PostgreSQL Guard MCP Server
PostgreSQL database access for AI agents with statement analysis and PII masking.
Data last scanned today · Reviewed today
Overview
This MCP server provides a security layer between AI agents and PostgreSQL databases by moving beyond simple regex filtering. It utilizes a dedicated PostgreSQL parser to structurally analyze every SQL statement before execution, ensuring that queries are classified correctly and multi-statement injections are blocked.
Our verdict
With a security score of 22/100, this tool is categorized as high risk and should be used with caution in sensitive production environments. The score reflects its status as an unreviewed, community-maintained project with no formal license or vetting. Given the critical nature of database access, users should carefully monitor the single-contributor development and limited community validation before deployment.
- Uses a structural PostgreSQL parser for statement analysis
- Supports masking of sensitive columns in query results
- Implements an append-only audit trail for queries
- Requires human approval for write operations
- High risk score of 22/100 indicates significant oversight needs
- Lacks an official open-source license
- Limited contributor base introduces single-point-of-failure risk
Setup
{
"mcpServers": {
"mcp-postgres-guard": {
"args": [
"-y",
"mcp-postgres-guard"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| list_tables | Tables readable under the policy, with row estimates | low |
| describe_table | Columns, types, nullability, defaults; masked columns marked | low |
| query | A single SELECT, read-only transaction, row-limited | low |
| execute | A single INSERT/UPDATE/DELETE, dry-run then human approval | high |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›Does the server require specific database-level permissions?
The server uses a provided DATABASE_URL and is designed to function with a read-only PostgreSQL role for queries, with additional write privileges only required if mutations are enabled.
›How are blocked or denied queries handled?
Denied calls are logged in the audit trail as JSONL records, and the server returns a specific reason to the agent to prevent them from repeatedly attempting the same invalid query.
›How does the server protect against unauthorized writes?
All mutations are first executed within a transaction that is always rolled back to measure the number of affected rows, after which the server requires human approval via MCP elicitation before performing the actual write.
›Can I hide sensitive data while still allowing agents to query it?
Yes, you can configure MASKED_COLUMNS to redact specific fields in the result set, allowing the agent to know the column exists and filter on it without seeing the underlying values.
›What happens if my MCP client does not support human approval prompts?
If the client does not support the required elicitation for write approvals, the server will automatically decline the mutation.
›How does the server prevent agents from executing multiple chained statements?
The server uses a real PostgreSQL parser to ensure every call consists of a single statement and will refuse to execute if it detects stacked or multiple statements.
Alternatives
Badge
Maintain this server? Add the live badge to your README.