Skip to main content
Glama

PGAutoPilot

PGAutoPilot

MIT License Node.js 18+ TypeScript MCP PostgreSQL React Express Tailwind pgautopilot MCP server CI

Model-agnostic PostgreSQL access for AI assistants, plus a hardened web dashboard.

Sponsor cyberreinxy

PGAutoPilot lets any AI assistant safely explore, query, and manage a PostgreSQL database in natural language through an MCP server, and gives you a full management UI through an optional dashboard. Both entry points share the exact same safety model (redaction, blocked tables, read-only mode, the dangerous-function gate), so every action, whether from an editor or the web UI, is subject to the same guarantees.

Model-agnostic  PostgreSQL-optimized  Safe writes  Read-only mode
Minimal config  Single executable    Docker       Cloud databases
Connection pool Production-ready     SSL          Schema inspection

Contents


Related MCP server: PostgreSQL MCP Server

What is PGAutoPilot?

Most database MCP servers expose raw SQL directly and leave destructive operations largely unguarded. PGAutoPilot takes the opposite stance:

  • Schema-aware: every identifier is validated against your live database.

  • Production-first: every write path is guarded by multiple configurable safety layers.

  • Model-agnostic: works identically with Claude, GPT-4o, Gemini, DeepSeek, Copilot, and open-source models.

  • Two surfaces, one safety model: the MCP server and the dashboard share the same redaction, blocked-tables, and read-only guarantees.

You: "Show me customers that spent more than $500."
  -> db_aggregate(table="orders", by="customer_id", _sum="total",
       orderBy={"_sum/total": "desc"}, take=5)
  <- 23 customers found

Repository layout

The repo is a monorepo with two independent halves, the MCP server and the dashboard, each with its own toolchain, kept separate but unified under one repo and one shared safety model.

root/
│
├─ server/                        MCP core, PostgreSQL MCP server (npm, single executable)
│  ├─ src/
│  │  ├─ index.ts                 MCP server entry point / initialization
│  │  ├─ config.ts                Env loading + validation
│  │  ├─ db.ts                    PostgreSQL connection pool
│  │  ├─ schema.ts                Live schema introspection (information_schema)
│  │  ├─ sqlBuilder.ts            Parameterized, safe SQL builder
│  │  ├─ safety.ts                Redaction, write access, warnings
│  │  ├─ toolDefinitions.ts       Zod schemas for all 14 tools
│  │  ├─ toolHandlers.ts          Tool implementations
│  │  ├─ sqlDump.ts               Backups via pg_dump
│  │  └─ *test.ts                 Colocated vitest tests
│  ├─ dist/                       Compiled + bundled artifact (pgautopilot.bundle.cjs)
│  ├─ config/                     Ready-to-use MCP configs for every editor/CLI (one folder per client)
│  ├─ scripts/                    bundle / sign / verify installers
│  ├─ docker-compose.yml          PostgreSQL 16 + MCP server
│  └─ package.json                npm package `pgautopilot`
│
└─ web/                           Dashboard, pnpm/Turborepo workspace
   ├─ apps/
   │  ├─ api/                     Express API (auth, tool gateway, schema, migrations, snapshots)
   │  └─ web/                     React + Vite + Tailwind v4 single-page app
   └─ packages/
      ├─ contracts/               Zod schemas + DTOs shared across the wire
      ├─ api-client/              Typed fetch client generated against contracts
      ├─ ui/                      Presentational component library (design system)
      ├─ core/                    HTTP-friendly port of the MCP tool/safety layer
      └─ config/                  Shared tsconfig + eslint presets

Two halves, one safety model. The web/ workspace is isolated (its own pnpm-lock.yaml, Turborepo, packages) and depends strictly inward (apps/* -> packages/*; packages never depend on apps). web/packages/core is an HTTP-friendly port of the MCP core's safety layer (server/src/safety.ts), so both entry points enforce identical guarantees. A change to one safety layer must be mirrored in the other, or the two surfaces diverge.

Each half has its own README stub pointing here, and each has its own verification gate, see Development and Verification before shipping.


The two entry points

Entry point

What it is

Built for

MCP server (server/)

A single-executable MCP server (pgautopilot) that AI assistants talk to over stdio

Running queries/tools from your editor (VS Code, Cursor, Claude Desktop, Zed, …)

Dashboard (web/)

A hardened web UI (React + Express) with tables, tools, SQL editor, schema, migrations, snapshots

Managing the database in a browser, on top of the same safety layer

The MCP server is the primary, fully self-contained artifact. The dashboard is an optional extension that connects to a database through the same gatekeeping logic.


Install

Requirements: Node.js 18+ · PostgreSQL 12+ (local, remote, Docker, or cloud) · any MCP-compatible client (for the server) or a modern browser (for the dashboard).

MCP server (server/)

npm:

npm install -g pgautopilot

No npm, one-line installer (clones, adds to PATH; re-run to update):

Platform

Command

Linux/mac

curl -fsSL https://raw.githubusercontent.com/cyberreinxy/pgautopilot/main/install.sh | bash

Windows

irm https://raw.githubusercontent.com/cyberreinxy/pgautopilot/main/install.ps1 | iex

Download & run: node pgautopilot.bundle.cjs

Clone & run: git clone https://github.com/cyberreinxy/pgautopilot.git && cd pgautopilot && node server/dist/pgautopilot.bundle.cjs

Uninstall:

Platform

Command

Linux/mac

curl -fsSL https://raw.githubusercontent.com/cyberreinxy/pgautopilot/main/uninstall.sh | bash

Windows

irm https://raw.githubusercontent.com/cyberreinxy/pgautopilot/main/uninstall.ps1 | iex

Dashboard (web/)

pnpm install

Installs are idempotent and signed; see Software Signing.


Quick Start

1. MCP server (AI assistants)

Create a .env anywhere on your machine (PGAutoPilot finds it automatically):

DATABASE_URL=postgresql://user:password@localhost:5432/yourdb

Connect your AI assistant, identical config for VS Code, Cursor, Windsurf, Claude Desktop, Zed, JetBrains, Neovim, opencode, Cline, Kilo, Roo Code, Gemini CLI, Codex CLI, Copilot CLI, and more:

{ "mcpServers": { "postgres": { "command": "pgautopilot" } } }

Ready-to-copy config files for every supported client live in server/config/, each folder has a README showing where to put the file in your project.

Then just ask: "Show me all tables." · "How many users signed up this month?" · "Find orders over $500 by customer." · "Add a product called 'Widget Pro' at $29.99."

2. Dashboard (web UI)

From web/:

pnpm install
cp .env.example .env   # set DATABASE_URL, PORT, HOST, DASHBOARD_TOKEN
pnpm dev               # API on 127.0.0.1:3000 + Vite on :5173 (hot reload)

After pnpm build, the API also serves the built SPA directly, so the full app runs monolithically on the API port.

Without Docker? Get a local database running in minutes with Run your own PostgreSQL (no Docker).


Architecture

AI Assistant
     (Claude / Cursor / GPT / Gemini)
        |
        v
   MCP Protocol
        |
        v
+----------------------------------+
|          PGAutoPilot              |
|                                  |
|  Schema Discovery                 |
|  Identifier Validation            |
|  Safety Policy Engine     <----+  |
|  SQL Builder                   |  |
|  Connection Pool               |  |
|  Tool Handlers (14 tools)      |  |
+---------------------------------+ |
        |                          |
        v                          |
   PostgreSQL      Everything passes through safety

Every MCP request flows: natural language → MCP tool call → Zod parameter validation → live schema lookup → identifier validation → safety policy evaluation → parameterized SQL generation → time-limited execution → formatted response. Deterministic at every step. No hidden state, no side effects.

The dashboard follows the same flow through its API: browser → Express → tool gateway → packages/core (a port of the same safety layer) → PostgreSQL.


Safety & Security

Threat model

PGAutoPilot runs on your machine and connects over the PostgreSQL wire protocol. The AI assistant communicates only through MCP, and every request passes the safety layer before reaching PostgreSQL. The DATABASE_URL credential is the sole authentication boundary for the MCP server; the dashboard adds optional bearer-token auth and binds to 127.0.0.1 by default.

The safety model is shared by both entry points (server/src/safety.ts and web/packages/core/src/safety.ts); a change to one must be mirrored in the other, or the two surfaces diverge.

Safety features

Threat

Protection

SQL injection

Parameterized queries (never string interpolation)

Accidental delete-all

confirmAll: true required

Full table update

Warning on >10 rows affected

Secret exposure

Automatic redaction on read + strip on write

Unknown table/column

Live schema validation before query build

Slow queries

Configurable statement timeout (default 10s)

Connection exhaustion

Configurable pool limit

Arbitrary SQL

db_raw_query is SELECT-only, single-statement

Dangerous Postgres fns

Blocked: pg_read_file, COPY, pg_sleep, etc.

