This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
Read-only Postgres access for AI agents over the Model Context Protocol, with a hard safety boundary between the model and the database.
Handing an agent a raw database connection answers the question "what were sales
last quarter" and also creates a way to DELETE FROM customers, hang the server
with a runaway query, or pull a million rows into the model's context. This
server exposes three narrow tools instead, and validates every statement before
it reaches Postgres.
Under construction, built in order:
Guard layer + adversarial test suite (no database required)
Execution layer: pool, read-only transaction, timeout, truncation
Schema cache: TTL-refreshed table and column metadata
MCP surface: list_tables, describe_table, run_query
Seed script and demo dataset
PyPI packaging
Hosted demo over HTTP
Related MCP server: db-readonly-mcp
src/sql_insights/guard.py is a pure function: SQL string in, verdict out. No
I/O, no database, no environment. It parses with sqlglot into an abstract
syntax tree rather than pattern-matching on text, because text-level checks lose
to anyone who knows how to hide a semicolon.
Check | Rule |
Statement count | Exactly one statement per call |
Statement type | Root must be a SELECT or a set operation |
Nested writes | No INSERT/UPDATE/DELETE/DDL anywhere in the tree, including inside CTEs |
Banned functions | No |
System catalogs |
|
Table allowlist | Every referenced table must be listed, when an allowlist is configured |
Row limit |
|
Comments | Stripped before the SQL is re-emitted |
This is the first of three independent defenses, and it is not trusted alone.
A single defense is a single point of failure, so there are three, and each one alone is sufficient:
The guard rejects the statement before it is sent.
The pool opens every connection with default_transaction_read_only = on
and wraps every query in an explicit BEGIN READ ONLY transaction.
The database role holds SELECT grants and nothing else, so a write that
somehow reached Postgres is refused by Postgres.
tests/test_execution.py asserts layer 3 directly, by sending writes straight
down the pool with the guard bypassed. They fail at the database, as they must.
Start a disposable Postgres (published on 5433, so it will not collide with any Postgres already on the host):
docker compose up -dThe container provisions readonly_user on first start. Then:
uv sync --group dev
uv run pytest -qThe database-backed tests skip cleanly if no Postgres is reachable, so the guard suite still runs on a machine without Docker.
Variable | Required | Default | Meaning |
| yes | - | Connection string for a read-only role |
| no |
| Per-query |
| no |
| Row cap enforced by the guard |
| no | all | Comma-separated allowlist |
| no |
|
|
| no |
| Schema cache refresh interval |
The connection string is read from the environment at startup and is never a tool parameter, so the model cannot see it, change it, or be talked into pointing the server somewhere else. Passwords are redacted from every log line.
MIT
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
This server cannot be deployed
Safe, read-only Postgres and MySQL access for AI agents. Audit log + column-level controls.
Deterministic safety, correctness & cost gate that vets Postgres SQL before your AI agent runs it.
PostgreSQL, MySQL, and SQL Server in one session. 26 read-only MCP tools for AI agents.
Query PostgreSQL databases in plain English — LLM-generated, safety-validated SQL.
