PostgreSQL 用 MCP サーバーです。読み取り専用アクセスをプロトコルと権限のレベルで強制します。クエリ文字列を解析して祈るだけの方式ではありません。
pip install pg-guard-mcp
# or, without installing anything permanently:
uvx pg-guard-mcpRelated MCP server: PostgreSQL MCP Server
公式の @modelcontextprotocol/server-postgres が実装していた読み取り専用モードは、COMMIT; の 1 文で回避できました。その実装は、エージェントのクエリを BEGIN TRANSACTION READ ONLY でラップし、全体を 1 つの文字列として送信していました。Postgres はこのモードでセミコロン区切りの複数文を受け付けるため、SELECT 1; COMMIT; DROP SCHEMA public CASCADE; は読み取り専用トランザクションを早期に閉じ、その DROP を通常の書き込みとして実行できてしまいました。この問題により、このパッケージは非推奨になりました。(Datadog Security Labs のレポート)
pg-guard が存在するのは、この「文字列検査だけで『読み取り専用』を強制する」というバグの分類が、今も MCP エコシステムで広く見られるからです。これは 3 つの独立した層で防御するため、どれか 1 つのミスが致命的になることはありません。
プロトコル層（実際の境界）. すべてのクエリは、Postgres の拡張クエリプロトコル（Parse / Bind / Execute）でのみ実行され、単純クエリプロトコルは使われません。拡張プロトコルは構造上、1 つの Parse メッセージに複数の文を拒否します。Postgres 自身が、私たちのコードが実行される前にそのクエリを否定するのです。どんな文字列を送っても、Datadog のエクスプロイトがここで機能しないのはこのためです。
セッション層. すべての接続は、セッションレベルで default_transaction_read_only = on を設定します。万一書き込みとしてデータベースに到達したクエリがあっても、Postgres が拒否します。
送信前チェック層. クエリを送信する前に、複数文とトランザクション制御キーワード（COMMIT、ROLLBACK、BEGIN、SAVEPOINT、...）をチェックし、明確なエラーで拒否します。これは主防御ではなく、迅速かつ明確に失敗させるためのものです。
さらに、書き込み権限が REVOKE されているデータベースロールで接続することが推奨されます（起動時にも確認されます）。権限層でも二重の安全策を取っていることになります。
Tool | 機能 |
| 読み取り専用の文を 1 つだけ実行し、結果行を返します |
| クエリを実行せずに実行プランを返します |
| スキーマ内のテーブル/ビューを一覧表示します |
| テーブルの列を一覧表示します |
| 接続中のロールが現在保持している書き込み権限を報告します。通常は空になるはずです |
pip install pg-guard-mcp
export PG_GUARD_DSN="host=127.0.0.1 dbname=mydb user=myapp_readonly password=..."
pg-guard-mcpMCP クライアントが、PG_GUARD_DSN を環境設定に設定した上で pg-guard-mcp コマンド（恒久的なインストールを避けるなら uvx pg-guard-mcp）を指すようにしてください。
サポートされている環境変数は .env.example に、適切に制限された読み取り専用ロールのセットアップ例（このプロジェクト自身のテストが前提にしている設定）は scripts/setup_dev_db.sh にあります。
pip install -e ".[dev]"
pytest tests/ -vtests/test_safety.py は純 Python で、データベースは不要です。tests/test_db.py と tests/test_server.py は実際のローカル PostgreSQL インスタンスに対して実行されます。これには、公式の Postgres MCP サーバーが非推奨になった原因となったものと同一のエクスプロイトペイロードも含まれており、pgguard_test に接続できない場合は自動的にスキップされます。一度 scripts/setup_dev_db.sh を実行すれば、そのデータベースが作成されます。
v0.1.0、PyPI で公開中。58 件のテストが成功しています（単体テスト＋実 PostgreSQL を使った統合テスト。公式の server-postgres を非推奨にした完全なエクスプロイトも、公開版パッケージを pip installat 설치한 fresh 环境で実行）。
MIT
Report any write privilege (INSERT/UPDATE/DELETE/TRUNCATE) the connected role actually holds on any table. An empty list is the expected, safe result — anything else means the privilege layer of defense is missing and the role should be locked down (see README.md), even though the protocol and session layers still hold on their own.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the expected safe result ('an empty list'), what a non-empty list means, and extra context that protocol/session layers still hold. It does not mention potential permissions needed to run the check itself, but this is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler: the first states the action and scope, the second frames the expected result and next step. Everything earns its place and the most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a zero-parameter tool with no output schema, the description is functionally complete: it defines the output semantics (list of privileges vs empty), the safety implication, and directs the agent to README.md. It could have mentioned that this is a read-only operation, but the overall context is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema description coverage is effectively complete, so there is no parameter gap. The description adds semantic value by precisely defining what is checked and how to interpret results, which is enough for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Report') and a precise resource ('write privilege the connected role actually holds on any table'), enumerating the exact privilege types (INSERT/UPDATE/DELETE/TRUNCATE). This clearly distinguishes it from sibling tools like pg_run_query or pg_list_tables.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when the tool matters: when a non-empty result means the privilege layer is missing and the role 'should be locked down.' It implies it is the tool to check for dangerous write privileges, but it does not explicitly state when not to use it or compare to alternatives. Overall the intended usage is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List the columns of a table: name, data type, nullability, and default, in column order.
