PostgreSQL
mcpkey · packageMCP server for PostgreSQL: local, Docker, RDS, Neon, Supabase, or behind an SSH bastion.
run it
on your own machines, one way per deploy method# once, as root:
# as_mcp DIR COMMAND...: runs COMMAND as the mcp user in DIR, its home, sandboxed as the
# units are: a package's install scripts can write to DIR only, as the server later can
as_mcp() {
local dir="$1"; shift
systemd-run --quiet --wait --pipe --collect --uid=mcp --gid=mcp \
-p WorkingDirectory="$dir" -p Environment=HOME="$dir" -p ReadWritePaths="$dir" \
-p NoNewPrivileges=true -p ProtectSystem=strict -p ProtectHome=true -p PrivateTmp=true \
-- "$@" </dev/null
}
install -d -m 0750 -o mcp -g mcp /var/lib/mcp/postgres-server
# postgres-server: its packages, installed whole before its unit starts (no session installs)
# npx takes a half-installed tree for installed: a rerun starts them afresh
systemctl stop mcp-my-agent-postgres-server.service 2>/dev/null || true
as_mcp /var/lib/mcp/postgres-server rm -rf /var/lib/mcp/postgres-server/.npm/_npx
as_mcp /var/lib/mcp/postgres-server npx --yes [email protected] -- true
as_mcp /var/lib/mcp/postgres-server npx --yes --package=supergateway@4 -- true
#!/usr/bin/env bash
# postgres-server (io.github.antonorlov/mcp-postgres-server), recipe baremetal (generated).
# Generated by Hub for toolset "my-agent"; started by mcp-my-agent-postgres-server.service.
set -euo pipefail
export HOST=127.0.0.1 PORT=8101
exec npx -y supergateway@4 --stdio 'npx -y [email protected]' --outputTransport streamableHttp --stateful --host 127.0.0.1 --port 8101 --streamableHttpPath /mcp --healthEndpoint /healthz
[Unit]
Description=MCP server postgres-server (toolset my-agent), generated by Hub
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
User=mcp
Group=mcp
EnvironmentFile=/etc/mcp/my-agent.env
Environment=HOME=/var/lib/mcp/postgres-server
WorkingDirectory=/var/lib/mcp/postgres-server
ExecStart=/opt/mcp/my-agent/bin/postgres-server.sh
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/mcp/postgres-server
[Install]
WantedBy=multi-user.target
docker run --rm -p 127.0.0.1:8101:8000 -e DATABASE_URL -e PG_HOST -e PG_PORT -e PG_USER -e PG_PASSWORD -e PG_DATABASE -e PG_ALLOW_WRITE -e PG_SSLMODE -e PG_SSL_CA -e PG_ENABLE_RUNTIME_CONNECT -e PG_MAX_RESULT_BYTES -e PG_STATEMENT_TIMEOUT -e PG_CONNECT_TIMEOUT -e PG_SSH_HOST -e PG_SSH_PORT -e PG_SSH_USER -e PG_SSH_PRIVATE_KEY -e PG_SSH_PASSPHRASE -e PG_SSH_AGENT -e PG_SSH_PASSWORD -e PG_SSH_FINGERPRINT -e PG_SSH_KEEPALIVE_INTERVAL node:22-alpine sh -c 'npx -y supergateway@4 --stdio '"'"'npx -y [email protected]'"'"' --outputTransport streamableHttp --stateful --host 0.0.0.0 --port 8000 --streamableHttpPath /mcp --healthEndpoint /healthz'
