PostgreSQL MCP servers, compared
Every PostgreSQL MCP server runs SQL for an agent; the differences are about blast radius. Some are read-only by design, some gate writes behind a flag or a role, and some expose full DDL. Authentication ranges from a connection string in an environment variable to OAuth in front of a hosted endpoint. This page compares the servers MCP Toplist has checked for this task on exactly those controls.
How the 11 servers below were chosen
- The server's documented purpose is querying or administering PostgreSQL (general multi-database servers are included when PostgreSQL is a first-class target).
- It has a public repository or published documentation that states its tools, access mode and configuration.
- MCP Toplist has read that documentation and written a profile with sources and a check date.
- Ordered by the composite ranking, which measures popularity and activity, not quality — read the cells, not the order.
Cells say what each server's own documentation says; “Not documented” means the docs are silent, not that the feature is absent. Profiles were checked between Oct 9, 2026 and Oct 9, 2026; ranks are as of across 144,396 active servers.
| Server | Access mode | Authentication | Query controls | Deployment | Beyond queries | Requirements |
|---|---|---|---|---|---|---|
| dbx #29t8y2No credentials | read_only, safe_write or high_risk_write set in DBX Settings; default not documented | Connections and credentials from the DBX app; none in client config | Access mode and connection allowlist; timeouts and row limits not documented | Local command via npx or native binary; Web/Docker backend via DBX_WEB_URL | 100+ database engines; opens tables in the DBX UI | DBX app with configured connections; Node.js or native binary |
| Prisma MCP Server #35prismaAPI key | Read/write SQL and schema updates; no read-only mode documented | Prisma account sign-in with workspace selection | Not documented beyond approving each operation in your AI tool | Hosted remote at mcp.prisma.io/mcp (Streamable HTTP) | Backups and recovery, Object Storage, Compute deployments, docs search | Prisma account and workspace; no runtime |
| Supabase MCP Server #58supabaseNo credentials | Read/write; read_only=true runs queries as a read-only Postgres user | OAuth sign-in to Supabase; scoped PAT as Bearer header for CI | project_ref scoping, feature groups, read-only user, elicitation confirmations | Hosted remote at mcp.supabase.com; local CLI endpoint with fewer tools | Migrations, logs, advisors, Edge Functions, branching, project management | Supabase account; no runtime; paid plan for branching |
| DBHub #63bytebaseNo credentials | Read/write; readonly = true per execute_sql in TOML; Bundle and plugin read-only | DSN flag/env var or DB_* vars; optional bearer tokens over HTTP | Statement allow-list plus READ ONLY transaction, max_rows, SSH/SSL | stdio (default) or HTTP :8080; npx or bytebase/dbhub Docker image | explain_sql, health_check, custom SQL tools, multi-database TOML | Node.js 22.5+ or Docker; database DSN |
| Postgres MCP #724crystaldbaAPI key | Restricted (read-only) or unrestricted via --access-mode; default not documented | Postgres URI in DATABASE_URI env var | Restricted mode: read-only transactions plus execution-time limit; explain_query | Local stdio or SSE on :8000; Docker image or pipx/uvx | Health checks, index tuning with hypopg, top queries | Docker or Python 3.12+; DB credentials; pg_stat_statements/hypopg for tuning |
| Neon #1,277neondatabaseNo credentials | Read/write; readonly=true or read-only OAuth scope disables write tools | OAuth sign-in to Neon, or Neon API key as Bearer header | readonly, projectId and category URL parameters; migrations prepared on a temporary branch | Hosted remote at mcp.neon.tech/mcp; local stdio package deprecated | Branches, migrations, slow-query tuning, Neon Auth, Data API, logs | Neon account; no runtime; paid plan not stated |
| PostgreSQL #1,944modelcontextprotocolNo credentials | Read-only only (READ ONLY transactions) | Connection URL as a command-line argument | Read-only transaction; nothing else documented | Local stdio via npx or mcp/postgres Docker image | Table schema resources; archived and unmaintained | Node.js (npx) or Docker; database URL |
| MCP-PostgreSQL-Ops #2,244call518API key | Read-only only; no SQL execution tool | POSTGRES_* env vars; optional Bearer token for HTTP mode | Predefined queries only; per-tool limit parameters | stdio (default) or streamable-http :8000; uvx, pip, docker-compose | Vacuum, bloat, locks, WAL, replication, I/O stats, multi-database | Python 3.12; catalog-read role; extensions optional |
| PostgreSQL Database Management Server #10,284henkdzAPI key | Readonly by default; write, admin, unsafe via --security-mode | POSTGRES_CONNECTION_STRING env var or --connection-string | Mode tiers, --allow-destructive, 100-row default limit, statement timeout, target allowlist, audit log | Local command via npx, Docker image henkey/postgres-mcp, Smithery | Index tuning, EXPLAIN, monitoring, RLS, import/export, cross-database copy | Node.js 18+ or Docker; connection string |
| Simple PostgreSQL MCP Server #32,091perrypixelAPI key | write or readonly argument at launch; README labels write the default | Connection string as a command-line argument | Server-wide readonly mode only | Local Node process built from source | None documented beyond SQL | Node.js and npm; connection string |
| MCP PostgreSQL Server #46,916antonorlovNo credentials | Read-only by default; writes via PG_ALLOW_WRITE=true | DATABASE_URL or PG_* env vars; SSL and SSH tunnel options | READ ONLY transactions, one statement per call, statement timeout, result byte cap | Local stdio via npx; no server Docker image documented | Runtime connect_db when enabled; no health or tuning tools | Node.js 20+; connection string; least-privilege role |
- Access mode
- Read-only, read/write, or configurable — and what is the default?
