MCPgCAUTION
Postgres MCP Server
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://mcptoplist.com/server/io.github.devopam%2Fmcpg)
A production-grade [Model Context Protocol](https://modelcontextprotocol.io) server for PostgreSQL. It lets AI agents safely inspect, query, operate, and tune a Postgres database — 254 tools spanning catalog introspection, query intelligence, natural-language SQL, structural diffs, hybrid search, graph queries, data movement, live ops, and more.
[](https://pypi.org/project/mcpg/) [](https://pypi.org/project/mcpg/) [](https://github.com/devopam/MCPg/blob/main/LICENSE) [](https://github.com/devopam/MCPg/actions/workflows/ci.yml) [](https://scorecard.dev/viewer/?uri=github.com/devopam/MCPg) [](https://www.bestpractices.dev/projects/13958) [](https://github.com/devopam/MCPg) [](https://smithery.ai/servers/devopam/mcpg) [](https://glama.ai/mcp/servers/devopam/MCPg) [](https://allmcps.com/mcp/devopam-mcpg?verify=63d9d537-be6b-4e07-a720-77dd0c41411b) [](https://mcpvault.io/servers/mcpg/health?utmsource=externalbadge&utmmedium=referral&utmcampaign=mcphealthreport)
Try it live: point an MCP client — or the MCP Inspector — at the ho
7ba99b927c03OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcpg -- uvx mcpg==0.8.2
Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
list_subscriptions | read | async def _run() -> list[introspection.SubscriptionInfo]: |
Trust audit
CAUTIONgrade D · trust 62/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
export MCPG_TEST_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/bench
--database-url postgresql://postgres:postgres@localhost:5433/demo \
--database-url postgresql://postgres:postgres@localhost:5433/demo \
MCPG_REPLICA_URLS=postgresql://reader:pw@replica-1/app,postgresql://reader:pw@replica-2/app
export MCPG_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/mydb
token="hvs.this_is_a_root_token_value",
secret = "sup3r-sekret-token-xyz"
pr_reviews.txt
.pre-commit-config.yaml
module = importlib.import_module(module_name)
module = importlib.import_module(f"mcpg.{module_name}")module = importlib.import_module(module_name)
digest = hashlib.sha1(sanitized.encode("utf-8")).hexdigest()[:8]# — no RC4, no 3DES, no CBC modes, no NULL, no anonymous.
# AEAD only — no CBC, no RC4, no 3DES, no NULL, no anonymous.
forbidden_substrings = ("RC4", "3DES", "DES-CBC", "NULL", "anon", "MD5", "EXPORT")--e2e --e2e-http-url http://127.0.0.1:8000/mcp \
"http://127.0.0.1:8000/mcp). Implies the HTTP transport is already running.",
OIDCVerifier(issuer="http://127.0.0.1:8080", audience="mcpg")
stdin = base64.b64decode(content, validate=True)
decoded = base64.b64decode(result.content)
config = json.loads(base64.b64decode(urllib.parse.unquote(next(iter(payloads.values())))))
"SELECT '' FROM t", # zero-width space literal
| 21.2 | ✅ **Shipped — PR open.** **Fork + PR submitted:** [docker/mcp-registry#4689](https://github.com/docker/mcp-registry/pull/4689). Forked `docker/mcp-registry`, ran `go run ./cmd/validate --name
unrestricted access mode.
Gates applied: no_behavioural_pass.
7ba99b927c03full audit observations/trust-audit/mcp-server/devopam__mcpg.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 7ba99b927c03 | CAUTION | D | 62 | first audit |
Questions
What is the MCPg MCP server?
Postgres MCP Server
What tools does MCPg expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is MCPg safe to connect to an agent?
With care. The audit graded it D (62/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does MCPg need?
It reads ANTHROPIC_API_KEY, MCPG_AUDIT_REDACT_KEYS and MCPG_NL2SQL_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does MCPg run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as pg-turboquant.
How current is this page?
The grade is for one exact copy of the source (7ba99b927c03), read on 2026-10-10. The repository is watched and re-audited when it changes.