# PostgreSQL (hardened, read-only) MCP server

Read-only PostgreSQL over MCP. Writes refused at the parsed SQL, plus a READ ONLY transaction.

## At a glance

PostgreSQL (hardened, read-only) is an MCP server in the Databases & Storage category. It runs locally over stdio via `npx -y postgres-mcp-hardened`, and needs DATABASE_URL. It exposes 7 tools, including explain_query, database_health and analyze_indexes. It scores A (87/100) on the MCP Skills Hub health score as of Oct 28, 2026.

## Install

### How to install PostgreSQL (hardened, read-only) in Claude Code

1. Add the server

```bash
claude mcp add postgres-mcp-hardened -e 'DATABASE_URL=<DATABASE_URL>' -- npx -y postgres-mcp-hardened
```

2. Fill in your credentials

   Replace <DATABASE_URL> with your real value. Keep secrets out of any config file you commit.

3. Verify it's connected

```bash
claude mcp list
```

4. Sharing it with your team?

   Add `--scope project` to write it to .mcp.json in the repository root, which you can commit (with the secrets left as environment variables).

5. Use it in a session

   Ask Claude to use the tools this server exposes (e.g. explain_query, database_health, analyze_indexes). It discovers them automatically.

### How to install PostgreSQL (hardened, read-only) in Claude Desktop

1. Open your MCP config

   macOS: ~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json

2. Add this server

```json
{
  "mcpServers": {
    "postgres-mcp-hardened": {
      "command": "npx",
      "args": [
        "-y",
        "postgres-mcp-hardened"
      ],
      "env": {
        "DATABASE_URL": "<DATABASE_URL>"
      }
    }
  }
}
```

3. Fill in your credentials

   Replace <DATABASE_URL> with your real value. Keep secrets out of any config file you commit.

4. Restart Claude Desktop

   The tools appear under the 🔌 menu once the app reloads.

### How to install PostgreSQL (hardened, read-only) in Cursor

1. Create / edit .cursor/mcp.json in your project

```json
{
  "mcpServers": {
    "postgres-mcp-hardened": {
      "command": "npx",
      "args": [
        "-y",
        "postgres-mcp-hardened"
      ],
      "env": {
        "DATABASE_URL": "<DATABASE_URL>"
      }
    }
  }
}
```

2. Fill in your credentials

   Replace <DATABASE_URL> with your real value. Keep secrets out of any config file you commit.

3. Enable it

   Cursor Settings → MCP → toggle the server on. Tools become available to the Composer/Agent.

### How to install PostgreSQL (hardened, read-only) in Codex CLI

1. Add to ~/.codex/config.toml

```toml
[mcp_servers.postgres-mcp-hardened]
command = "npx"
args = ["-y", "postgres-mcp-hardened"]
env = { DATABASE_URL = "<DATABASE_URL>" }
```

2. Fill in your credentials

   Replace <DATABASE_URL> with your real value. Keep secrets out of any config file you commit.

3. Run Codex

   Codex loads MCP servers from config.toml on startup and exposes their tools to the agent.

### How to install PostgreSQL (hardened, read-only) in Windsurf

1. Edit ~/.codeium/windsurf/mcp_config.json

```json
{
  "mcpServers": {
    "postgres-mcp-hardened": {
      "command": "npx",
      "args": [
        "-y",
        "postgres-mcp-hardened"
      ],
      "env": {
        "DATABASE_URL": "<DATABASE_URL>"
      }
    }
  }
}
```

2. Fill in your credentials

   Replace <DATABASE_URL> with your real value. Keep secrets out of any config file you commit.

3. Reload

   Windsurf → Cascade → refresh MCP servers. Cascade can now call the tools.

### How to install PostgreSQL (hardened, read-only) in Cline

1. Open Cline → MCP Servers → Configure

   Adds to cline_mcp_settings.json.

2. Add the server

```json
{
  "mcpServers": {
    "postgres-mcp-hardened": {
      "command": "npx",
      "args": [
        "-y",
        "postgres-mcp-hardened"
      ],
      "env": {
        "DATABASE_URL": "<DATABASE_URL>"
      }
    }
  }
}
```

3. Fill in your credentials

   Replace <DATABASE_URL> with your real value. Keep secrets out of any config file you commit.

### How to install PostgreSQL (hardened, read-only) in VS Code

1. Create .vscode/mcp.json

```json
{
  "servers": {
    "postgres-mcp-hardened": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "postgres-mcp-hardened"
      ],
      "env": {
        "DATABASE_URL": "<DATABASE_URL>"
      }
    }
  }
}
```

2. Fill in your credentials

   Replace <DATABASE_URL> with your real value. Keep secrets out of any config file you commit.

3. Start it

   VS Code shows a ▶ Start action above the server entry. Agent mode (Copilot Chat) can then use the tools.

## Tools

- `explain_query` — the execution plan; with `analyze` it runs the statement and reports real
- `database_health` — cache hit ratio, connections (this database and the cluster), the longest
- `analyze_indexes` — unused indexes, duplicates, and tables scanned sequentially often enough
- `top_queries` — the heaviest statements, from `pg_stat_statements`.
- `security_posture` — what this deployment is actually able to do to your database, asked of
- `query` — run a read-only SQL query (validated, auto-`LIMIT`, cost-guarded). The response
- `list_schemas` — , `list_tables`, `describe_table` — progressive schema discovery

Source repository: https://github.com/Eszetael/postgres-mcp-hardened

---

Source: https://mcp-skills-hub.vercel.app/mcps/io-github-eszetael-postgres-mcp-hardened · MCP Skills Hub · data as of 2026-10-28T12:31:05Z