Verified

PostgreSQL MCP Server (Yaw Labs)

Query PostgreSQL databases with index advisors and read-only defaults.

Data last scanned today · Reviewed today

48 1 dangerous tool23 tools★ 5TypeScriptMIT

Overview

This TypeScript-based MCP server enables LLM integration with PostgreSQL databases. It focuses on diagnostic and analysis tools, offering schema introspection, EXPLAIN plan generation, and health checks to assist in database management directly from your AI interface. The server defaults to read-only operation to protect data integrity, with an optional audit logging feature that tracks statements via JSON output. Recent updates include an index advisor that uses HypoPG for hypothetical indexing and support for both legacy and current MCP protocol revisions.

Our verdict

This project holds a high-risk security score of 38/100. The rating is driven by the fact that its read-only mode support and authentication methods have not yet undergone editorial review. While the server aims to protect data through opt-in write modes, users should approach this with caution in production environments until these critical security mechanisms are validated.

Supports zero direct dependencies to reduce supply-chain surface area.
Includes a specialized index advisor using HypoPG for cost estimation.
Provides structured tool output alongside legacy text support.
Maintains an active development cycle with recent commits.

Security score of 38/100 indicates significant unreviewed risk areas.
Authentication and read-only implementation lack independent editorial verification.
Community-maintained status lacks the backing of official vendor support.

Setup

Claude Desktop

{
  "mcpServers": {
    "yawlabs-postgres-mcp": {
      "args": [
        "-y",
        "@yawlabs/postgres-mcp"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
pg_readonly	Run a SQL statement with no persistent data changes - always inside BEGIN READ ONLY, regardless of ALLOW_WRITES.	low
pg_query	Run a SQL query.	medium
pg_list_schemas	List non-system schemas.	low
pg_list_tables	List tables (and optionally views) in a schema with estimated row counts.	low
pg_describe_table	Kind, columns, PK, outgoing FKs, incoming FKs, CHECK / UNIQUE / EXCLUDE constraints, indexes, and partition parent/children for a relation.	low
pg_list_views	List views and materialized views in a schema, including their SQL definitions.	low
pg_list_functions	List functions, procedures, and aggregates in a schema with signatures and return types.	low
pg_list_extensions	List installed extensions with versions.	low
pg_search_columns	Find columns by name pattern across all user schemas.	low
pg_explain	EXPLAIN or EXPLAIN ANALYZE for a SQL statement.	low

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›Is write access enabled by default?

No, the server is read-only by default to prevent unintended data modifications. You must explicitly set the ALLOW_WRITES environment variable to 1 to enable write operations.

›How does the server protect against stacked-query SQL injection?

The server uses the PostgreSQL extended query protocol for all user SQL, which restricts each request to a single statement and prevents the execution of multi-statement strings like COMMIT or DROP commands.

›What is the recommended way to manage database permissions?

The recommended security posture is to connect using a database role with least-privileged access, such as one granted the pg_read_all_data role, allowing PostgreSQL to enforce access boundaries directly.

›Does the index advisor make permanent changes to my database?

No, the pg_index_advisor tool uses HypoPG to evaluate hypothetical indexes. These candidates are never created on disk and are only used to estimate performance costs.

›What are the environment requirements for running this server?

The server requires Node 22 or higher to run.

›Does the audit logging feature record parameter values?

No, audit logging records executed statements but never records the bound parameter values.