Bulk data loss

Dry-run support on every write tool

Operational guarantees

  • Never logs DATABASE_URL (hostname only in the startup banner)

  • Never exposes redacted fields (passwords, tokens, keys → ***REDACTED***)

  • Never runs multiple SQL statements in one call

  • Never UPDATEs without live identifier validation

  • Never DELETEs all rows without confirmAll: true

  • Never runs raw INSERT/UPDATE/DELETE (use the structured tools)

  • Never bypasses schema validation or exceeds the pool max

Sensitive columns

Columns matching password, token, secret, api_key, private_key, ssn, credit_card, cvv (and variants) are auto-redacted on read and stripped on write. Extend via SENSITIVE_COLUMNS.

Least-privilege database role

Do not connect with a superuser or the application's primary role. Create a dedicated role per connection mode and point DATABASE_URL at it. The Postgres role is the security boundary, not the client.

CREATE ROLE mcp_readonly LOGIN PASSWORD 'generate-a-strong-password';
GRANT CONNECT ON DATABASE yourdb TO mcp_readonly;
GRANT USAGE ON SCHEMA public TO mcp_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO mcp_readonly;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO mcp_readonly;

For a read/write connection, additionally grant INSERT, UPDATE, DELETE on the tables the agent may touch. Never grant SUPERUSER. For non-loopback hosts, prefer PGSSLMODE=verify-full.

Dashboard security

  • Localhost-first: the API binds to 127.0.0.1 by default; set DASHBOARD_TOKEN to require Authorization: Bearer <token> on all /api/* routes.

  • Same safety model as the MCP server: every tool call passes through packages/core.

  • No CORS by default: the web app is served same-origin through the Vite proxy.

  • Masked errors: production mode returns generic errors so schema details never leak.

  • Rate limiting: tool execution, migrations, and failed authentication are throttled when configured.

Security

  • Responsible disclosure: report vulnerabilities privately via GitHub Security Advisories.

  • Signed releases: every release is SHA-256 checksummed and GPG-signed.

  • Zero runtime dependencies in the bundled MCP server build.

  • Logging policy: connection strings are never logged; per-request logs off in --mode=production.


Tools (MCP server)

Read tools

Tool

Use when...

Returns

db_overview

"What's in this database?"

All tables, row counts, relationships

db_schema

"What columns does each table have?"

Full column/type/constraint map

db_health

"Is the connection working?"

Pool usage, uptime, latency

db_table_info

"Tell me about the orders table"

Columns, indexes, row estimates, size

db_find_many

"Show recent orders", "Find inactive users"

Filtered, sorted, paginated rows

db_find_first

"Get user with ID 42"

Single matching row

db_count

"How many users signed up this week?"

Row count (all or filtered)

db_aggregate

"Total sales by category", "Average order value"

Grouped aggregates (count, sum, avg, min, max)

db_raw_query

"I need a custom SELECT"

Raw query results (SELECT-only, limited to 5000 rows)

Write tools

Tool

Use when...

Safety

db_create

"Add a new user"

Dry-run supported, schema-validated

db_upsert

"Create or update this product"

Dry-run supported, conflict-safe

db_update_many

"Update all shipped orders"

Warns on >10 rows, dry-run supported

db_delete_many

"Delete old logs"

Warns on >10 rows, confirmAll for full clears

Maintenance tools

Tool

Use when...

Output

db_backup

"Back up the database"

Full SQL dump via pg_dump


Examples

Find recent orders for a customer:

Prompt: "Show me the last 10 orders for customer 42"
Tool:   db_find_many(table="orders", where={"customer_id": 42}, select=["id","total","status","created_at"], orderBy={"created_at":"desc"}, take=10)

Count products by category:

Prompt: "How many products in each category?"
Tool:   db_aggregate(table="products", by="category", _count="*", take=5, orderBy={"_count": "desc"})
        -> Electronics: 142, Clothing: 89, Books: 54, ...

Add a record (dry run first, then commit):

Prompt: "Add Jane Doe with email jane@example.com"
Tool:   db_create(table="users", data={"email":"jane@example.com","name":"Jane Doe"}, dryRun=true)
        -> "Dry run: valid. Proceed?" -> Row inserted with id 105

Bulk delete with confirmation:

Prompt: "Delete logs from before 2025"
Tool:   db_delete_many(table="logs", where={"created_at":{"lt":"2025-01-01"}}, dryRun=true)
        -> "1,204 rows would be deleted. Confirm? [yes/no]"

Every write tool is dry-run capable, and every query produces the exact parameterized SQL that runs, nothing touches your database silently.


API (dashboard)

All endpoints are mounted under /api. Token auth, rate limiting, and error masking apply when configured.

Method

Path

What it does

GET

/api/health

API + database diagnostics

GET

/api/tools

List the safe MCP tools

POST

/api/tools/:name

Execute a tool with validated params

GET

/api/schema

Live schema introspection

GET

/api/migrations

List applied + pending migrations

POST

/api/migrations/apply

Apply all pending migrations

POST

/api/migrations/apply-selected

Apply specific migrations by version

POST

/api/migrations/apply/:version

Apply a single migration

GET

/api/config

Current safety/read-only/version state

Tool execution passes through packages/core: sensitive-column redaction, blocked-table checks, read-only enforcement, the raw-query dangerous-function gate, and write confirmation requirements.


Migrations (dashboard)

Versioned SQL migrations live in web/apps/api/migrations (default MIGRATIONS_DIR). Applied versions are tracked in the schema_migrations table.

File

What it does

001_initial_schema.sql

Base schema: organizations, users, orders, invoices

002_seed_demo_data.sql

Demo dataset for the dashboard views

Apply pending migrations through the UI, the API (POST /api/migrations/apply), or the migration runner in packages/core. In read-only mode, all apply endpoints are blocked. 001_initial_schema.sql is idempotent; 002_seed_demo_data.sql is not, so never assume both are safely re-runnable.


Docker

Run PGAutoPilot alongside a fresh PostgreSQL instance, or point it at a database you already have:

cd server
docker compose up --build          # PostgreSQL 16 + MCP server together
docker run -e DATABASE_URL=... pgautopilot   # Connect to an existing DB

Run your own PostgreSQL (no Docker)

Don't use Docker for your database? Install PostgreSQL directly on your machine and manage it yourself with psql or pgAdmin.

1. Install

Platform

How

Windows

EDB installer. Note the superuser password it prompts for.

macOS

brew install postgresql@16brew services start postgresql@16

Linux (Debian/Ubuntu)

sudo apt install postgresqlsudo systemctl enable --now postgresql

Linux (Fedora)

sudo dnf install postgresql-server

2. Set the postgres password

(Needed for TCP login; Windows/macOS set it at install time, so skip to step 3 if set):

sudo -u postgres psql -c "ALTER USER postgres PASSWORD 'mypass';"

3. Create a database

createdb mydb (or CREATE DATABASE mydb; via psql).

4. Verify

pg_isready -h localhost -p 5432 should say accepting connections. Then:

DATABASE_URL=postgresql://postgres:mypass@localhost:5432/mydb

5. Inspect with pgAdmin (optional)

New server: Host localhost · Port 5432 · Maintenance DB postgres · Username postgres · your password. Browse tables and run queries while PGAutoPilot works against the same database.

Backups need pg_dump, bundled with PostgreSQL on Windows; install the client tools (postgresql-client / libpq) on macOS/Linux. See Troubleshooting.

Tip: for production, create a dedicated least-privilege role for PGAutoPilot (see Safety & Security) and keep your postgres login for pgAdmin/psql.


Configuration

MCP server (server/)

pgautopilot --readonly                              # block every write
pgautopilot --mode=production                       # suppress per-request logs
pgautopilot --readonly --mode=production

Variable

Default

What it does

DATABASE_URL

(required)

PostgreSQL connection string

PGSSLMODE

auto

SSL mode: disable, prefer, require, verify-full

PGPOOL_MAX

5

Maximum simultaneous database connections

PG_CONNECT_TIMEOUT_MS

10000

Connection timeout (ms)

PG_IDLE_TIMEOUT_MS

30000

Idle-connection timeout (ms)

PG_STATEMENT_TIMEOUT_MS

10000

Max single-query time (ms)

BACKUPS_DIR

./backups

Where db_backup saves files

DOCKER_CONTAINER

-

Docker container name for pg_dump fallback

BLOCKED_TABLES

-

Tables to block writes on (comma-separated)

HIGH_RISK_TABLES

-

Tables that warn but allow writes (comma-separated)

SENSITIVE_COLUMNS

-

Extra columns to redact (comma-separated)

ALLOW_WRITES

-

Set true to enable write tools (read-only by default)

DISABLED_TOOLS

-

Tools to disable entirely (comma-separated)

PG_SCHEMAS

public

PostgreSQL schemas to introspect (comma-separated)

NODE_ENV

development

production disables per-request logging

Dashboard API (web/apps/api)

Variable

Default

What it does

DATABASE_URL

(required)

PostgreSQL connection string

PORT

3000

Port the API binds to

HOST

127.0.0.1

Bind address (localhost by default)

DASHBOARD_TOKEN

-

Bearer token required on all /api/* routes when set

ALLOW_NO_AUTH

false

Allow production start without a token

PG_STATEMENT_TIMEOUT_MS

10000

Max time for a single query (ms)

