Integrations · Postgres
A custom MCP server for Postgres
A custom Postgres MCP server exposes your database to Claude as a small, read-first tool set, from$2,000. The point is not features; it is making the dangerous default safe: a read replica, a least-privilege role that cannot write or run DDL, a statement timeout, and row limits. If you only need to query a throwaway dev database, an off-the-shelf server is fine and you should use it.
What the off-the-shelf option gives you, and where it stops
Community Postgres servers connect fast and query anything, which is exactly the problem for production. Most default to a broad connection and no query guards, so "show me the customers" and "delete the customers" are equally reachable. They stop precisely where safety starts.
The nine tools we define
| Tool | Access |
|---|---|
| rows.query | read (guarded, row-limited) |
| table.describe | read |
| customers.search | read |
| orders.for_customer | read |
| metrics.rollup | read |
| recent.activity | read |
| record.count | read |
| schema.list | read |
| note.append | write · dry-run · single table |
The write-safety consideration specific to Postgres
Postgres will happily do what you grant, so safety is a grant problem, not a prompt problem. We enforce it at the role, below the tool layer, where the model cannot reach.
CREATE ROLE mcp_read NOLOGIN;
GRANT CONNECT ON DATABASE app TO mcp_read;
GRANT USAGE ON SCHEMA public TO mcp_read;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO mcp_read;
ALTER ROLE mcp_read SET statement_timeout = '5s';
-- point the server at a READ REPLICA; no INSERT/UPDATE/DELETE/DDLAuth and cost
Internal builds use an API key and run on a read replica; a shared build uses OAuth. The Postgres build is an Internal Connect engagement, from $2,000 plus $250 per month, with the retainer covering spec migrations like 2026-07-28. The connecting-Claude-to-Postgres write-up in the field notes has the safety detail, and the internal-integration service page has the full scope.
Read the Postgres safety write-up or see internal integration.
Postgres questions
- Should we just use an existing Postgres MCP server?
- For a throwaway local query tool on a dev database, yes, and several community servers do it. For anything touching production data, the default posture of most off-the-shelf servers is the problem: a superuser connection and no query guards. A custom build exists to make the dangerous default safe, not to add features.
- Can it run destructive SQL?
- No. The role we grant cannot DELETE, DROP or ALTER, and there is no tool that issues DDL. That is enforced at the database, not just in the tool layer, so even a confused model cannot route around it. No destructive deletes, ever, is the same contractual rule as everywhere else.
- How do you stop a runaway query?
- A statement timeout on the role and row limits in the tools. A model that asks for "all orders" gets a bounded page, not a table scan that locks your database. As of the 2026-07-28 revision this all runs over Streamable HTTP with the current auth model.