postgres-mcp

What it is

The reference-quality Postgres MCP server: schema introspection, EXPLAIN plan analysis, index-tuning recommendations, and a battery of database-health checks (bloat, vacuum and wraparound, replication lag, buffer hit rates).

How it was vetted

Cloned at commit 07eb329 (2026-01-22), installed via uvx, booted, and read end to end. The trust question for a database tool is one thing. Can the agent write when you told it not to? So the audit centered there.

• Two enforcement layers, independent. In restricted mode the SafeSqlDriver parses each statement’s AST with pglast and rejects anything that isn’t a read. Separately, _execute_with_connection opens BEGIN TRANSACTION READ ONLY before running it. Either layer alone would stop a write; both have to fail.
• The project’s own tests confirm it. test_readonly_enforcement.py, test_safe_sql.py, and test_access_mode.py, 66 cases total, all pass.
• The default is not the safe one. Without --access-mode restricted, the tool registers execute_sql with a destructiveHint and runs arbitrary SQL. This is documented, but it’s the opposite of safe by default, so the install line above pins the restricted flag.
• One opt-in network path. analyze_workload_indexes(method="llm") builds an OpenAI() client on your own key. The default is dta (algorithmic, offline). No analytics, telemetry, or other outbound calls anywhere in the source.