MIGRATIONS_DIR

./migrations

Directory holding versioned SQL migrations

BACKUPS_DIR

./backups

Where db_backup saves files

DOCKER_CONTAINER

-

Docker container name for pg_dump fallback

BLOCKED_TABLES

-

Tables to block writes on (comma-separated)

HIGH_RISK_TABLES

-

Tables that warn but allow writes (comma-separated)

SENSITIVE_COLUMNS

-

Extra columns to redact (comma-separated)

ALLOW_WRITES

-

Set true to enable write tools (read-only by default)

DISABLED_TOOLS

-

Tools to disable entirely (comma-separated)

READONLY

false

true blocks every write, even with ALLOW_WRITES=true

NODE_ENV

development

production masks errors and disables per-request logs

RATE_LIMIT_MAX

-

Requests per window for tool/migration endpoints

RATE_LIMIT_WINDOW_MS

60000

Rate-limit window

AUTH_RATE_LIMIT_MAX

30

Failed-auth throttle when token auth is on

AUTH_RATE_LIMIT_WINDOW_MS

60000

Failed-auth throttle window

TRUST_PROXY

-

Proxy trust when deployed behind a reverse proxy

Dashboard Web (web/apps/web)

Variable

Default

What it does

VITE_API_BASE

/api

Base URL for the API (same-origin proxy by default)

VITE_DASHBOARD_TOKEN

-

Bearer token sent on every request (match the API token)

Connection string examples:

Where

URL

Localhost

postgresql://postgres:mypass@localhost:5432/mydb

Remote server

postgresql://admin:secret@db.mycompany.com:5432/production

Docker (port-mapped)

postgresql://user:pass@localhost:5433/mydb

Neon

postgresql://user:pass@ep-xxx.us-east-2.aws.neon.tech/neondb

Supabase

postgresql://postgres:pass@db.xxx.supabase.co:5432/postgres

AWS RDS

postgresql://admin:pass@xxx.us-east-1.rds.amazonaws.com:5432/mydb

Render

postgresql://user:pass@host.render.com:5432/mydb

Cloud SSL: cloud providers (Neon, Supabase, RDS, Render) need SSL; set PGSSLMODE=require (stronger: verify-full); auto-detected for most providers.


Performance

PGAutoPilot adds minimal overhead over a direct connection, latency depends on your database and network, with a zero-dependency single-file executable for the MCP server and configurable pool sizes and statement timeouts. Full benchmarks will be published once the project reaches a stable release.


Compatibility

Platform

Support

Windows

Yes (native)

macOS

Yes (native)

Linux

Yes (native)

Docker

Yes

WSL

Yes

ARM64

Yes

x64

Yes

Node 18

Yes

Node 20

Yes

Node 22

Yes


Software Signing

Method

How to verify

SHA-256 hashes

npm run verify or node scripts/verify.mjs (from server/)

GPG signature

npm run verify:gpg (public key: server/PUBLIC_KEY.asc)

cd server
npm run sign:gpg     # signs dist/checksums.txt -> dist/checksums.txt.sig
npm run verify:gpg   # verifies the signature + all checksums

Install scripts verify checksums.txt automatically after cloning. On mismatch, installation aborts. Bypass with --skip-verify (not recommended).


FAQ

Do I need to restart after schema changes? No, identifiers are validated against the live schema on every request.

Can PGAutoPilot modify my database automatically? Only through explicit tool calls; every write is deliberate, and dry-run-before-write is the default.

Does it work with Supabase? Yes, use the Supabase connection string and PGSSLMODE=require.

Does it require npm? No, npm, the one-line installer, or the single-file bundle all work.

Does it support SSL? Yes, auto-detected or via PGSSLMODE.

Can I disable writes entirely? Yes, pgautopilot --readonly.

Can I expose it publicly? No, the MCP server is designed for local/private network use (no auth layer or HTTP server); the dashboard binds to 127.0.0.1 by default.

Is it safe for production? Yes, every write path is guarded. See Safety & Security.


Troubleshooting

Error

Likely cause

How to verify

Fix

DATABASE_URL is not set

.env not found or missing

echo $DATABASE_URL

Create .env in the working directory

Connection refused

PostgreSQL not running or wrong URL

pg_isready

Check host/port, Docker port mapping

SSL connection error

Cloud DB requires SSL

Check provider docs

Set PGSSLMODE=require

Unknown table / column

Typo or wrong schema

Run db_overview first

Use exact names from schema

Only SELECT queries allowed

Using db_raw_query for writes

N/A

Use db_create, db_update_many, etc.

pg_dump failed

pg_dump not installed

which pg_dump

Install postgresql-client or set DOCKER_CONTAINER


Development

MCP server (server/), source layout

server/src/
  index.ts           Entry point, MCP server initialization
  config.ts          Environment variable loading and validation
  db.ts              PostgreSQL connection pool management
  schema.ts          Live schema introspection via information_schema
  sqlBuilder.ts      Parameterized, safe SQL query builder
  safety.ts          Redaction engine, write access control, warnings
  toolDefinitions.ts Zod schemas for all 14 tools
  toolHandlers.ts    Tool implementations, one handler per tool

Command

What it does

npm run dev

Start the dev server with hot-reload

npm run build

Compile TypeScript and bundle into a single executable

npm start

Run the compiled version

npm run typecheck

Full TypeScript type checking

npm run lint

TypeScript type-check + ESLint

npm run test

Unit tests (vitest)

npm run format

Auto-format source files with Prettier

Dashboard (web/)

Command

What it does

pnpm dev

Free conflicting ports, then run API + web with hot reload (Turborepo)

pnpm precheck

Check the API/web ports and kill processes using them

pnpm build

Build all workspace packages

pnpm start

Build, then run the bundled API (apps/api/dist/index.cjs)

pnpm typecheck

Full TypeScript type checking across the workspace

pnpm lint

ESLint across the workspace

pnpm test

Unit tests across the workspace

pnpm test:e2e

Playwright E2E smoke test (from web/apps/web)

pnpm format

Format all source with Prettier

Dashboard source layout:

web/apps/api/src/        Express API (routes, middleware, services)
web/apps/web/src/        React SPA (app, components, features, routes)
web/packages/contracts/  zod schemas + DTOs
web/packages/core/       HTTP-friendly port of the MCP safety layer
web/packages/ui/         design system components
web/packages/config/     shared tsconfig + eslint presets

Verification before shipping

Run the full gate before merging or publishing:

# MCP core
cd server
npm run typecheck && npm run lint && npm run test && npm run build && npm run verify:gpg

# Dashboard
cd ../web
pnpm typecheck && pnpm lint && pnpm test && pnpm build
cd apps/web && pnpm test:e2e

The E2E smoke test (web/apps/web/e2e/smoke.spec.ts) boots the app and asserts the tool runner renders. Run a full integration test against a live API + Postgres if you need deeper coverage, since the smoke test starts only the web server.


Roadmap

  • Authentication plugins / session management UI (API key, JWT)

  • SQL editor with syntax highlighting and safe-query checks

  • Backups UI (trigger and download pg_dump output)

  • AI-assisted workflows (natural language to safe SQL, explain/optimize)

  • Role-based access control and audit log

  • Realtime monitoring (pool stats, slow queries, active sessions)


Contributing & License

See server/CONTRIBUTING.md for contribution guidelines.

MIT &copy; 2026 Cyber Reinxy

Available Tools

18 tools
db_aggregateAggregate / Group ByA
Read-onlyIdempotent

Groups rows by one or more columns and computes aggregate functions (count, sum, avg, min, max) on each group. This is the tool for analytical queries like "total sales by category", "average order value by month", or "count of users per country". Results are sorted by the aggregate by default.

When to use:

  • "How many products in each category?" (by=category, _count="*")

  • "Total revenue by region" (by=region, _sum="amount")

  • "Average order value by status" (by=status, _avg="total")

  • "Min and max prices per category" (by=category, _min="price", _max="price")

Parameter guidance:

  • by: comma-separated column names to group by (required). Example: "category, region"

  • where: optional JSON filter applied before grouping

  • orderBy: JSON object for sorting results. Use "_count", "_sum", "_avg", "_min", "_max" as the key. Example: {"_count": "desc"}

  • sum/avg/min/max: comma-separated numeric columns to aggregate

  • take: max groups to return (default 50)

Behavioral notes:

  • All aggregations run in a read-only transaction with a configurable timeout.

  • Results are returned as an array of group objects with the computed aggregates.

  • Groups with zero rows are excluded from the results.