# Generated by Hub for toolset "my-agent" (2026-10-18T21:02:51+00:00).
# Each package server runs behind a stdio->HTTP bridge and listens on localhost only.
# cp .env.example .env # fill the ${VAR}s
# docker compose up -d && bash smoke.sh
# Remote servers are not here: clients reach them directly (see clients/).
name: mcp-my-agent
services:
postgres-server:
image: node:22-alpine
command:
- sh
- -c
- npx -y supergateway@4 --stdio 'npx -y [email protected]' --outputTransport streamableHttp
--stateful --host 0.0.0.0 --port 8000 --streamableHttpPath /mcp --healthEndpoint /healthz
ports:
- 127.0.0.1:8101:8000
volumes:
- npm-cache:/root/.npm
healthcheck:
test:
- CMD-SHELL
- wget -qO- http://127.0.0.1:8000/healthz || exit 1
interval: 30s
timeout: 5s
retries: 5
start_period: 2m
restart: unless-stopped
environment:
DATABASE_URL: ${DATABASE_URL}
PG_HOST: ${PG_HOST}
PG_PORT: ${PG_PORT}
PG_USER: ${PG_USER}
PG_PASSWORD: ${PG_PASSWORD}
PG_DATABASE: ${PG_DATABASE}
PG_ALLOW_WRITE: ${PG_ALLOW_WRITE}
PG_SSLMODE: ${PG_SSLMODE}
PG_SSL_CA: ${PG_SSL_CA}
PG_ENABLE_RUNTIME_CONNECT: ${PG_ENABLE_RUNTIME_CONNECT}
PG_MAX_RESULT_BYTES: ${PG_MAX_RESULT_BYTES}
PG_STATEMENT_TIMEOUT: ${PG_STATEMENT_TIMEOUT}
PG_CONNECT_TIMEOUT: ${PG_CONNECT_TIMEOUT}
PG_SSH_HOST: ${PG_SSH_HOST}
PG_SSH_PORT: ${PG_SSH_PORT}
PG_SSH_USER: ${PG_SSH_USER}
PG_SSH_PRIVATE_KEY: ${PG_SSH_PRIVATE_KEY}
PG_SSH_PASSPHRASE: ${PG_SSH_PASSPHRASE}
PG_SSH_AGENT: ${PG_SSH_AGENT}
PG_SSH_PASSWORD: ${PG_SSH_PASSWORD}
PG_SSH_FINGERPRINT: ${PG_SSH_FINGERPRINT}
PG_SSH_KEEPALIVE_INTERVAL: ${PG_SSH_KEEPALIVE_INTERVAL}
volumes:
npm-cache: {}
uv-cache: {}
# Generated by Hub for toolset "my-agent" (2026-10-18T21:02:51+00:00).
# kubectl create namespace mcp
# kubectl -n mcp create secret generic mcp-credentials --from-env-file=.env
# kubectl apply -f kubernetes.yaml
# Services are cluster-internal: <name>.mcp.svc.cluster.local:8000/mcp. Put an ingress
# with auth in front before exposing any of them.
apiVersion: v1
kind: Namespace
metadata:
name: mcp
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: postgres-server
namespace: mcp
labels: &id001
app: postgres-server
spec:
replicas: 1
selector:
matchLabels: *id001
template:
metadata:
labels: *id001
spec:
containers:
- name: postgres-server
image: node:22-alpine
ports:
- containerPort: 8000
name: http
env:
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: mcp-credentials
key: DATABASE_URL
- name: PG_HOST
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_HOST
- name: PG_PORT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_PORT
- name: PG_USER
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_USER
- name: PG_PASSWORD
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_PASSWORD
- name: PG_DATABASE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_DATABASE
- name: PG_ALLOW_WRITE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_ALLOW_WRITE
- name: PG_SSLMODE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSLMODE
- name: PG_SSL_CA
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSL_CA
- name: PG_ENABLE_RUNTIME_CONNECT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_ENABLE_RUNTIME_CONNECT
- name: PG_MAX_RESULT_BYTES
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_MAX_RESULT_BYTES
- name: PG_STATEMENT_TIMEOUT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_STATEMENT_TIMEOUT
- name: PG_CONNECT_TIMEOUT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_CONNECT_TIMEOUT
- name: PG_SSH_HOST
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_HOST
- name: PG_SSH_PORT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_PORT
- name: PG_SSH_USER
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_USER
- name: PG_SSH_PRIVATE_KEY
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_PRIVATE_KEY
- name: PG_SSH_PASSPHRASE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_PASSPHRASE
- name: PG_SSH_AGENT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_AGENT
- name: PG_SSH_PASSWORD
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_PASSWORD
- name: PG_SSH_FINGERPRINT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_FINGERPRINT
- name: PG_SSH_KEEPALIVE_INTERVAL
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_KEEPALIVE_INTERVAL
args:
- sh
- -c
- npx -y supergateway@4 --stdio 'npx -y [email protected]' --outputTransport streamableHttp
--stateful --host 0.0.0.0 --port 8000 --streamableHttpPath /mcp --healthEndpoint /healthz
readinessProbe:
httpGet:
path: /healthz
port: http
initialDelaySeconds: 10
---
apiVersion: v1
kind: Service
metadata:
name: postgres-server
namespace: mcp
spec:
selector:
app: postgres-server
ports:
- port: 8000
targetPort: http
name: http
# Generated by Hub for toolset "my-agent" (2026-10-18T21:02:51+00:00).
# Credentials come from the Secret 'mcp-credentials' (kubectl create secret generic ... --from-env-file=.env).
# Each server under `servers` is one Deployment + Service; the keys after it configure
# upstream charts a worker verified.
servers:
postgres-server:
enabled: true
replicas: 1
port: 8000
path: /mcp
container:
name: postgres-server
image: node:22-alpine
ports:
- containerPort: 8000
name: http
env:
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: mcp-credentials
key: DATABASE_URL
- name: PG_HOST
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_HOST
- name: PG_PORT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_PORT
- name: PG_USER
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_USER
- name: PG_PASSWORD
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_PASSWORD
- name: PG_DATABASE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_DATABASE
- name: PG_ALLOW_WRITE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_ALLOW_WRITE
- name: PG_SSLMODE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSLMODE
- name: PG_SSL_CA
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSL_CA
- name: PG_ENABLE_RUNTIME_CONNECT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_ENABLE_RUNTIME_CONNECT
- name: PG_MAX_RESULT_BYTES
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_MAX_RESULT_BYTES
- name: PG_STATEMENT_TIMEOUT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_STATEMENT_TIMEOUT
- name: PG_CONNECT_TIMEOUT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_CONNECT_TIMEOUT
- name: PG_SSH_HOST
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_HOST
- name: PG_SSH_PORT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_PORT
- name: PG_SSH_USER
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_USER
- name: PG_SSH_PRIVATE_KEY
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_PRIVATE_KEY
- name: PG_SSH_PASSPHRASE
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_PASSPHRASE
- name: PG_SSH_AGENT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_AGENT
- name: PG_SSH_PASSWORD
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_PASSWORD
- name: PG_SSH_FINGERPRINT
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_FINGERPRINT
- name: PG_SSH_KEEPALIVE_INTERVAL
valueFrom:
secretKeyRef:
name: mcp-credentials
key: PG_SSH_KEEPALIVE_INTERVAL
args:
- sh
- -c
- npx -y supergateway@4 --stdio 'npx -y [email protected]' --outputTransport streamableHttp
--stateful --host 0.0.0.0 --port 8000 --streamableHttpPath /mcp --healthEndpoint /healthz
readinessProbe:
httpGet:
path: /healthz
port: http
initialDelaySeconds: 10
# helm install my-agent helm/my-agent -n mcp
in the cloud
one click: the provider's deploy form opens filled in, in your own account- koyeb
-
The form opens with CHANGE_ME for each value you supply: DATABASE_URL, PG_HOST, PG_PORT, PG_USER, PG_PASSWORD, PG_DATABASE, PG_ALLOW_WRITE, PG_SSLMODE, PG_SSL_CA, PG_ENABLE_RUNTIME_CONNECT, PG_MAX_RESULT_BYTES, PG_STATEMENT_TIMEOUT, PG_CONNECT_TIMEOUT, PG_SSH_HOST, PG_SSH_PORT, PG_SSH_USER, PG_SSH_PRIVATE_KEY, PG_SSH_PASSPHRASE, PG_SSH_AGENT, PG_SSH_PASSWORD, PG_SSH_FINGERPRINT, PG_SSH_KEEPALIVE_INTERVAL. Fill them in before you deploy.
Clients connect to the service's https://…koyeb.app address plus /mcp.
