PostgreSQL

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-09-14T20:23:00.55789Z",
      "publishedAt": "2026-09-14T20:23:00.55789Z",
      "statusChangedAt": "2026-09-14T20:23:00.55789Z"
    }
  },
  "server": {
    "name": "io.github.antonorlov/mcp-postgres-server",
    "title": "PostgreSQL",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "version": "0.3.1",
    "packages": [
      {
        "version": "0.3.1",
        "transport": {
          "type": "stdio"
        },
        "identifier": "mcp-postgres-server",
        "runtimeHint": "npx",
        "registryType": "npm",
        "registryBaseUrl": "https://registry.npmjs.org",
        "environmentVariables": [
          {
            "name": "DATABASE_URL",
            "format": "string",
            "isSecret": true,
            "description": "Full connection string (preferred). Supports sslmode in the URL.",
            "placeholder": "postgres://user:password@localhost:5432/mydb?sslmode=require"
          },
          {
            "name": "PG_HOST",
            "format": "string",
            "description": "Database host (fallback when DATABASE_URL is not set)."
          },
          {
            "name": "PG_PORT",
            "format": "number",
            "default": "5432",
            "description": "Database port."
          },
          {
            "name": "PG_USER",
            "format": "string",
            "description": "Database user."
          },
          {
            "name": "PG_PASSWORD",
            "format": "string",
            "isSecret": true,
            "description": "Database password."
          },
          {
            "name": "PG_DATABASE",
            "format": "string",
            "description": "Database name."
          },
          {
            "name": "PG_ALLOW_WRITE",
            "format": "boolean",
            "choices": [
              "false",
              "true"
            ],
            "default": "false",
            "description": "When true, execute performs writes and reads are sent directly. Off (default) is read-only: execute refuses writes and each read runs in a READ ONLY transaction."
          },
          {
            "name": "PG_SSLMODE",
            "format": "string",
            "choices": [
              "disable",
              "allow",
              "prefer",
              "require",
              "verify-ca",
              "verify-full"
            ],
            "description": "TLS mode. require/allow/prefer encrypt without verifying the certificate; verify-ca/verify-full verify it (supply a CA via PG_SSL_CA). Unlike libpq, allow/prefer do not fall back to plaintext, so a server without TLS needs disable."
          },
          {
            "name": "PG_SSL_CA",
            "format": "filepath",
            "description": "Path to a CA certificate file. Setting it by itself implies verify-full."
          },
          {
            "name": "PG_ENABLE_RUNTIME_CONNECT",
            "format": "boolean",
            "choices": [
              "false",
              "true"
            ],
            "default": "false",
            "description": "Register the connect_db tool (runtime credential switching)."
          },
          {
            "name": "PG_MAX_RESULT_BYTES",
            "format": "number",
            "default": "32768",
            "description": "Byte budget for a query result sent to the model. Whole rows are kept while they fit; over the budget returnedRows < rowCount and truncated is true."
          },
          {
            "name": "PG_STATEMENT_TIMEOUT",
            "format": "number",
            "default": "30000",
            "description": "Statement timeout in milliseconds, applied to every session."
          },
          {
            "name": "PG_CONNECT_TIMEOUT",
            "format": "number",
            "default": "10000",
            "description": "Timeout in milliseconds for a single connect attempt (raise it for slow links or SSH tunnels)."
          },
          {
            "name": "PG_SSH_HOST",
            "format": "string",
            "description": "SSH bastion host. Setting it enables tunneling: the server reaches the database only through an SSH tunnel to this host. Needs the ssh2 optional dependency."
          },
          {
            "name": "PG_SSH_PORT",
            "format": "number",
            "default": "22",
            "description": "SSH bastion port."
          },
          {
            "name": "PG_SSH_USER",
            "format": "string",
            "description": "SSH username."
          },
          {
            "name": "PG_SSH_PRIVATE_KEY",
            "format": "filepath",
            "description": "Path to a private key file. If unset, auth falls back like ssh: a running agent (SSH_AUTH_SOCK), then a default key (~/.ssh/id_ed25519, id_rsa, id_ecdsa)."
          },
          {
            "name": "PG_SSH_PASSPHRASE",
            "format": "string",
            "isSecret": true,
            "description": "Passphrase for the private key, if encrypted."
          },
          {
            "name": "PG_SSH_AGENT",
            "format": "string",
            "description": "true to use the ambient agent (SSH_AUTH_SOCK), or an explicit socket path / Windows named pipe."
          },
          {
            "name": "PG_SSH_PASSWORD",
            "format": "string",
            "isSecret": true,
            "description": "SSH login password. Opt-in; a key or agent takes precedence. Prefer keys, a bastion often disables password auth."
          },
          {
            "name": "PG_SSH_FINGERPRINT",
            "format": "string",
            "description": "Pinned host-key fingerprint (SHA256:...). Host-key verification is mandatory and set only this way: without it the tunnel refuses to connect. Get it with ssh-keygen -lF host.",
            "placeholder": "SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
          },
          {
            "name": "PG_SSH_KEEPALIVE_INTERVAL",
            "format": "number",
            "default": "15000",
            "description": "SSH keepalive interval in ms; the tunnel drops after 3 unanswered keepalives, and the next call reconnects."
          }
        ]
      }
    ],
    "repository": {
      "url": "https://github.com/antonorlov/mcp-postgres-server",
      "source": "github"
    },
    "websiteUrl": "https://github.com/antonorlov/mcp-postgres-server#readme",
    "description": "MCP server for PostgreSQL: local, Docker, RDS, Neon, Supabase, or behind an SSH bastion."
  }
}