Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@SQL Insights MCP Server show me the top 10 customers by total order value this year"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Read-only Postgres access for AI agents over the Model Context Protocol, with a hard safety boundary between the model and the database.
Handing an agent a raw database connection answers the question "what were sales
last quarter" and also creates a way to DELETE FROM customers, hang the server
with a runaway query, or pull a million rows into the model's context. This
server exposes three narrow tools instead, and validates every statement before
it reaches Postgres.
Under construction, built in order:
Guard layer + adversarial test suite (no database required)
Execution layer: pool, read-only transaction, timeout, truncation
Schema cache: TTL-refreshed table and column metadata
MCP surface: list_tables, describe_table, run_query
Seed script and demo dataset
PyPI packaging
Hosted demo over HTTP
Related MCP server: pg-mcp
src/sql_insights/guard.py is a pure function: SQL string in, verdict out. No
I/O, no database, no environment. It parses with sqlglot into an abstract
syntax tree rather than pattern-matching on text, because text-level checks lose
to anyone who knows how to hide a semicolon.
Check | Rule |
Statement count | Exactly one statement per call |
Statement type | Root must be a SELECT or a set operation |
Nested writes | No INSERT/UPDATE/DELETE/DDL anywhere in the tree, including inside CTEs |
Banned functions | No |
System catalogs |
|
Table allowlist | Every referenced table must be listed, when an allowlist is configured |
Row limit |
|
Comments | Stripped before the SQL is re-emitted |
This is the first of three independent defenses, and it is not trusted alone.
A single defense is a single point of failure, so there are three, and each one alone is sufficient:
The guard rejects the statement before it is sent.
The pool opens every connection with default_transaction_read_only = on
and wraps every query in an explicit BEGIN READ ONLY transaction.
The database role holds SELECT grants and nothing else, so a write that
somehow reached Postgres is refused by Postgres.
tests/test_execution.py asserts layer 3 directly, by sending writes straight
down the pool with the guard bypassed. They fail at the database, as they must.
Start a disposable Postgres (published on 5433, so it will not collide with any Postgres already on the host):
docker compose up -dThe container provisions readonly_user on first start. Then:
uv sync --group dev
uv run pytest -qThe database-backed tests skip cleanly if no Postgres is reachable, so the guard suite still runs on a machine without Docker.
Variable | Required | Default | Meaning |
| yes | - | Connection string for a read-only role |
| no |
| Per-query |
| no |
| Row cap enforced by the guard |
| no | all | Comma-separated allowlist |
| no |
|
|
| no |
| Schema cache refresh interval |
The connection string is read from the environment at startup and is never a tool parameter, so the model cannot see it, change it, or be talked into pointing the server somewhere else. Passwords are redacted from every log line.
MIT
This server cannot be deployed
Safe, read-only Postgres and MySQL access for AI agents. Audit log + column-level controls.
Deterministic safety, correctness & cost gate that vets Postgres SQL before your AI agent runs it.
Query PostgreSQL databases in plain English — LLM-generated, safety-validated SQL.
Query your Postgres from ChatGPT or Claude without exposing the database or handing over credentials. Run npx boltschema connect next to your database and it dials out over HTTPS — no inbound firewall rule, no open port, works with localhost and VPC-private databases. Read-only is enforced by a SQL guard, a Postgres READ ONLY transaction, and a scoped role generated for you.