- Authentication
- Connection string, env vars, OAuth, or a hosted account?
- Query controls
- Statement allowlists, restricted mode, timeouts, EXPLAIN-only, schema scoping?
- Deployment
- Local stdio, Docker image, or hosted remote?
- Beyond queries
- Health checks, index tuning, migrations, multi-database?
- Requirements
- Runtime, credentials, paid plan?
- Pointing an agent at production? Choose a read-only default and a server that documents its restricted mode; set a read-only database role as well.
- Need migrations or writes? Prefer servers that gate writes behind an explicit flag so the safe mode is the one you forget to change.
- Using a managed Postgres (Supabase, Neon, RDS)? The vendor's own server usually adds project and branch management on top of SQL.
- Many of these servers can be launched with npx or uvx; a Docker image is the safer choice on shared machines.
Each server in detail
- dbx →
DBX is a Rust-based database manager (desktop, web/Docker and CLI) for 100+ engines including PostgreSQL; its separate MCP server lets coding agents list connections, browse tables and run SQL through the connections already configured in DBX.
- Prisma MCP Server →
Prisma's hosted MCP server lets an agent manage Prisma Postgres databases, run SQL and schema updates, restore backups, manage Object Storage buckets and Prisma Compute deployments, and search the Prisma docs inside your Prisma workspace.
- Supabase MCP Server →
Supabase's hosted MCP server connects an agent to your Supabase projects so it can query and migrate the Postgres database, read logs and advisors, deploy Edge Functions, manage branches and projects, and search the Supabase docs.
- DBHub →
DBHub is a zero-dependency MCP gateway from Bytebase that connects agents to PostgreSQL, MySQL, MariaDB, SQL Server, Oracle and SQLite, with read-only mode, row limits and SSH/SSL access as guardrails.
- Postgres MCP →
Postgres MCP Pro gives an agent database health checks, index tuning, EXPLAIN-based query analysis and access-controlled SQL execution against one PostgreSQL database, covering development through production tuning.
- Neon →
Neon's hosted MCP server translates natural-language requests into Neon API calls so an agent can manage projects, branches and compute endpoints, run SQL, perform guarded migrations and tune queries on Neon Postgres.
- PostgreSQL →
The original reference PostgreSQL server from the Model Context Protocol project: a single read-only query tool plus per-table schema resources. It now lives in the servers-archived repository and is no longer maintained.
- MCP-PostgreSQL-Ops →
MCP-PostgreSQL-Ops exposes 37 predefined, read-only diagnostic tools for PostgreSQL operations and monitoring: connections, configuration, sizes, bloat, vacuum, locks, WAL, replication, I/O and (with extensions) top queries.
- PostgreSQL Database Management Server →
A PostgreSQL management server (@henkey/postgres-mcp-server) that consolidates 46 operations into 18 tools for schema, users, performance, indexes, functions, triggers, RLS, data import/export and SQL, with a tiered readonly/write/admin/unsafe security model.
- Simple PostgreSQL MCP Server →
A minimal Node.js MCP server that runs SQL against one PostgreSQL database, with a single server-wide mode argument choosing between write and read-only access.
- MCP PostgreSQL Server →
A small Node.js MCP server (mcp-postgres-server) for querying PostgreSQL, read-only by default with writes opt-in via an environment flag, and with SSL, SSH tunnelling, timeouts and a result-size cap built in.