- azure
-
A Container Apps environment with one app per server, each with HTTPS ingress and one replica. The portal asks for each value you supply as a secure parameter; the deployment's outputs list the endpoints.
connect to it
copy what your client needsnpx -y [email protected] # env: DATABASE_URL, PG_HOST, PG_PORT, PG_USER, PG_PASSWORD, PG_DATABASE, PG_ALLOW_WRITE, PG_SSLMODE, PG_SSL_CA, PG_ENABLE_RUNTIME_CONNECT, PG_MAX_RESULT_BYTES, PG_STATEMENT_TIMEOUT, PG_CONNECT_TIMEOUT, PG_SSH_HOST, PG_SSH_PORT, PG_SSH_USER, PG_SSH_PRIVATE_KEY, PG_SSH_PASSPHRASE, PG_SSH_AGENT, PG_SSH_PASSWORD, PG_SSH_FINGERPRINT, PG_SSH_KEEPALIVE_INTERVAL
{
"mcpServers": {
"postgres-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"DATABASE_URL": "${DATABASE_URL}",
"PG_HOST": "${PG_HOST}",
"PG_PORT": "${PG_PORT}",
"PG_USER": "${PG_USER}",
"PG_PASSWORD": "${PG_PASSWORD}",
"PG_DATABASE": "${PG_DATABASE}",
"PG_ALLOW_WRITE": "${PG_ALLOW_WRITE}",
"PG_SSLMODE": "${PG_SSLMODE}",
"PG_SSL_CA": "${PG_SSL_CA}",
"PG_ENABLE_RUNTIME_CONNECT": "${PG_ENABLE_RUNTIME_CONNECT}",
"PG_MAX_RESULT_BYTES": "${PG_MAX_RESULT_BYTES}",
"PG_STATEMENT_TIMEOUT": "${PG_STATEMENT_TIMEOUT}",
"PG_CONNECT_TIMEOUT": "${PG_CONNECT_TIMEOUT}",
"PG_SSH_HOST": "${PG_SSH_HOST}",
"PG_SSH_PORT": "${PG_SSH_PORT}",
"PG_SSH_USER": "${PG_SSH_USER}",
"PG_SSH_PRIVATE_KEY": "${PG_SSH_PRIVATE_KEY}",
"PG_SSH_PASSPHRASE": "${PG_SSH_PASSPHRASE}",
"PG_SSH_AGENT": "${PG_SSH_AGENT}",
"PG_SSH_PASSWORD": "${PG_SSH_PASSWORD}",
"PG_SSH_FINGERPRINT": "${PG_SSH_FINGERPRINT}",
"PG_SSH_KEEPALIVE_INTERVAL": "${PG_SSH_KEEPALIVE_INTERVAL}"
}
}
}
}
#!/usr/bin/env bash
# Registers every server with Claude Code (run once; `claude mcp list` to check).
set -euo pipefail
set -a; [ -f .env ] && source .env; set +a
claude mcp add postgres-server -e "DATABASE_URL=${DATABASE_URL}" -e "PG_HOST=${PG_HOST}" -e "PG_PORT=${PG_PORT}" -e "PG_USER=${PG_USER}" -e "PG_PASSWORD=${PG_PASSWORD}" -e "PG_DATABASE=${PG_DATABASE}" -e "PG_ALLOW_WRITE=${PG_ALLOW_WRITE}" -e "PG_SSLMODE=${PG_SSLMODE}" -e "PG_SSL_CA=${PG_SSL_CA}" -e "PG_ENABLE_RUNTIME_CONNECT=${PG_ENABLE_RUNTIME_CONNECT}" -e "PG_MAX_RESULT_BYTES=${PG_MAX_RESULT_BYTES}" -e "PG_STATEMENT_TIMEOUT=${PG_STATEMENT_TIMEOUT}" -e "PG_CONNECT_TIMEOUT=${PG_CONNECT_TIMEOUT}" -e "PG_SSH_HOST=${PG_SSH_HOST}" -e "PG_SSH_PORT=${PG_SSH_PORT}" -e "PG_SSH_USER=${PG_SSH_USER}" -e "PG_SSH_PRIVATE_KEY=${PG_SSH_PRIVATE_KEY}" -e "PG_SSH_PASSPHRASE=${PG_SSH_PASSPHRASE}" -e "PG_SSH_AGENT=${PG_SSH_AGENT}" -e "PG_SSH_PASSWORD=${PG_SSH_PASSWORD}" -e "PG_SSH_FINGERPRINT=${PG_SSH_FINGERPRINT}" -e "PG_SSH_KEEPALIVE_INTERVAL=${PG_SSH_KEEPALIVE_INTERVAL}" -- npx -y [email protected]
