Ein PostgreSQL-MCP-Server, der schreibgeschützten Zugriff auf der Protokoll- und Berechtigungsebene erzwungen — nicht, indem er den Query-String parst und hofft.
pip install pg-guard-mcp
# or, without installing anything permanently:
uvx pg-guard-mcpRelated MCP server: PostgreSQL MCP Server
Das offizielle Paket @modelcontextprotocol/server-postgres wurde mit einem Read-only-Modus ausgeliefert, den ein einzelnes COMMIT; umgehen konnte: Es verpackte die Abfrage des Agenten in BEGIN TRANSACTION READ ONLY und schickte das Ganze als einen String. Postgres akzeptiert in diesem Zustand semikolongetrennte Mehrfachanweisungen, so beendete SELECT 1; COMMIT; DROP SCHEMA public CASCADE; die Read-only-Transaktion frühzeitig und führte das DROP als gewöhnlichen Schreibzugriff aus. Das Paket wurde deshalb als deprecated markiert. (Bericht von Datadog Security Labs)
pg-guard-mcp existiert, weil diese Fehlerklasse – „read-only“, nur durch String-Inspektion erzwungen – im MCP-Ökosystem immer noch verbreitet ist. Es verteidigt auf drei unabhängigen Ebenen, sodass kein einzelner Fehler fatal ist:
Protokollebene (die eigentliche Grenze). Jede Anfrage läuft über das erweiterte Anfrageprotokoll von Postgres (Parse/Bind/Execute), niemals über das einfache Anfrageprotokoll. Das erweiterte Protokoll lehnt strukturell mehr als eine Anweisung pro Parse-Nachricht ab – Postgres selbst weist es ab, bevor irgendein Code von uns ausgeführt wird. Deshalb kann der Datadog-Exploit hier nicht funktionieren, egal welcher String übergeben wird.
Sitzungsebene. Jede Verbindung setzt default_transaction_read_only = on auf Sitzungsebene, sodass auch eine Abfrage, die tatsächlich als Schreibzugriff in der Datenbank ankommt, von Postgres abgelehnt wird.
Preflight-Ebene. Bevor eine Abfrage überhaupt gesendet wird, wird sie auf mehrere Anweisungen und Schlüsselwörter der Transaktionskontrolle (COMMIT, ROLLBACK, BEGIN, SAVEPOINT, ...) geprüft und mit einer klaren Fehlermeldung abgewiesen. Das dient dafür, schnell und laut zu scheitern – nicht als primäre Verteidigung.
Außerdem ist die Verbindung mit einer Datenbankrolle, der Schreibrechte per REVOKE entzogen wurden, die empfohlene (und beim Start überprüfte) Einrichtung – Gürtel und Hosenträger auch auf der Berechtigungsebene.
Werkzeug | Beschreibung |
| Führt eine einzelne schreibgeschützte Anweisung aus und gibt Zeilen zurück |
| Gibt den Abfrageplan zurück, ohne ihn auszuführen |
| Listet Tabellen/Views in einem Schema auf |
| Listet die Spalten einer Tabelle auf |
| Meldet jede Schreibberechtigung, die die verbundene Rolle tatsächlich besitzt – sollte immer leer zurückkommen |
pip install pg-guard-mcp
export PG_GUARD_DSN="host=127.0.0.1 dbname=mydb user=myapp_readonly password=..."
pg-guard-mcpRichten Sie Ihren MCP-Client auf den Befehl pg-guard-mcp aus (oder uvx pg-guard-mcp für den Fall einer dauerhaften Installation) mit gesetztem PG_GUARD_DSN in dessen Umgebungskonfiguration.
Siehe .env.example für alle unterstützten Umgebungsvariablen und scripts/setup_dev_db.sh für ein funktionierendes Beispiel, wie man eine richtig eingeschränkte Read-only-Rolle einrichtet (die Konfiguration, gegen die die eigenen Tests dieses Projekts laufen).
pip install -e ".[dev]"
pytest tests/ -vtests/test_safety.py ist reines Python und benötigt keine Datenbank. tests/test_db.py und tests/test_server.py laufen gegen eine reale lokale PostgreSQL-Instanz – einschließlich des exakten Exploit-Payloads, der für die Deprecation des offiziellen Postgres-MCP-Servers verantwortlich war – und werden automatisch übersprungen, wenn pgguard_test nicht erreichbar ist. Führen Sie scripts/setup_dev_db.sh einmal aus, um die Datenbank zu erstellen.
v0.1.0, live auf PyPI. 58 erfolgreiche Tests (Unit- und Live-Postgres-Integration, einschließlich des exakten Exploits, der zur Deprecation des offiziellen server-postgres führte, ausgeführt gegen eine frische pip install des veröffentlichten Pakets).
