pg-cve-mcp — PostgreSQL CVE & Release Intelligence MCP Server

Query CVEs, yanked releases, known exploits, and upgrade paths for any PostgreSQL version directly from your AI assistant.

Quick Start

pip install pg-cve-mcp
pg-cve-mcp

Or with npx (no install):

npx -y pg-cve-mcp

Related MCP server: MCP PostgreSQL Operations

MCP Tools

Remote (Hosted) Server

A remote deployment is available at:

https://pgcve-mcp-production.up.railway.app/mcp

This uses the Streamable HTTP transport. Configure any MCP client with this URL, for example in opencode.json:

{
  "mcp": {
    "pg-cve-mcp": {
      "type": "remote",
      "url": "https://pgcve-mcp-production.up.railway.app/mcp"
    }
  }
}

Local stdio fallback

To run the server locally in stdio mode (for clients that only support stdio):

pip install -e .
pg-cve-mcp

Configuration

Development

Run the Streamable HTTP server locally:

python run_server.py
# Server listens on http://127.0.0.1:8000/mcp

Run tests:

python -m pytest

Data Source

Data is fetched from the PG_CVE project's GitHub Pages with local caching. Falls back to a bundled copy if the network is unavailable.

Example Prompts

"What CVEs affect PostgreSQL 16.4?"

"Is PostgreSQL 15.8 safe to use?"

"Compare CVEs in 16.3 vs 16.4"

"What's the upgrade path from PostgreSQL 14.10?"

License

Apache 2.0