. This is why the Datadog exploit cannot work here regardless of what string is submitted.
Session layer. Every connection sets default_transaction_read_only = on at the session level, so even a query that somehow reached the database as a write is rejected by Postgres.
Pre-flight layer. Before a query is even sent, it's checked for multiple statements and transaction-control keywords (COMMIT, ROLLBACK, BEGIN, SAVEPOINT, ...) and rejected with a clear error. This exists to fail fast and loud, not as the primary defense.
On top of that, connecting with a database role that has had write privileges REVOKEd is the recommended (and startup-checked) setup — belt and suspenders at the privilege layer too.
Tool | Does |
| Run one read-only statement, return rows |
| Return the query plan without running it |
| List tables/views in a schema |
| List a table's columns |
| Report any write grant the connected role actually holds — should always come back empty |
| Static-check DDL for lock/downtime/breakage patterns before anyone runs it — never touches the database |
| Same check, reading the SQL from a file on disk |
An agent asked to "add this migration and run it" is exactly the moment a
CREATE INDEX without CONCURRENTLY locks writes on a busy table for the
next ten minutes, or an ADD COLUMN ... NOT NULL with no default fails
outright the instant it hits a populated table. pg_check_migration_safety
and pg_check_migration_file catch these before they run — pure text
analysis, no database connection involved, so they work with no PG_GUARD_DSN
configured at all.
This is the same rule class as Squawk and strong_migrations, which exist as standalone linters but not, as far as a deliberate search turned up, as an MCP tool an agent can call mid-conversation:
Rule | Catches |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
This is regex-based pattern matching over one statement at a time, not a
real SQL parser — see migration_safety.py's module docstring for the
exact scope limitation (a single hand-written statement combining several
actions in one comma-separated ALTER TABLE is checked as a whole, not
action-by-action; every common migration tool generates one action per
statement by default, so this covers the overwhelming majority of
real-world migrations). An empty findings list means no known-unsafe
pattern was found, not a guarantee.
pip install pg-guard-mcp
export PG_GUARD_DSN="host=127.0.0.1 dbname=mydb user=myapp_readonly password=..."
pg-guard-mcpPoint your MCP client at the pg-guard-mcp command (or uvx pg-guard-mcp to skip a permanent install) with PG_GUARD_DSN set in its env config.
See .env.example for all supported environment variables, and scripts/setup_dev_db.sh for a working example of setting up a properly-restricted read-only role (the setup this project's own tests run against).
pip install -e ".[dev]"
pytest tests/ -vtests/test_safety.py is pure-Python and needs no database. tests/test_db.py and tests/test_server.py run against a real local PostgreSQL instance — including the exact exploit payload that deprecated the official Postgres MCP server — and skip automatically if pgguard_test isn't reachable. Run scripts/setup_dev_db.sh once to create it.
v0.2.0. 99 passing tests (unit + live-Postgres integration, including the exact exploit that deprecated the official server-postgres, run against a fresh pip install of the published package) plus 16 DB-dependent tests that skip automatically without a local pgguard_test database.
MIT
Report any write privilege (INSERT/UPDATE/DELETE/TRUNCATE) the connected role actually holds on any table. An empty list is the expected, safe result — anything else means the privilege layer of defense is missing and the role should be locked down (see README.md), even though the protocol and session layers still hold on their own.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the expected safe result ('an empty list'), what a non-empty list means, and extra context that protocol/session layers still hold. It does not mention potential permissions needed to run the check itself, but this is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler: the first states the action and scope, the second frames the expected result and next step. Everything earns its place and the most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a zero-parameter tool with no output schema, the description is functionally complete: it defines the output semantics (list of privileges vs empty), the safety implication, and directs the agent to README.md. It could have mentioned that this is a read-only operation, but the overall context is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema description coverage is effectively complete, so there is no parameter gap. The description adds semantic value by precisely defining what is checked and how to interpret results, which is enough for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Report') and a precise resource ('write privilege the connected role actually holds on any table'), enumerating the exact privilege types (INSERT/UPDATE/DELETE/TRUNCATE). This clearly distinguishes it from sibling tools like pg_run_query or pg_list_tables.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when the tool matters: when a non-empty result means the privilege layer is missing and the role 'should be locked down.' It implies it is the tool to check for dangerous write privileges, but it does not explicitly state when not to use it or compare to alternatives. Overall the intended usage is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List the columns of a table: name, data type, nullability, and default, in column order.