ParametersJSON Schema
NameRequiredDescriptionDefault
byYesComma-separated column names to group by
avgNoComma-separated numeric columns to average
maxNoComma-separated columns to find maximum
minNoComma-separated columns to find minimum
sumNoComma-separated numeric columns to sum
takeNoMax groups to return (default 50)
tableYesName of the table to query
whereNoOptional JSON filter applied before grouping
orderByNoJSON order object, e.g. '{"_count":"desc"}'
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only signal read-only, idempotent, non-destructive. The description adds genuinely useful behavior: read-only transaction with configurable timeout, default sorting by the aggregate, zero-row groups being excluded, and return shape as an array of group objects. This goes well beyond annotation data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is organized into purpose, usage, parameter guidance, and behavioral notes; every sentence adds operational value. It is longer than one-liner tools but justified by 10 parameters and no output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with no output schema, the description covers selection, invocation patterns, parameter semantics, ordering, limits, filtering, and return behavior. Count semantics are slightly implicit since there is no count input parameter, but the orderBy guidance and examples treat count as a returned aggregate key, so the description remains complete enough for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds practical parameter meaning: comma-separated syntax for by, JSON shape with '_count'/'_sum' keys for orderBy, where being applied before grouping, and take's default. It does not enrich the table/database parameters, so not a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action—'Groups rows by ... and computes aggregate functions'—and names the exact resource pattern. It also says 'This is the tool for analytical queries' and gives concrete query examples, making it easy to distinguish from row-retrieval siblings like db_find_many or db_count.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is an explicit 'When to use' section with four query-pattern examples that map user intents to parameters. It does not name sibling tools or state when not to use it (e.g., for unaggregated rows use db_find_many), so it stops just short of full exclusion guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_backupBackup DatabaseA
Read-only

Creates a full SQL dump of the database using pg_dump and saves it to the configured backup directory (default: ./backups). The backup includes the full schema and data. When the local pg_dump binary is not available and DOCKER_CONTAINER is set, this tool falls back to running pg_dump inside the specified Docker container.

When to use:

  • Before running risky migrations or bulk operations

  • Periodic backups as part of maintenance routines

  • When the user asks to back up or export the database

Parameter guidance:

  • label: optional label for the backup filename (e.g., "pre-migration"). The final filename includes a timestamp: backups/db_backup_pre-migration_2026-09-01T120000.sql

  • confirmed: set to true to confirm the backup operation

Behavioral notes:

  • Requires pg_dump to be available either locally or via Docker.

  • The backup file is a plain SQL dump, not a binary format.

  • Large databases may take significant time and disk space.

  • This tool is idempotent — running it multiple times creates separate backup files.

  • The backup directory is created automatically if it does not exist.

Returns: path to the created backup file and its size.

ParametersJSON Schema
NameRequiredDescriptionDefault
labelNoOptional label for the backup filename
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.
confirmedNoExplicit user confirmation required to run a backup

TDQS

A3.8/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description contradicts the annotations. It says the tool 'saves' backup files to a directory, which is a filesystem side effect, while readOnlyHint is true. It also calls the tool 'idempotent' while idempotentHint is false and the clarifying clause ('creates separate backup files') actually indicates non-idempotent behavior. Despite otherwise useful behavioral notes, the contradiction makes this dimension fail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well organized into short sections: an opening summary, when to use, parameter guidance, behavioral notes, and return value. Every section adds practical information, and the key action is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description covers prerequisites (pg_dump or Docker), fallback behavior, performance implications, return value, and automatic directory creation. It loses one point because the incorrect idempotence claim and readOnlyHint contradiction could mislead an agent about side effects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage for label, database, and confirmed. The description adds meaningful value beyond the schema by showing the exact filename format with a timestamp, giving a concrete 'pre-migration' example, and clarifying that confirmed is an explicit user confirmation gate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Creates a full SQL dump of the database using pg_dump and saves it to the configured backup directory.' It also clarifies that the backup includes the full schema and data, making it easy to distinguish from the db_* query and schema sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'When to use' section lists concrete triggers: risky migrations, bulk operations, periodic maintenance, and explicit user requests to back up/export. It does not explicitly mention when not to use the tool, but there are no obvious backup sibling alternatives to exclude.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_countCount RowsA
Read-onlyIdempotent

Returns the exact number of rows in a table, optionally filtered. This runs an exact COUNT(*) query — not an estimate. Use this when you need a precise count for reporting, validation, or before performing bulk operations.

When to use:

  • "How many users signed up this week?"

  • "Count all orders with status pending"

  • Before bulk deletes, to confirm the scope of the operation

Parameter guidance:

  • table: the table name (required)

  • where: optional JSON filter object (same syntax as db_find_many)

Behavioral notes:

  • Exact COUNT(*) on large tables (millions of rows) may be slow.

  • On large tables, consider using db_aggregate with a group-by for approximate breakdowns.

  • Returns an integer count, not a row object.

ParametersJSON Schema
NameRequiredDescriptionDefault
tableYesName of the table to query
whereNoOptional JSON filter object
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses that the tool runs exact COUNT(*) queries, may be slow on millions of rows, and returns an integer rather than a row object. This adds meaningful behavioral context that annotations alone do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with clear sections, front-loaded core behavior, and no redundancy. Every sentence contributes guidance: exactness, use cases, parameter guidance, and performance caveats.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given three parameters, no output schema, and the need to differentiate from many sibling tools, this description is complete. It covers return type, performance trade-offs, filtering syntax, helpful examples, and when to choose an alternative.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, providing a baseline of 3, but the description adds value by clarifying table is required, explaining the where parameter uses the same syntax as db_find_many, and noting the result type. This goes beyond the basic schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Returns the exact number of rows in a table, optionally filtered.' It explicitly contrasts with an estimate ('exact COUNT(*) query — not an estimate') and helps distinguish itself from siblings like db_aggregate and db_find_many.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete when-to-use examples ('How many users signed up this week?', 'Count all orders with status pending') and explicitly recommends an alternative tool for large tables ('consider using db_aggregate'). It also references db_find_many's syntax, giving clear routing among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_createCreate RowA
Destructive

Inserts a new row into the specified table. All columns are validated against the live schema before execution — typos in column names or type mismatches are caught early. Sensitive columns (passwords, tokens, API keys, etc.) are automatically stripped from the input to prevent accidental credential storage. Use dry_run=true to preview the insert without actually writing to the database.

When to use:

  • "Add a new user named Jane with email jane@example.com"

  • "Create an order for customer 42 with total $99.99"

  • Any single-row INSERT operation

Parameter guidance:

  • table: the target table name (required)

  • data: JSON object of column-value pairs to insert (required). Example: {"name": "Jane Doe", "email": "jane@example.com", "role": "admin"}

  • dry_run: set to true to validate without writing (default: false)

Behavioral notes:

  • The table name and all column names are validated against the live schema.

  • The INSERT runs in a transaction — if any constraint is violated, the entire operation rolls back with a clear error message.

  • On success, returns the inserted row including any auto-generated values (e.g., id).

  • Sensitive columns in the input are silently stripped before execution.

  • For multiple inserts, call this tool once per row or use db_raw_query with an INSERT ... VALUES statement (requires confirmed=true and ALLOW_RAW_WRITES).

ParametersJSON Schema
NameRequiredDescriptionDefault
dataYesJSON object of column values to insert
tableYesName of the table to query
dryRunNoIf true, simulates without writing
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even with annotations present, the description adds substantial behavioral detail: schema validation, sensitive-column stripping, transactional rollback on constraint violations, dry-run semantics, and the return value including auto-generated fields. These are meaningful behaviors not visible in the annotations or schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well organized into clear sections and front-loads the core purpose. It is somewhat long and repeats the schema-validation point twice, but the structure and examples make the information easy to consume.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description explains what the tool returns on success, how dry_run behaves, and what validation or rollback guarantees exist. It is complete enough for an agent to call this tool correctly without opening the schema, and the database parameter is already covered in the input schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all parameters. The description adds a concrete data example and clarifies dry_run behavior, which is helpful. However, it refers to the parameter as dry_run while the schema defines dryRun, and it does not mention the database parameter at all, creating a minor invocation risk.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Inserts a new row into the specified table.' It clearly differentiates this from sibling tools by framing it as the single-row INSERT operation and even contrasts it with db_raw_query for multiple inserts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'When to use' examples and gives a clear routing rule: for multiple inserts, call this tool once per row or use db_raw_query with confirmed=true. This tells an agent exactly when this tool is appropriate and when an alternative is better.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_delete_manyDelete RowsA
Destructive

Deletes all rows matching the given filter. This is a destructive operation — deleted data cannot be recovered unless a backup exists. When the filter is empty ('{}'), ALL rows in the table would be deleted — this requires confirmAll=true as a safety gate. A warning is issued when more than 10 rows are affected. Use dry_run=true to preview the deletion scope before committing.

When to use:

  • "Delete all logs older than 2025"

  • "Remove user with email test@test.com"

  • "Purge expired sessions"

Parameter guidance:

  • table: the target table name (required)

  • where: JSON filter selecting rows to delete (required). Example: {"expired": true} Use '{}' with confirmAll=true to delete ALL rows (dangerous!).

  • dry_run: set to true to preview without deleting (default: false). STRONGLY recommended — always dry-run first to see how many rows would be affected.

  • confirmAll: REQUIRED when where='{}' to confirm deleting all rows

Behavioral notes:

  • A warning is emitted when more than 10 rows would be affected.

  • Empty filter with confirmAll=false returns an error requiring explicit confirmation.

  • The delete runs in a transaction — all rows are deleted atomically.

  • Returns the count of deleted rows.

