Read-only PostgreSQL over MCP. Writes refused at the parsed SQL, plus a READ ONLY transaction.
Connect Runs on your machine
claude mcp add postgres-mcp-hardened -e DATABASE_URL=<DATABASE_URL> -e MCP_STATEMENT_TIMEOUT=<MCP_STATEMENT_TIMEOUT> -e MCP_ALLOW_TABLES=<MCP_ALLOW_TABLES> -e MCP_AUDIT_LOG=<MCP_AUDIT_LOG> -- npx -y [email protected]{
"mcpServers": {
"postgres-mcp-hardened": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"DATABASE_URL": "<DATABASE_URL>",
"MCP_STATEMENT_TIMEOUT": "<MCP_STATEMENT_TIMEOUT>",
"MCP_ALLOW_TABLES": "<MCP_ALLOW_TABLES>",
"MCP_AUDIT_LOG": "<MCP_AUDIT_LOG>"
}
}
}
}{
"mcpServers": {
"postgres-mcp-hardened": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"DATABASE_URL": "<DATABASE_URL>",
"MCP_STATEMENT_TIMEOUT": "<MCP_STATEMENT_TIMEOUT>",
"MCP_ALLOW_TABLES": "<MCP_ALLOW_TABLES>",
"MCP_AUDIT_LOG": "<MCP_AUDIT_LOG>"
}
}
}
}{
"servers": {
"postgres-mcp-hardened": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"DATABASE_URL": "<DATABASE_URL>",
"MCP_STATEMENT_TIMEOUT": "<MCP_STATEMENT_TIMEOUT>",
"MCP_ALLOW_TABLES": "<MCP_ALLOW_TABLES>",
"MCP_AUDIT_LOG": "<MCP_AUDIT_LOG>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
DATABASE_URLRequired, secret | Connection string for the role the server connects as. Use a role that cannot write — the server refuses writes twice, but a read-only role is the layer that does not depend on us being correct. `--print-setup-sql` prints the SQL that creates one. |
MCP_STATEMENT_TIMEOUTOptional | Server-side statement timeout, e.g. `5s`. A question that would pin the database is cancelled by PostgreSQL, not by hope. |
MCP_ALLOW_TABLESOptional | Comma-separated allowlist. A table off the list is refused by name, and hiding it inside a CTE, a view or a join does not help. |
MCP_AUDIT_LOGOptional | Path to the tamper-evident audit log. Entries are chained by hash and survive a restart; `--verify-audit` checks the chain against an off-host anchor. |
Details
| Package | [email protected] (NPM, stdio) |
| Package | ghcr.io/eszetael/postgres-mcp-hardened:0.1.10 (OCI, streamable-http) |
| First published | 4 Sep 2026 |
| Last updated | 4 Sep 2026 |
| Registry name | io.github.Eszetael/postgres-mcp-hardened |
More databases servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.