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | public | |
| table_name | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and it is reasonably transparent. It states the returned column attributes and the column-order behavior, clearly implying a read-only schema-introspection operation. It does not discuss error cases or permission requirements, but the core invocation behavior is adequately disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that is front-loaded with the action, resource, and output details. Every clause adds useful information, and there is no repetition or unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple introspection tool with no output schema, the description fully specifies what the agent can expect to see (columns, data types, nullability, defaults, ordered) and what the tool does. The parameter semantics shortfall is already captured in the parameter dimension, so nothing needed for a correct invocation is missing here.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not compensate by explaining the parameters. It neither mentions the optional `schema` parameter (defaulting to `public`) nor clarifies that `table_name` is required and identifies the target table. The parameter names are self-evident, but the description adds almost no semantic value beyond them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool's specific action and resource: 'List the columns of a table: name, data type, nullability, and default, in column order.' It includes enough detail to distinguish it from siblings like pg_list_tables, which lists tables rather than describing columns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit when-to-use or when-not-to-use guidance, nor does it mention alternative siblings such as pg_list_tables for discovering tables or pg_run_query for running arbitrary SQL. Usage context is only implicitly inferred from the tool name and purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Return the PostgreSQL query plan for a read-only SELECT/WITH statement, without running it. Useful for checking whether a query will be slow before running it for real.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the full burden of explaining behavior. It explicitly says the operation is read-only, only accepts SELECT/WITH, and does not run the statement — which conveys the main safety implication. It does not detail the output format of the plan or possible changes to behavior for different statement types, but the critical behavioral facts are present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long and every clause earns its place: the action, the input constraint, the non-execution behavior, and the purpose. No redundant or filler language exists.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description is mostly complete: it tells the agent what to pass, what limits apply, and what the tool will produce. It does not describe the exact structure or format of the returned plan, but 'PostgreSQL query plan' is sufficient for typical invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must add meaning to the sql parameter, and it does: it specifies that the sql must be a read-only SELECT/WITH statement. For a one-parameter tool, this is meaningful semantic guidance. It could go further on formatting or accepted statement variants, but the main constraint is covered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Return the PostgreSQL query plan'), the target resource ('a read-only SELECT/WITH statement'), and the key behavior ('without running it'). This distinguishes it from pg_run_query and makes its purpose immediately obvious.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a concrete use case: 'checking whether a query will be slow before running it for real.' It implicitly contrasts with running the query, and the sibling list includes pg_run_query, so the intended context is clear. It does not explicitly say when not to use it or name the alternative tool, so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List the tables and views visible to the connected role in the given schema (default: public).