MIT
Report any write privilege (INSERT/UPDATE/DELETE/TRUNCATE) the connected role actually holds on any table. An empty list is the expected, safe result — anything else means the privilege layer of defense is missing and the role should be locked down (see README.md), even though the protocol and session layers still hold on their own.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the expected safe result ('an empty list'), what a non-empty list means, and extra context that protocol/session layers still hold. It does not mention potential permissions needed to run the check itself, but this is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler: the first states the action and scope, the second frames the expected result and next step. Everything earns its place and the most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a zero-parameter tool with no output schema, the description is functionally complete: it defines the output semantics (list of privileges vs empty), the safety implication, and directs the agent to README.md. It could have mentioned that this is a read-only operation, but the overall context is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema description coverage is effectively complete, so there is no parameter gap. The description adds semantic value by precisely defining what is checked and how to interpret results, which is enough for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Report') and a precise resource ('write privilege the connected role actually holds on any table'), enumerating the exact privilege types (INSERT/UPDATE/DELETE/TRUNCATE). This clearly distinguishes it from sibling tools like pg_run_query or pg_list_tables.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when the tool matters: when a non-empty result means the privilege layer is missing and the role 'should be locked down.' It implies it is the tool to check for dangerous write privileges, but it does not explicitly state when not to use it or compare to alternatives. Overall the intended usage is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List the columns of a table: name, data type, nullability, and default, in column order.
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | public | |
| table_name | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and it is reasonably transparent. It states the returned column attributes and the column-order behavior, clearly implying a read-only schema-introspection operation. It does not discuss error cases or permission requirements, but the core invocation behavior is adequately disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that is front-loaded with the action, resource, and output details. Every clause adds useful information, and there is no repetition or unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple introspection tool with no output schema, the description fully specifies what the agent can expect to see (columns, data types, nullability, defaults, ordered) and what the tool does. The parameter semantics shortfall is already captured in the parameter dimension, so nothing needed for a correct invocation is missing here.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not compensate by explaining the parameters. It neither mentions the optional `schema` parameter (defaulting to `public`) nor clarifies that `table_name` is required and identifies the target table. The parameter names are self-evident, but the description adds almost no semantic value beyond them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool's specific action and resource: 'List the columns of a table: name, data type, nullability, and default, in column order.' It includes enough detail to distinguish it from siblings like pg_list_tables, which lists tables rather than describing columns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit when-to-use or when-not-to-use guidance, nor does it mention alternative siblings such as pg_list_tables for discovering tables or pg_run_query for running arbitrary SQL. Usage context is only implicitly inferred from the tool name and purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Return the PostgreSQL query plan for a read-only SELECT/WITH statement, without running it. Useful for checking whether a query will be slow before running it for real.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the full burden of explaining behavior. It explicitly says the operation is read-only, only accepts SELECT/WITH, and does not run the statement — which conveys the main safety implication. It does not detail the output format of the plan or possible changes to behavior for different statement types, but the critical behavioral facts are present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long and every clause earns its place: the action, the input constraint, the non-execution behavior, and the purpose. No redundant or filler language exists.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description is mostly complete: it tells the agent what to pass, what limits apply, and what the tool will produce. It does not describe the exact structure or format of the returned plan, but 'PostgreSQL query plan' is sufficient for typical invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must add meaning to the sql parameter, and it does: it specifies that the sql must be a read-only SELECT/WITH statement. For a one-parameter tool, this is meaningful semantic guidance. It could go further on formatting or accepted statement variants, but the main constraint is covered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Return the PostgreSQL query plan'), the target resource ('a read-only SELECT/WITH statement'), and the key behavior ('without running it'). This distinguishes it from pg_run_query and makes its purpose immediately obvious.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a concrete use case: 'checking whether a query will be slow before running it for real.' It implicitly contrasts with running the query, and the sibling list includes pg_run_query, so the intended context is clear. It does not explicitly say when not to use it or name the alternative tool, so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List the tables and views visible to the connected role in the given schema (default: public).