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | public | |
| table_name | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and it is reasonably transparent. It states the returned column attributes and the column-order behavior, clearly implying a read-only schema-introspection operation. It does not discuss error cases or permission requirements, but the core invocation behavior is adequately disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that is front-loaded with the action, resource, and output details. Every clause adds useful information, and there is no repetition or unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple introspection tool with no output schema, the description fully specifies what the agent can expect to see (columns, data types, nullability, defaults, ordered) and what the tool does. The parameter semantics shortfall is already captured in the parameter dimension, so nothing needed for a correct invocation is missing here.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not compensate by explaining the parameters. It neither mentions the optional `schema` parameter (defaulting to `public`) nor clarifies that `table_name` is required and identifies the target table. The parameter names are self-evident, but the description adds almost no semantic value beyond them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool's specific action and resource: 'List the columns of a table: name, data type, nullability, and default, in column order.' It includes enough detail to distinguish it from siblings like pg_list_tables, which lists tables rather than describing columns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit when-to-use or when-not-to-use guidance, nor does it mention alternative siblings such as pg_list_tables for discovering tables or pg_run_query for running arbitrary SQL. Usage context is only implicitly inferred from the tool name and purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Return the PostgreSQL query plan for a read-only SELECT/WITH statement, without running it. Useful for checking whether a query will be slow before running it for real.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the full burden of explaining behavior. It explicitly says the operation is read-only, only accepts SELECT/WITH, and does not run the statement — which conveys the main safety implication. It does not detail the output format of the plan or possible changes to behavior for different statement types, but the critical behavioral facts are present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long and every clause earns its place: the action, the input constraint, the non-execution behavior, and the purpose. No redundant or filler language exists.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description is mostly complete: it tells the agent what to pass, what limits apply, and what the tool will produce. It does not describe the exact structure or format of the returned plan, but 'PostgreSQL query plan' is sufficient for typical invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must add meaning to the sql parameter, and it does: it specifies that the sql must be a read-only SELECT/WITH statement. For a one-parameter tool, this is meaningful semantic guidance. It could go further on formatting or accepted statement variants, but the main constraint is covered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Return the PostgreSQL query plan'), the target resource ('a read-only SELECT/WITH statement'), and the key behavior ('without running it'). This distinguishes it from pg_run_query and makes its purpose immediately obvious.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a concrete use case: 'checking whether a query will be slow before running it for real.' It implicitly contrasts with running the query, and the sibling list includes pg_run_query, so the intended context is clear. It does not explicitly say when not to use it or name the alternative tool, so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List the tables and views visible to the connected role in the given schema (default: public).
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | public |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral disclosure burden. It clearly conveys read-only behavior through 'List' and reveals an important filtering trait: only objects 'visible to the connected role' are returned, which is more informative than merely repeating the tool name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is a single, front-loaded sentence with no wasted words. Each clause earns its place: action, target, visibility filter, and schema argument.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, optional-parameter list tool with no output schema, the description is adequate for a correct call. It is concise but may not fully specify the exact output format; still, no critical contextual gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While schema description coverage is 0%, the description explicitly explains what `schema` means ('given schema') and includes its default value, which aligns with the input schema. For a single optional parameter, this provides sufficient meaning for correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('List') and resource ('tables and views'), with the scoping qualifier ('visible to the connected role') and the optional schema argument. This immediately distinguishes it from sibling tools like pg_describe_table and pg_run_query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys when one would use this tool—when the agent needs to enumerate the tables and views the current role can access in a schema—by 'given schema (default: public)'. However, it does not explicitly compare against alternatives or state when not to use it, so some usage inference is still required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a single read-only SQL statement (SELECT / WITH / EXPLAIN / SHOW) against the configured PostgreSQL database and return the rows.
Rejects anything that isn't exactly one plain read-only statement — multiple statements, transaction-control keywords (COMMIT, ROLLBACK, BEGIN, ...), and any write/DDL/admin keyword anywhere in the query are all refused before the query is sent to the database. Results are capped at PG_GUARD_ROW_LIMIT rows (default 1000).
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the behavioral burden and does it well. It discloses that multiple statements, transaction-control keywords, and write/DDL/admin keywords are blocked before execution, and that results are capped at PG_GUARD_ROW_LIMIT. It lacks detail on error behavior and the exact return shape, but the main safety characteristics are clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded: the first sentence states the purpose and acceptable statement types, the second provides restrictions and the row cap. No unnecessary information or filler is present, and each sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema or annotations, the description should more precisely describe the returned data layout, such as whether rows are returned as arrays with column headers or as objects. It also does not mention error handling when a query is rejected or when the row limit is exceeded. These are meaningful gaps for a tool without an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, so the description must compensate for the 'sql' parameter. It explains what kinds of SQL are accepted and what is rejected, which adds meaningful semantics beyond the bare string type. It could still be more explicit about formatting requirements (e.g., single statement, no trailing semicolons), but the core meaning is well communicated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the operation: run a single read-only SQL statement (SELECT/WITH/EXPLAIN/SHOW) against the configured PostgreSQL database and return the rows. It gives a specific verb and resource, but it does not explicitly differentiate from the sibling tools, especially pg_explain_query, which overlaps on the EXPLAIN capability.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies appropriate usage—single read-only SQL queries—and documents strong restrictions, but it never names alternatives or explains when to use pg_explain_query, pg_list_tables, pg_check_privileges, or pg_describe_table instead. The overlap of EXPLAIN support with pg_explain_query leaves some ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0pg_check_privilegespg_describe_tablepg_explain_querypg_list_tablespg_run_queryScored across 5 tools
Each tool has a clearly distinct role: executing read-only queries, explaining query plans, listing tables, describing table schemas, and checking write privileges. There is no functional overlap or ambiguity between them.
All tool names follow the same pg_ prefix with a consistent verb_noun pattern: run_query, explain_query, list_tables, check_privileges, describe_table. The naming is uniform and predictable.
Five tools is well-scoped for a PostgreSQL guard/observer server. Each tool serves a clear, non-redundant purpose and the set feels complete without being bloated.
The tool surface covers the core read-only workflow: exploring available tables, inspecting schemas, validating query plans, running queries, and verifying the security posture. No obvious dead ends or missing security-relevant operations are apparent.
Safe, read-only Postgres and MySQL access for AI agents. Audit log + column-level controls.
Deterministic safety, correctness & cost gate that vets Postgres SQL before your AI agent runs it.
Query PostgreSQL databases in plain English — LLM-generated, safety-validated SQL.
Generate, fix, explain and run read-only SQL on PostgreSQL, MySQL and SQL Server