| Name | Required | Description | Default |
|---|---|---|---|
| schema | No | public |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral disclosure burden. It clearly conveys read-only behavior through 'List' and reveals an important filtering trait: only objects 'visible to the connected role' are returned, which is more informative than merely repeating the tool name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is a single, front-loaded sentence with no wasted words. Each clause earns its place: action, target, visibility filter, and schema argument.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, optional-parameter list tool with no output schema, the description is adequate for a correct call. It is concise but may not fully specify the exact output format; still, no critical contextual gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While schema description coverage is 0%, the description explicitly explains what `schema` means ('given schema') and includes its default value, which aligns with the input schema. For a single optional parameter, this provides sufficient meaning for correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('List') and resource ('tables and views'), with the scoping qualifier ('visible to the connected role') and the optional schema argument. This immediately distinguishes it from sibling tools like pg_describe_table and pg_run_query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys when one would use this tool—when the agent needs to enumerate the tables and views the current role can access in a schema—by 'given schema (default: public)'. However, it does not explicitly compare against alternatives or state when not to use it, so some usage inference is still required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a single read-only SQL statement (SELECT / WITH / EXPLAIN / SHOW) against the configured PostgreSQL database and return the rows.
Rejects anything that isn't exactly one plain read-only statement — multiple statements, transaction-control keywords (COMMIT, ROLLBACK, BEGIN, ...), and any write/DDL/admin keyword anywhere in the query are all refused before the query is sent to the database. Results are capped at PG_GUARD_ROW_LIMIT rows (default 1000).
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the behavioral burden and does it well. It discloses that multiple statements, transaction-control keywords, and write/DDL/admin keywords are blocked before execution, and that results are capped at PG_GUARD_ROW_LIMIT. It lacks detail on error behavior and the exact return shape, but the main safety characteristics are clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded: the first sentence states the purpose and acceptable statement types, the second provides restrictions and the row cap. No unnecessary information or filler is present, and each sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema or annotations, the description should more precisely describe the returned data layout, such as whether rows are returned as arrays with column headers or as objects. It also does not mention error handling when a query is rejected or when the row limit is exceeded. These are meaningful gaps for a tool without an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, so the description must compensate for the 'sql' parameter. It explains what kinds of SQL are accepted and what is rejected, which adds meaningful semantics beyond the bare string type. It could still be more explicit about formatting requirements (e.g., single statement, no trailing semicolons), but the core meaning is well communicated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the operation: run a single read-only SQL statement (SELECT/WITH/EXPLAIN/SHOW) against the configured PostgreSQL database and return the rows. It gives a specific verb and resource, but it does not explicitly differentiate from the sibling tools, especially pg_explain_query, which overlaps on the EXPLAIN capability.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies appropriate usage—single read-only SQL queries—and documents strong restrictions, but it never names alternatives or explains when to use pg_explain_query, pg_list_tables, pg_check_privileges, or pg_describe_table instead. The overlap of EXPLAIN support with pg_explain_query leaves some ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0pg_check_privilegespg_describe_tablepg_explain_querypg_list_tablespg_run_queryScored across 5 tools
Each tool has a clearly distinct role: executing read-only queries, explaining query plans, listing tables, describing table schemas, and checking write privileges. There is no functional overlap or ambiguity between them.
All tool names follow the same pg_ prefix with a consistent verb_noun pattern: run_query, explain_query, list_tables, check_privileges, describe_table. The naming is uniform and predictable.
Five tools is well-scoped for a PostgreSQL guard/observer server. Each tool serves a clear, non-redundant purpose and the set feels complete without being bloated.
The tool surface covers the core read-only workflow: exploring available tables, inspecting schemas, validating query plans, running queries, and verifying the security posture. No obvious dead ends or missing security-relevant operations are apparent.
Safe, read-only Postgres and MySQL access for AI agents. Audit log + column-level controls.
Deterministic safety, correctness & cost gate that vets Postgres SQL before your AI agent runs it.
Query PostgreSQL databases in plain English — LLM-generated, safety-validated SQL.
Query 40 databases from Claude, ChatGPT, or Cursor — on any device. Read-only, encrypted, audited.