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | public |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral disclosure burden. It clearly conveys read-only behavior through 'List' and reveals an important filtering trait: only objects 'visible to the connected role' are returned, which is more informative than merely repeating the tool name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is a single, front-loaded sentence with no wasted words. Each clause earns its place: action, target, visibility filter, and schema argument.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, optional-parameter list tool with no output schema, the description is adequate for a correct call. It is concise but may not fully specify the exact output format; still, no critical contextual gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While schema description coverage is 0%, the description explicitly explains what `schema` means ('given schema') and includes its default value, which aligns with the input schema. For a single optional parameter, this provides sufficient meaning for correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('List') and resource ('tables and views'), with the scoping qualifier ('visible to the connected role') and the optional schema argument. This immediately distinguishes it from sibling tools like pg_describe_table and pg_run_query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys when one would use this tool—when the agent needs to enumerate the tables and views the current role can access in a schema—by 'given schema (default: public)'. However, it does not explicitly compare against alternatives or state when not to use it, so some usage inference is still required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a single read-only SQL statement (SELECT / WITH / EXPLAIN / SHOW) against the configured PostgreSQL database and return the rows.
Rejects anything that isn't exactly one plain read-only statement — multiple statements, transaction-control keywords (COMMIT, ROLLBACK, BEGIN, ...), and any write/DDL/admin keyword anywhere in the query are all refused before the query is sent to the database. Results are capped at PG_GUARD_ROW_LIMIT rows (default 1000).
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the behavioral burden and does it well. It discloses that multiple statements, transaction-control keywords, and write/DDL/admin keywords are blocked before execution, and that results are capped at PG_GUARD_ROW_LIMIT. It lacks detail on error behavior and the exact return shape, but the main safety characteristics are clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded: the first sentence states the purpose and acceptable statement types, the second provides restrictions and the row cap. No unnecessary information or filler is present, and each sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema or annotations, the description should more precisely describe the returned data layout, such as whether rows are returned as arrays with column headers or as objects. It also does not mention error handling when a query is rejected or when the row limit is exceeded. These are meaningful gaps for a tool without an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, so the description must compensate for the 'sql' parameter. It explains what kinds of SQL are accepted and what is rejected, which adds meaningful semantics beyond the bare string type. It could still be more explicit about formatting requirements (e.g., single statement, no trailing semicolons), but the core meaning is well communicated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the operation: run a single read-only SQL statement (SELECT/WITH/EXPLAIN/SHOW) against the configured PostgreSQL database and return the rows. It gives a specific verb and resource, but it does not explicitly differentiate from the sibling tools, especially pg_explain_query, which overlaps on the EXPLAIN capability.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies appropriate usage—single read-only SQL queries—and documents strong restrictions, but it never names alternatives or explains when to use pg_explain_query, pg_list_tables, pg_check_privileges, or pg_describe_table instead. The overlap of EXPLAIN support with pg_explain_query leaves some ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0pg_check_privilegespg_describe_tablepg_explain_querypg_list_tablespg_run_queryScored across 5 tools
Each tool has a clearly distinct role: executing read-only queries, explaining query plans, listing tables, describing table schemas, and checking write privileges. There is no functional overlap or ambiguity between them.
All tool names follow the same pg_ prefix with a consistent verb_noun pattern: run_query, explain_query, list_tables, check_privileges, describe_table. The naming is uniform and predictable.
Five tools is well-scoped for a PostgreSQL guard/observer server. Each tool serves a clear, non-redundant purpose and the set feels complete without being bloated.
The tool surface covers the core read-only workflow: exploring available tables, inspecting schemas, validating query plans, running queries, and verifying the security posture. No obvious dead ends or missing security-relevant operations are apparent.
Safe, read-only Postgres and MySQL access for AI agents. Audit log + column-level controls.
Deterministic safety, correctness & cost gate that vets Postgres SQL before your AI agent runs it.
Query PostgreSQL databases in plain English — LLM-generated, safety-validated SQL.
Query 40 databases from Claude, ChatGPT, or Cursor — on any device. Read-only, encrypted, audited.