  • ALWAYS use dry_run=true first to verify the scope before committing.

ParametersJSON Schema
NameRequiredDescriptionDefault
tableYesName of the table to query
whereYesJSON filter selecting rows to delete
dryRunNoIf true, simulates without deleting
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.
confirmAllNoRequired to delete all rows when where is '{}'

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even though annotations already mark destructiveHint=true, the description adds crucial behavior: irreversibility without backup, the confirmAll safety gate, warning on >10 rows, atomic transaction behavior, returned deleted count, and the strong recommendation to dry-run first. This goes well beyond the annotations and gives an agent a full risk profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is lengthy but organized into clear sections: overview, when to use, parameter guidance, and behavioral notes. Some safety guidance is repeated, but for a destructive tool that repetition reinforces the most critical behavior without becoming bloated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the full calling context: when to use, how to use safely, what counts as dangerous, the transaction guarantee, and the return value. Since there is no output schema, the statement that it returns the count of deleted rows is especially valuable and completes the picture.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds important semantic weight: where is a JSON filter with a concrete example, '{}' is explicitly labeled dangerous and requires confirmAll=true, dryRun is strongly recommended as a preview mechanism, and confirmAll's purpose is explained. This materially helps an agent invoke parameters correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Deletes all rows matching the given filter.' It clearly distinguishes this as a destructive bulk deletion tool, and the examples and safety gate make its scope unambiguous relative to siblings like db_update_many or db_find_many.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'When to use' section provides concrete, realistic scenarios and explicitly warns about the empty-filter case and the confirmAll requirement. It does not explicitly contrast with alternatives such as db_update_many, but the guidance is clear enough for an agent to decide when deletion is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_explainExplain Query PlanA
Read-onlyIdempotent

Runs EXPLAIN ANALYZE on a SQL SELECT query to analyze its execution plan, performance characteristics, and bottlenecks. Returns the full execution plan with timing, buffer usage, row estimates, and actionable analysis. This tool helps you understand how PostgreSQL processes a query and identifies optimization opportunities like missing indexes, sequential scans, or high-cost operations.

When to use:

  • "Why is this query slow?"

  • "Help me optimize this query"

  • "What indexes would improve this query?"

  • Before creating indexes, to understand current plan

Parameter guidance:

  • query: the SQL SELECT query to analyze (required). Example: "SELECT u.name, COUNT(o.id) FROM users u JOIN orders o ON o.user_id = u.id WHERE o.created_at > '2025-01-01' GROUP BY u.name ORDER BY COUNT(o.id) DESC LIMIT 10"

  • analyze: set to true for actual timing (default: true)

  • buffers: set to true to include buffer usage stats (default: true)

Behavioral notes:

  • Only SELECT queries are accepted — EXPLAIN on writes is not supported.

  • The query is NOT executed — only the plan is analyzed.

  • Results include: execution plan (JSON), total cost, actual time, rows, buffers, and analysis text.

  • Analysis highlights: sequential scans on large tables, low selectivity filters, missing index opportunities, high-cost joins.

  • No extensions required — uses built-in PostgreSQL EXPLAIN.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesThe SQL SELECT query to analyze. Must be a SELECT statement. The query is wrapped in EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON) automatically.
analyzeNoRun EXPLAIN ANALYZE for actual timing (default: true).
buffersNoInclude buffer usage statistics (default: true).
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds substantial behavioral context beyond annotations: only SELECT is accepted, query has no persistent side effects, output includes execution plan JSON/cost/time/buffers/analysis, and no extensions are required. Minor imprecision: 'The query is NOT executed' is technically misleading for EXPLAIN ANALYZE, which executes internally to gather timing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average but strictly organized into overview, when-to-use, parameter guidance, and behavioral notes. Every section carries necessary information, and there is no filler or redundancy beyond the minor execution phrasing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter tool with no output schema, this is complete: it covers invocation, parameter format, behavioral limits, result contents, analysis focus, and prerequisites. An agent has enough to decide when to call it and what to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema already documents all four parameters with 100% coverage, so the baseline is 3. The description adds value with a full example query, clarifies the effect of analyze/buffers defaults, and lists result components. The database parameter is not elaborated, but the schema covers it adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence names a specific action ('Runs EXPLAIN ANALYZE') and resource ('SQL SELECT query'), and the rest specifies the output (execution plan, performance characteristics, bottlenecks). It is clearly differentiated from sibling row-returning tools (db_find_many, db_raw_query) by being explicitly about query plan analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

A dedicated 'When to use' section lists four concrete scenarios, from 'Why is this query slow?' to 'Before creating indexes'. No explicit when-not-to-use or alternative tool names are given, so it stops short of a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_find_firstFind First RowA
Read-onlyIdempotent

Finds a single row matching the given filter. Returns the first matching row or null if no rows match. Use this instead of db_find_many when you expect exactly one result and want a single object rather than an array. Sensitive columns are automatically redacted.

When to use:

  • "Get user with ID 42", "Find the order with this tracking number"

  • Lookups by unique identifier (primary key or unique constraint)

  • When you need exactly one row, not a list

Parameter guidance:

  • where: JSON filter object (required). Must be specific enough to target one row. Example: {"id": 42} or {"email": "user@example.com"}

  • select: optional JSON array of column names to return

Behavioral notes:

  • Returns a single JSON object, not an array.

  • Returns null (not an error) when no row matches the filter.

  • For queries that should return multiple rows, use db_find_many instead.

ParametersJSON Schema
NameRequiredDescriptionDefault
tableYesName of the table to query
whereYesJSON filter object to find a single row
selectNo
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive behavior, so the bar is lower. The description adds valuable context beyond annotations: sensitive columns are automatically redacted, null is returned rather than an error, and the result is a single object. This is strong but not exhaustive—the meaning of 'first' row is not clarified with respect to ordering.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections for usage, parameters, and behavior, and it front-loads the core purpose. It is slightly repetitive—'use db_find_many instead' appears in both the opening and the behavioral notes—but this redundancy is minor and aids routing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers return type, null behavior, sensitive column redaction, parameter guidance, and sibling differentiation, which is substantial given no output schema. The only notable omission is clarifying whether 'first' implies a defined ordering or is database-dependent, which could matter for exact-result expectations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 75% schema coverage, the schema documents table, where, and database, but select lacks a description. The description compensates by explaining where as a JSON filter object with concrete examples, emphasizing specificity, and defining select as an optional JSON array of column names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb plus resource: 'Finds a single row matching the given filter', and clearly distinguishes itself from db_find_many by emphasizing a single object rather than an array. It also states the null return case, making the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to use this tool 'instead of db_find_many when you expect exactly one result' and provides concrete scenarios like unique identifier lookups. It also repeats the exclusion in the behavioral notes, so an agent has clear routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_find_manyFind Many RowsA
Read-onlyIdempotent

Queries rows from a table with flexible filtering, column selection, sorting, and pagination. This is the primary tool for reading data. All parameters are optional except 'table' — omitting filters returns all rows (up to the limit). The default limit is 50 rows; the maximum is 500. Sensitive columns (passwords, tokens, keys) are automatically redacted in the output.

When to use:

  • "Show me recent orders", "Find users with email containing gmail"

  • "List products sorted by price", "Get page 2 of customers"

  • Any read query that needs filtering, sorting, or pagination

Parameter guidance:

  • where: JSON filter object. Supports operators: eq, neq, gt, gte, lt, lte, contains, startsWith, endsWith, in, notIn. Example: {"status": "active", "age": {"gt": 18}}

  • select: JSON array of column names to return. Example: ["id", "name", "email"]

  • orderBy: JSON object with column name and direction. Example: {"created_at": "desc"}

  • take: max rows to return (default 50, max 500)

  • skip: rows to skip for offset pagination

Behavioral notes:

  • All queries run in a read-only transaction with a configurable timeout (default 10s).

  • The table name is validated against the live schema before query execution.

  • Results include pagination metadata (total count when available).

  • On error, returns a clear message explaining what went wrong.

ParametersJSON Schema
NameRequiredDescriptionDefault
skipNoRows to skip for pagination
takeNoMax rows to return (default 50, max 500)
tableYesName of the table to query
whereNoJSON filter object, e.g. '{"email":{"contains":"@gmail"}}'
selectNoJSON array of column names, e.g. '["id","email"]'
orderByNoJSON object, e.g. '{"createdAt":"desc"}'
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this read-only and idempotent, and the description adds meaningful behavior beyond them: automatic redaction of sensitive columns, read-only transaction timeout, live schema validation, pagination metadata, and error messages. No statement contradicts the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is organized into clear sections: summary, when-to-use examples, parameter guidance, and behavioral notes. It is long but every section adds operational value; no filler or repetition of the schema is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter read tool with no output schema, the description covers invocation, parameter semantics, defaults, limits, security behavior, and error handling. The only minor omission is explicit routing to sibling tools, but the usage examples make the tool's scope sufficiently clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description goes well beyond it by documenting where operators (eq, neq, gt, gte, lt, lte, contains, startsWith, endsWith, in, notIn), providing concrete JSON examples for where/select/orderBy, and stating take default/max. The database parameter is only in the schema, but the schema description is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb ('Queries rows') and resource ('from a table') and enumerates capabilities: filtering, column selection, sorting, and pagination. The phrase 'primary tool for reading data' helps distinguish it from sibling read tools, and the title 'Find Many Rows' reinforces the many-row semantics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'When to use' section lists concrete natural-language triggers and explicitly says any read query needing filtering, sorting, or pagination. It does not explicitly name alternatives or exclusions (e.g., use db_find_first for a single row), so guidance is clear but not fully contrastive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_healthDatabase HealthA
Read-onlyIdempotent

Checks database connectivity, connection pool statistics, server uptime, and total request count. In multi-database mode, omit the database parameter to see health status for all configured databases simultaneously. Also runs PostgreSQL system checks: vacuum health (TXID wraparound risk), replication lag, index usage, sequence exhaustion, buffer cache hit rate, and invalid constraints.