{
"mcpServers": {
"postgres-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"DATABASE_URL": "${DATABASE_URL}",
"PG_HOST": "${PG_HOST}",
"PG_PORT": "${PG_PORT}",
"PG_USER": "${PG_USER}",
"PG_PASSWORD": "${PG_PASSWORD}",
"PG_DATABASE": "${PG_DATABASE}",
"PG_ALLOW_WRITE": "${PG_ALLOW_WRITE}",
"PG_SSLMODE": "${PG_SSLMODE}",
"PG_SSL_CA": "${PG_SSL_CA}",
"PG_ENABLE_RUNTIME_CONNECT": "${PG_ENABLE_RUNTIME_CONNECT}",
"PG_MAX_RESULT_BYTES": "${PG_MAX_RESULT_BYTES}",
"PG_STATEMENT_TIMEOUT": "${PG_STATEMENT_TIMEOUT}",
"PG_CONNECT_TIMEOUT": "${PG_CONNECT_TIMEOUT}",
"PG_SSH_HOST": "${PG_SSH_HOST}",
"PG_SSH_PORT": "${PG_SSH_PORT}",
"PG_SSH_USER": "${PG_SSH_USER}",
"PG_SSH_PRIVATE_KEY": "${PG_SSH_PRIVATE_KEY}",
"PG_SSH_PASSPHRASE": "${PG_SSH_PASSPHRASE}",
"PG_SSH_AGENT": "${PG_SSH_AGENT}",
"PG_SSH_PASSWORD": "${PG_SSH_PASSWORD}",
"PG_SSH_FINGERPRINT": "${PG_SSH_FINGERPRINT}",
"PG_SSH_KEEPALIVE_INTERVAL": "${PG_SSH_KEEPALIVE_INTERVAL}"
}
}
}
}
{
"servers": {
"postgres-server": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"DATABASE_URL": "${DATABASE_URL}",
"PG_HOST": "${PG_HOST}",
"PG_PORT": "${PG_PORT}",
"PG_USER": "${PG_USER}",
"PG_PASSWORD": "${PG_PASSWORD}",
"PG_DATABASE": "${PG_DATABASE}",
"PG_ALLOW_WRITE": "${PG_ALLOW_WRITE}",
"PG_SSLMODE": "${PG_SSLMODE}",
"PG_SSL_CA": "${PG_SSL_CA}",
"PG_ENABLE_RUNTIME_CONNECT": "${PG_ENABLE_RUNTIME_CONNECT}",
"PG_MAX_RESULT_BYTES": "${PG_MAX_RESULT_BYTES}",
"PG_STATEMENT_TIMEOUT": "${PG_STATEMENT_TIMEOUT}",
"PG_CONNECT_TIMEOUT": "${PG_CONNECT_TIMEOUT}",
"PG_SSH_HOST": "${PG_SSH_HOST}",
"PG_SSH_PORT": "${PG_SSH_PORT}",
"PG_SSH_USER": "${PG_SSH_USER}",
"PG_SSH_PRIVATE_KEY": "${PG_SSH_PRIVATE_KEY}",
"PG_SSH_PASSPHRASE": "${PG_SSH_PASSPHRASE}",
"PG_SSH_AGENT": "${PG_SSH_AGENT}",
"PG_SSH_PASSWORD": "${PG_SSH_PASSWORD}",
"PG_SSH_FINGERPRINT": "${PG_SSH_FINGERPRINT}",
"PG_SSH_KEEPALIVE_INTERVAL": "${PG_SSH_KEEPALIVE_INTERVAL}"
}
}
}
}
name: my-agent target: local servers: - hub: io.github.antonorlov/mcp-postgres-server
- not probed yet: tools unpinned, ingest lists them