Provide system status and configuration details without exposing secrets.

Retrieve structural details, parameters, and definition for a database object.

Discover tables and columns with optional filtering by schema or keyword search.

Execute read-only SELECT statements and CTEs with safety validation and row limits.

Execute read-only SQL batches with support for temporary tables within the session.

Execute PostgreSQL functions or procedures with optional parameters and result limiting.

Execute a PostgreSQL function with positional parameters and return preview rows.

Use this tool for function calls such as sales."Fn_GetSalesChamps"(2, 2025, ARRAY[1,2,5], 5).

Pass arguments in positional order using JSON-compatible values:

• scalars: 2, 2025, 5

• arrays: [1, 2, 5]

• null: null

PostgreSQL array parameters should be passed as normal lists; psycopg adapts them to PostgreSQL arrays automatically.

Insert a single row into a PostgreSQL table.

Use this tool when you need one explicit insert with structured values.

• table_name: table target, optionally schema-qualified

• row: object mapping column names to values

• returning_columns: optional list of columns to return via RETURNING

Example:

• table_name: sales.orders

• row: { "customer_id": 10, "status": "new" }

• returning_columns: ["order_id"]

Insert multiple rows into a PostgreSQL table in one batch.

Use this tool for bulk inserts where every row has the same columns.

• table_name: table target, optionally schema-qualified

• rows: list of objects mapping column names to values

• returning_columns: optional list of columns to return from inserted rows

Notes:

• Every row must use the same columns in the same order.

• Arrays can be passed as JSON lists and psycopg adapts them automatically.

Send an HTTP GET request.

Use for read-only resource retrieval. Provide a full URL. Pass jwt_token to forward the caller's JWT for this request only. If jwt_token is omitted, API_BEARER_TOKEN is used when configured. headers.Authorization is ignored; use jwt_token instead.

Send an HTTP HEAD request.

Use for metadata/status checks without retrieving a full body. Pass jwt_token to override the default environment token for this call. headers.Authorization is ignored; use jwt_token instead.

Send an HTTP POST request.

Use for create/actions. Provide a full URL. body accepts JSON object/array or UTF-8 text. content_type optionally overrides the Content-Type header. Pass jwt_token to forward the caller's JWT for this request only.

Send an HTTP PUT request.

Use for full updates/replacements. body accepts JSON object/array or UTF-8 text. Pass jwt_token to forward the caller's JWT for this request only.

Send an HTTP PATCH request.

Use for partial updates. body accepts JSON object/array or UTF-8 text. Pass jwt_token to forward the caller's JWT for this request only.

Send an HTTP DELETE request.

Use for delete operations. Some APIs allow delete payloads; if needed, provide body as JSON object/array or UTF-8 text. Pass jwt_token to forward the caller's JWT for this request only.

Acquire a session-scoped JWT for email from the backend broker.

After a successful call every HTTP tool call in this session will automatically use the returned token (unless the tool call provides its own jwt_token).

Parameters

email: The user whose identity the MCP session will impersonate. reason: Optional free-text description of why this session is needed. Stored in the JWT claims for audit purposes.

Returns

dict ok=True with email, display_name, user_name, store on success; ok=False with error on failure.

Switch the active session to a different user.

Equivalent to calling auth_start_session — provided as a semantic alias when the intent is to change the active user rather than start a fresh session.

Parameters

email: The new user to impersonate. reason: Optional free-text description of why the switch is needed.

Returns

dict Same shape as auth_start_session.

Return the current session status without exposing the raw token.

Returns

dict active=False when no session is set; otherwise active=True with email, display_name, expires_in_seconds, and needs_refresh.

Clear the active session token from memory.

After this call HTTP tools will fall back to API_BEARER_TOKEN (if configured) or make unauthenticated requests.

Returns

dict {"ok": True, "message": "Session cleared."}.