When to use:

  • At the start of a session to verify the database is responsive.

  • When the user asks about connection health or pool utilization.

  • When troubleshooting slow responses or connection errors.

  • Periodically during long sessions to check pool exhaustion.

  • To check vacuum/replication/sequence health in production.

Behavioral notes:

  • In single-database mode, returns stats for the one connected database.

  • In multi-database mode, returns an array of health entries for all databases.

  • 'idle' connections are available; 'active' connections are in use.

  • If pool utilization is high (>80%), consider increasing PGPOOL_MAX.

  • Vacuum checks query pg_stat_user_tables — no extensions required.

  • Replication checks query pg_stat_replication — returns empty on standalone instances.

  • Buffer cache checks pg_stat_database for hit rate below 90%.

  • Constraint checks pg_constraint for invalid (unvalidated) constraints.

Returns: JSON with connected (boolean), pool stats (total, idle, active), uptime seconds, total requests served, database connection summary, and health checks (vacuum, replication, indexes, sequences, bufferCache, constraints).

ParametersJSON Schema
NameRequiredDescriptionDefault
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses single- versus multi-database behavior, empty replication results on standalone instances, idle/active connection semantics, the >80% pool-utilization guidance, and which system tables are queried. These details go far beyond the annotations' readOnly/idempotent hints and give the agent accurate expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is organized into clear sections, front-loads the primary purpose, and uses bullets for usage guidance. It is longer than average, but every section carries distinct operational information for a complex diagnostic tool, so the length is earned.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even without an output schema, the description enumerates the exact returned fields (connected, pool stats, uptime, total requests, database summary, and each health check) and covers edge cases such as standalone instances and mode differences. An agent has enough context to invoke the tool correctly and interpret its result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already explains the database parameter and its default. The description adds multi-database mode behavior ('omit the database parameter to see health status for all configured databases simultaneously') and clarifies the parameter's source, which is meaningful context beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Checks database connectivity, connection pool statistics, server uptime, and total request count' and then targets specific PostgreSQL system checks. This clearly distinguishes db_health from siblings like db_overview or mcp_status by naming concrete metrics rather than a generic health phrase.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

A dedicated 'When to use' section lists clear trigger scenarios: session startup, connection-health queries, slow-response troubleshooting, periodic pool checks, and production vacuum/replication checks. It does not explicitly name sibling tools to exclude, so it stops short of a 5, but the context is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_list_databasesList DatabasesA
Read-onlyIdempotent

Lists all databases configured in pgautopilot.json for multi-database mode, including each database's connection status (connected, not connected, or error), host, port, schema, and read-only setting. This tool is only meaningful in multi-database mode — in single-database mode it returns a message indicating only one database is configured.

When to use:

  • As the first call when the user wants to work with a specific named database.

  • To discover which databases are available before calling db_use_database.

  • To verify that all configured databases are reachable.

Returns: an array of database entries with name, connection summary, status (connected | not connected | error), and readonly flag. Databases that failed to connect at startup will show 'not connected' and will be lazily connected on first use.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint. The description adds valuable behavioral context beyond those: the single-database mode fallback message, how failed connections appear, and the lazy connection behavior on first use. It does not contradict annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is organized with the core function first, followed by usage guidance and return details. It is longer than strictly necessary but every sentence adds useful information, such as status values and lazy connection behavior, rather than repeating schema or annotation data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description correctly compensates by specifying the array shape and its fields. It also covers edge behavior (single-database mode, failed startup connections) and practical usage context. For a parameterless discovery tool, nothing important is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the input schema confirms this, so the baseline is 4. The description correctly avoids inventing parameter semantics and instead explains what the returned entries contain, which is appropriate for a parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb ('Lists') and specific resource ('databases configured in pgautopilot.json'), and specifies exactly what fields are shown, including connection status, host, port, schema, and read-only setting. It also differentiates the tool's purpose by noting it is meaningful only in multi-database mode.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit 'When to use' guidance with three concrete scenarios, positions it as a precursor to db_use_database, and notes when it is not meaningful (single-database mode). This is strong routing guidance relative to alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_overviewDatabase OverviewA
Read-onlyIdempotent

Provides a high-level overview of the connected PostgreSQL database: all tables with approximate row counts, foreign key relationships between tables, the server mode (read-only or read-write), and active safety rules (blocked tables, high-risk tables, sensitive columns). Use this as your first call when exploring an unfamiliar database to understand its structure before querying specific tables.

When to use:

  • At the start of a session to understand what tables exist and how they relate.

  • When the user asks "What's in this database?" or "Show me the tables."

  • Before writing queries, to confirm table names and relationships.

Behavioral notes:

  • Row counts are estimates from pg_stat (not exact COUNT(*)) for performance.

  • Only tables in the configured schemas are shown (default: public).

  • The overview includes safety metadata so the agent knows what operations are allowed.

Returns: JSON with tables array (name, estimated rows, column count), foreign keys, server mode, and safety configuration.

ParametersJSON Schema
NameRequiredDescriptionDefault
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations already declaring readOnlyHint=true and idempotentHint=true, the description adds meaningful behavioral context: row counts are estimates from pg_stat rather than exact COUNT(*), only configured schemas are shown (default public), and safety metadata is included so the agent knows what operations are allowed. This goes well beyond the annotations and helps set accurate expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with clear 'When to use' and 'Behavioral notes' sections, and it front-loads the core purpose. It earns its length, though there is minor redundancy: the first paragraph already says to use it as a first call, and the 'When to use' bullets restate similar scenarios.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description fully equips an agent to select and call the tool correctly: it explains what the overview contains, when to use it, how row counts behave, what schemas are visible, and what the return JSON includes. Since there is no output schema, the explicit 'Returns' statement is especially valuable and complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers the single optional parameter at 100%, describing it as 'Name of the database to query (from pgautopilot.json). Omit to use the current default database.' The description does not add parameter-level detail, so the schema carries the full burden; the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Provides a high-level overview') and resource ('connected PostgreSQL database'), then enumerates exactly what the overview contains: tables, row counts, foreign keys, server mode, and safety rules. It also positions itself as the 'first call' when exploring an unfamiliar database, which clearly distinguishes it from more detailed sibling tools like db_schema or db_table_info.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'When to use' section gives explicit trigger scenarios: start of a session, 'What's in this database?' questions, and before writing queries to confirm names and relationships. It provides clear context but does not explicitly name sibling tools to avoid, such as db_schema for detailed schema or db_table_info for per-table details.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_raw_queryRaw SQL QueryA
Read-onlyIdempotent

Executes a raw SQL SELECT statement with a mandatory LIMIT clause. This is the escape hatch for queries that cannot be expressed with the structured tools (complex JOINs, CTEs, window functions, subqueries, etc.). All queries run inside a read-only, single-statement transaction with a configurable timeout (default 10 seconds).

When to use:

  • Complex JOINs across multiple tables

  • CTEs, window functions, or subqueries

  • Custom aggregations not supported by db_aggregate

  • Exploratory queries during development

Parameter guidance:

  • sql: the raw SQL statement (required). Must be a SELECT and MUST include a LIMIT clause. Example: "SELECT u.name, COUNT(o.id) FROM users u JOIN orders o ON o.user_id = u.id GROUP BY u.name ORDER BY COUNT(o.id) DESC LIMIT 10"

  • confirmed: set to true to acknowledge the raw query (currently informational)

Behavioral notes:

  • ONLY SELECT statements are allowed. INSERT, UPDATE, DELETE, DROP, ALTER, CREATE, GRANT, and other DDL/DML are rejected.

  • The LIMIT clause is mandatory — queries without LIMIT are rejected.

  • Only single-statement queries are allowed (no semicolons separating multiple statements).

  • Dangerous functions (pg_read_file, COPY, pg_sleep, etc.) are blocked.

  • Results are capped at 5000 rows to prevent memory exhaustion.

  • Sensitive columns are automatically redacted in the output.

  • For write operations, use the structured tools (db_create, db_update_many, etc.).

