prestSAFE
Official stdio MCP adapter for pREST: bridge Cursor, Claude, and other MCP clients to pREST’s HTTP /_mcp endpoint for PostgreSQL-backed tools. Tiny Go transport proxy—no SQL or schema logic.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Official stdio adapter for pREST’s HTTP MCP endpoint.
This adapter lets MCP clients that require stdio connect to a running pREST instance exposing an HTTP MCP endpoint at /_mcp.
MCP client / AI IDE ↓ stdio (NDJSON JSON-RPC) prest-mcp ↓ HTTP POST http://localhost:3000/_mcp ↓ pREST
The adapter is a tiny transport bridge. It does not introspect schemas, generate SQL, or implement MCP tools. Those live in pREST.
Requirements
- A running pREST instance with the
/_mcproute available - Go 1.26+ (to build from source)
Environment variables
Install
From source
go install github.com/prest/prest-mcp-adapter/cmd/prest-mcp@latest
Docker / OCI
docker pull ghcr.io/prest/prest-mcp-adapter:0.1.3
Local usage
PREST_MCP_URL=http://localhost:3000/_mcp prest-mcp
With token
PREST_MCP_URL=https://api.example.com/_mcp \ PREST_MCP_TOKEN=secret \ prest-mcp
Docker usage
docker run --rm -i \ -e PREST_MCP_URL=http://host.docker.internal:3000/_mcp \ ghcr.io/prest/prest-mcp-adapter:0.1.3
MCP client configuration
Cursor
Add to your MCP settings (e.g. .cursor/mcp.json):
{
"mcpServers": {
"prest": {
"command": "prest-mcp",
"env": {
"PREST_MCP_URL": "http://localhost:3000/_mcp"
}
}
}
}Claude Desktop
Add to claude_desktop_config.json:
{
"mcpServers": {
"prest": {
"command": "prest-mcp",
"env": {
"PREST_MCP_URL": "http://localhost:3000/_mcp"
}
ecb8a7047a43OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add prest-mcp-adapter:0.1.3 --env PREST_MCP_TOKEN=${PREST_MCP_TOKEN} -- docker run -i --rm ghcr.io/prest/prest-mcp-adapter:0.1.3:NoneTrust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (4)
t.Setenv("PREST_MCP_URL", "http://127.0.0.1:1")f := transport.NewHTTPForwarder(&http.Client{}, "http://127.0.0.1:1", "")f := transport.NewHTTPForwarder(&http.Client{}, "http://127.0.0.1:1", "")Gates applied: no_behavioural_pass.
ecb8a7047a43full audit observations/trust-audit/mcp-server/prest__prest-mcp-adapter.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | ecb8a7047a43 | SAFE | B | 89 | first audit |
Questions
What is the prest MCP server?
Official stdio MCP adapter for pREST: bridge Cursor, Claude, and other MCP clients to pREST’s HTTP /_mcp endpoint for PostgreSQL-backed tools. Tiny Go transport proxy—no SQL or schema logic.
Is prest safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does prest need?
It reads PREST_MCP_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does prest run?
It speaks stdio, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (ecb8a7047a43), read on 2026-10-12. The repository is watched and re-audited when it changes.