ParametersJSON Schema
NameRequiredDescriptionDefault
sqlYesRaw SQL statement. SELECT (must end with LIMIT) by default; non-SELECT requires confirmed: true, ALLOW_RAW_WRITES on the server, and a server that is not read-only
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.
confirmedNoExplicit user confirmation to allow a single non-SELECT (write/DDL) statement

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes far beyond the annotations by disclosing the read-only transaction, timeout default, mandatory LIMIT enforcement, single-statement restriction, blocked dangerous functions, 5000-row cap, and column redaction. It is consistent with readOnlyHint=true and destructiveHint=false. One caveat: the schema's sql/confirmed descriptions imply non-SELECT writes are possible, which conflicts with this description; however, the description itself is transparent and aligned with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average, but the length is justified for a raw SQL tool with safety implications. It is well-structured with clear sections. A small redundancy exists between the intro's list of complex query types and the 'When to use' bullets, but the overall organization makes it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex, no-output-schema tool, the description covers essentially everything an agent needs: what queries are allowed, safety constraints, timeouts, result caps, redaction, and where to route write operations. The absence of an output schema is mitigated by describing result limitations and redaction.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the description adds meaningful guidance beyond it: a complete SQL example, the mandatory LIMIT rule, and clarification that confirmed is currently informational. The database parameter is adequately covered by the schema, so no further description is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the specific verb ('Executes'), the resource ('raw SQL SELECT statement'), and the defining constraint ('mandatory LIMIT clause'). It also clearly frames the tool as an 'escape hatch' for queries that structured tools cannot express, distinguishing it from siblings like db_find_many and db_aggregate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'When to use' section explicitly lists complex JOINs, CTEs, window functions, subqueries, and custom aggregations. It also provides clear exclusions: write operations should use structured tools like db_create and db_update_many. This gives an agent concrete routing criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_schemaDatabase SchemaA
Read-onlyIdempotent

Returns the full database schema with column-level detail: every table's columns with their data types, nullability, defaults, constraints (primary key, unique, check), indexes, and foreign key relationships presented as a relationship diagram. This is introspected live from PostgreSQL's information_schema, so it always reflects the current state of the database.

When to use:

  • When you need column-level detail beyond what db_overview provides.

  • Before constructing queries with specific columns, to verify column names and types.

  • When the user asks about table structure, constraints, or relationships.

  • When debugging query errors related to column types or constraints.

Behavioral notes:

  • Schema is fetched fresh on every call (not cached) to catch DDL changes.

  • Only schemas listed in PG_SCHEMAS are included (default: public).

  • The relationship diagram shows foreign keys between tables, useful for JOIN queries.

Returns: JSON with tables (each containing columns with type, nullable, default, constraints), indexes, and a relationships array.

ParametersJSON Schema
NameRequiredDescriptionDefault
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, and the description adds non-redundant behavioral context: live introspection from information_schema, no caching to catch DDL changes, PG_SCHEMAS filtering with public default, and the relationship diagram's use for JOIN queries. No statement contradicts the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with a front-loaded summary, explicit use cases, behavioral notes, and a return-shape section. There is minor redundancy between 'introspected live from PostgreSQL's information_schema' and 'fetched fresh on every call (not cached)', and the Returns paragraph partly repeats the opening sentence, so it is not a perfect 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even with no output schema, the Returns paragraph specifies the JSON shape (tables with columns, type, nullable, default, constraints, indexes, relationships array). Behavioral notes cover freshness and schema scope, and the one optional parameter is fully described in the schema, so nothing essential is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single optional `database` parameter is fully documented in the input schema (100% coverage), so the baseline is 3. The description does not add parameter-specific details beyond the schema, which is acceptable given the schema already explains the parameter's meaning and default behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Returns the full database schema with column-level detail' and enumerates exact contents (columns, data types, nullability, defaults, constraints, indexes, foreign keys). It explicitly contrasts with db_overview ('beyond what db_overview provides'), making sibling differentiation clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a dedicated 'When to use' list with concrete triggers: needing column-level detail, verifying column names/types before constructing queries, answering structure/constraint/relationship questions, and debugging type/constraint errors. It names db_overview as the alternative and the condition that selects this tool, giving an agent clear routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_table_infoTable InformationA
Read-onlyIdempotent

Returns detailed information about a single table: exact row count (via COUNT(*)), all columns with their types and nullability, all indexes with their columns and uniqueness, foreign key relationships, and approximate table size on disk. Use this when you need specifics about one table that go beyond the overview.

When to use:

  • After db_overview, to drill into a specific table's details.

  • When the user asks "Tell me about the orders table" or "What indexes does users have?"

  • Before writing performance-sensitive queries, to understand available indexes.

  • When debugging issues related to a specific table.

Behavioral notes:

  • Row count is exact (uses COUNT(*)), which may be slow on very large tables.

  • The table name must exist in the database — a typo returns a clear error with suggestions from the schema.

  • Table size is approximate, based on pg_table_size().

Returns: JSON with row_count, columns array, indexes array, foreign_keys, and size_bytes.

ParametersJSON Schema
NameRequiredDescriptionDefault
tableYesName of the table to query
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, idempotent, and non-destructive behavior, and the description adds meaningful behavioral details beyond that: exact row count via COUNT(*) may be slow on large tables, typos produce clear errors with schema suggestions, and table size is approximate via pg_table_size(). This is exactly the kind of context an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a summary, 'When to use,' 'Behavioral notes,' and 'Returns' sections. Every sentence contributes concrete information, and the key purpose is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description compensates by listing the exact returned fields (row_count, columns, indexes, foreign_keys, size_bytes). It also covers use cases, performance caveats, error behavior, and parameter guidance, making it complete enough for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with descriptions for both parameters, so the baseline is 3. The description adds little parameter-specific detail, but it doesn't need to; 'single table' reinforces the required table parameter and the return summary implicitly clarifies what the operation yields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Returns detailed information about a single table' and enumerates exact contents (row count, columns, indexes, foreign keys, size). It also distinguishes this tool from list-like siblings by emphasizing 'single table' and 'go beyond the overview.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'When to use' bullets covering drill-down after db_overview, user questions, performance-sensitive query preparation, and debugging. It clearly explains the intended context, though it does not name a full set of alternatives or exclude cases where another sibling would be better.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_update_manyUpdate RowsA
DestructiveIdempotent

Updates all rows matching the given filter. Every column and value is validated against the live schema before execution. When the filter is empty ('{}'), ALL rows in the table would be updated — this requires confirmAll=true as a safety gate. A warning is issued when more than 10 rows are affected. Use dry_run=true to preview the update without actually writing.

When to use:

  • "Mark all pending orders as shipped"

  • "Update user 42's email to new@example.com"

  • "Set all products in category X as discontinued"

Parameter guidance:

  • table: the target table name (required)

  • where: JSON filter selecting rows to update (required). Example: {"status": "pending"} Use '{}' with confirmAll=true to update ALL rows (dangerous!).

  • data: JSON object of column-value pairs to set (required). Example: {"status": "shipped", "shipped_at": "2026-09-01"}

  • dry_run: set to true to preview without writing (default: false)

  • confirmAll: REQUIRED when where='{}' to confirm updating all rows

Behavioral notes:

  • A warning is emitted when more than 10 rows would be affected.

  • Empty filter with confirmAll=false returns an error requiring explicit confirmation.

  • The update runs in a transaction — all rows are updated atomically.

  • Returns the count of affected rows.

ParametersJSON Schema
NameRequiredDescriptionDefault
dataYesJSON object of column-value pairs to set
tableYesName of the table to query
whereYesJSON filter selecting rows to update
dryRunNoIf true, simulates without writing
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.
confirmAllNoRequired to update all rows when where is '{}'

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even with annotations already marking destructiveHint=true and readOnlyHint=false, the description goes well beyond: it explains live-schema validation, the empty-filter safety gate requiring confirmAll, the >10-row warning, atomic transaction behavior, dry_run previewing, and the affected-row count. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured into clear sections—overview, when to use, parameter guidance, and behavioral notes—and every sentence conveys necessary operational detail. For a dangerous data-mutating tool, the length is justified and well-organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description covers return value (affected row count), error behavior (empty filter without confirmAll), safety mechanisms, and transaction semantics. It gives an agent all the information needed to invoke the tool correctly, including the required safety flag for full-table updates.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds concrete examples for 'where' and 'data', clarifies the dangerous '{}' case, and explains when confirmAll is required. The only drawback is the parameter naming discrepancy: description says 'dry_run' while the schema defines 'dryRun', which could mislead an agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Updates all rows matching the given filter.' It clearly distinguishes itself from siblings like db_delete_many, db_find_many, and db_create. The title 'Update Rows' is expanded meaningfully by the first sentence and the safety-focused details.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'When to use' section gives concrete, realistic examples ('Mark all pending orders as shipped', 'Update user 42's email...') that make selection intent clear. However, it does not explicitly mention when NOT to use this tool or contrast it with alternatives like db_upsert or db_create, so it misses the top tier.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_upsertUpsert RowA
DestructiveIdempotent

Inserts a new row or updates an existing one using PostgreSQL's ON CONFLICT mechanism. The 'where' filter's columns must match a unique constraint or primary key on the table — this is how PostgreSQL determines whether to insert or update. If a matching row exists, only the columns specified in 'update' are changed. If no match exists, a new row is created with the values from 'create'. Use dry_run=true to preview.

When to use:

  • "Create this user if they don't exist, otherwise update their last_login"

  • "Upsert product SKU-123 with price $29.99"

  • Idempotent insert-or-update operations

Parameter guidance:

  • table: the target table name (required)

  • where: JSON filter identifying the conflict target (required). Columns must match a unique constraint or primary key. Example: {"email": "jane@example.com"}

  • create: JSON object of column-value pairs for the INSERT case (required)

  • update: JSON object of column-value pairs for the UPDATE case (optional). If omitted, no update occurs on conflict — the existing row is returned unchanged.

  • dry_run: set to true to validate without writing (default: false)

Behavioral notes:

  • The where columns MUST match a unique constraint or primary key — the tool validates this against the schema and returns an error if no matching constraint exists.

  • Returns the final row (either newly inserted or updated).

  • This is idempotent — calling it multiple times with the same data has the same effect as calling it once.

ParametersJSON Schema
NameRequiredDescriptionDefault
tableYesName of the table to query
whereYesJSON filter identifying the row, must match a unique constraint
createYesJSON object of column-value pairs to insert if not found
dryRunNoIf true, simulates without writing
updateNoJSON object of column-value pairs to set if found
databaseNoName of the database to query (from pgautopilot.json). Omit to use the current default database.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds substantial behavioral detail beyond the annotations: it explains the conflict-target constraint, the validation against schema constraints, the exact behavior when a match exists versus not, the return of the final row, and dry-run usage. This meaningfully informs an agent about side effects and safety.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with clear sections and front-loaded mechanics. It is somewhat lengthy and repeats the dry-run and ON CONFLICT concepts, but the extra detail is mostly purposeful and improves usability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating tool with no output schema, this description is complete: it defines required parameters, conflict resolution, optional update behavior, dry-run preview, validation failure, returned value, and idempotency. Nothing critical to calling the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds rich guidance for table, where, create, update, and dry_run, including examples and conflict semantics. However, it refers to 'dry_run' while the schema property is 'dryRun', a naming mismatch that could confuse an agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Inserts a new row or updates an existing one using PostgreSQL's ON CONFLICT mechanism.' This specific verb-plus-resource framing distinguishes it from sibling tools like db_create and db_update_many.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'When to use' section provides concrete examples and identifies idempotent insert-or-update operations as the target scenario. It does not explicitly state when not to use the tool or name alternatives, so it stops short of full exclusion guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

db_use_databaseSwitch Default DatabaseA
Read-onlyIdempotent

Switches the default database for subsequent tool calls. After switching, all tools that accept an optional 'database' parameter will use this database when the parameter is omitted. The target database must be listed in pgautopilot.json. This is an idempotent operation — calling it with the same database name has no effect.

When to use:

  • After calling db_list_databases, when the user wants to work with a specific database.

  • When switching between production and analytics databases mid-session.

Behavioral notes:

  • The target database is lazily connected on first use if not already connected.

  • If the target database is unreachable, the switch succeeds but subsequent tools will return a connection error with guidance.

  • This does NOT affect other MCP sessions or connections — only the current session.

Returns: confirmation with the new default database name and its connection details.

ParametersJSON Schema
NameRequiredDescriptionDefault
databaseYesName of the database to switch to as the default

TDQS

A3.9/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations declare readOnlyHint=true, but the description explicitly states the tool 'switches the default database' and affects subsequent tool calls—this is a session-state mutation, directly contradicting the read-only annotation. Because of this annotation contradiction, behavioral transparency must be scored 1 per rubric, despite the otherwise rich behavioral notes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with clear sections: main purpose, when to use, behavioral notes, and return value. Every sentence adds relevant information, and the most important behavior is front-loaded. No unnecessary repetition or filler exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers prerequisites (config listing), idempotency, lazy connection behavior, unreachable-database handling, session scoping, and return value. There is no output schema, but the return format is described. For a state-changing tool with one parameter, this is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'database' is fully described in the schema, and the description adds meaningful constraints and behavior: the target must be listed in pgautopilot.json, is lazily connected on first use, and that unreachable targets lead to connection errors later. This exceeds the baseline expected with 100% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Switches the default database for subsequent tool calls.' It clearly explains the scope and effect without ambiguity, and the tool is distinct from sibling tools like db_list_databases and db_table_info. This is a clear, actionable definition.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'When to use' section provides explicit contexts, such as after db_list_databases or when switching between production and analytics databases. It does not explicitly name alternatives or state when not to use the tool, but the usage context is sufficiently clear to guide tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_statusMCP Server StatusA
Read-onlyIdempotent

Reports whether the MCP server is ready to run database tools and which database it is connected to. Use this tool first if you suspect a configuration problem. When the server is not configured (e.g. DATABASE_URL is missing or invalid), this tool returns a detailed explanation of exactly what to fix, including the expected .env file location and connection string format. In multi-database mode, it lists every configured database with its connection status. This tool never modifies anything — it is purely informational.

When to use:

  • At the start of a session to verify the server is connected and healthy.

  • When any other tool returns a connection error, to diagnose the root cause.

  • When the user asks about the current server configuration or connected database.

Returns: a JSON object with 'status' (ready|not_configured), 'database' (connection summary), 'mode' (read-only or read-write), and 'readonly' flag. Errors include actionable guidance.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, and the description reinforces this by stating it 'never modifies anything' and is 'purely informational'. It also adds non-obvious behavior: returning actionable configuration fixes, handling multi-database mode, and disclosing exact return fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then uses a compact 'When to use' list and a concise return-value summary. Each section adds new information without redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter status tool with no output schema, the description fully covers invocation context, return shape, error behavior, and read-only guarantees. An agent has everything needed to select and interpret this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the input schema carries no burden and the baseline is 4. The description still adds value by naming the return fields status, database, mode, and readonly, which compensates for the lack of an output schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reports MCP server readiness, the connected database, and configuration mode. It explicitly frames this as server-level health/configuration status, which distinguishes it from database-specific siblings like db_health and db_overview.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit scenarios for when to use the tool: at session start, after connection errors, or when asked about server configuration. It does not explicitly say when not to use it or name alternative tools, so it stops just short of full exclusionary guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 18 tool updatesv0.1.0
    • First observeddb_aggregate
    • First observeddb_backup
    • First observeddb_count
    • First observeddb_create
    • First observeddb_delete_many
    • First observeddb_explain
    • First observeddb_find_first
    • First observeddb_find_many
    • First observeddb_health
    • First observeddb_list_databases
    • First observeddb_overview
    • First observeddb_raw_query
    • First observeddb_schema
    • First observeddb_table_info
    • First observeddb_update_many
    • First observeddb_upsert
    • First observeddb_use_database
    • First observedmcp_status

TDQS

A4.3/5.0

Scored across 18 tools

Disambiguation5/5

Every tool targets a distinct resource or action: introspective tools (schema, overview, table_info, health) are cleanly separated by granularity, read tools (find_many, find_first, count, aggregate) by return shape and purpose, and write tools (create, upsert, update_many, delete_many) by operation semantics. Even potentially adjacent tools like db_explain and db_raw_query are clearly differentiated. No two tools appear to do the same thing.

Naming Consistency4/5

The overwhelming majority of tools follow a consistent db_ verb_noun snake_case pattern (db_find_many, db_update_many, db_backup, db_upsert). The only exception is mcp_status, which breaks the prefix convention but is still readable and logically separate (server health vs. database operations).

Tool Count4/5

At 18 tools, this is on the heavier side but each tool serves a legitimate role in a comprehensive PostgreSQL access surface: discovery, monitoring, structured reads, analytics, raw SQL escape hatch, backup, and write operations. The count is justified by the breadth of the domain, though it slightly exceeds the ideal 3-15 sweet spot.

Completeness5/5

The tool set provides full CRUD coverage (create, read via find_many/find_first, update via update_many, delete via delete_many), plus upsert for idempotent writes. It also covers schema discovery, database switching, health monitoring, query explanation, aggregation, raw SQL escape hatch, and backups—no critical lifecycle dead ends. The intentional exclusion of DDL and raw write tools fits the read-safe design.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Postgres Pro is an open source Model Context Protocol (MCP) server built to support you and your AI agents throughout the entire development process—from initial coding, through testing and deployment, and to production tuning and maintenance.
    9
    3,286
    MIT
  • F
    license
    A
    quality
    D
    maintenance
    Enables AI assistants to interact with PostgreSQL databases using natural language queries, providing secure read-only access to database schemas and SQL translation capabilities.
    6
    12
    -
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to safely explore, analyze, and maintain PostgreSQL databases with read-only mode by default, SQL injection prevention, query performance analysis, and optional write operations.
    37
    Apache 2.0
  • A
    license
    Not graded
    quality
    Not graded
    maintenance
    Provides AI assistants with safe, controlled access to PostgreSQL databases with read-only defaults, granular permissions, query safety features, and schema introspection capabilities.
    1
    -