Postgres MCP (Microsoft)
Postgres MCP Server (Microsoft)
Postgres MCP from Microsoft: connection profiles with passwords in the OS keyring, Entra ID sign-in for Azure, queries, schema, CSV and server metrics
- 61 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The write tool runs DDL and DML with the rights of the profile's role, and the server itself does not check what the agent may do
- Loading and describing CSV reads local files from approved folders
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/postgres-mcp-server-microsoftDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The write tool runs DDL and DML with the rights of the profile's role, and the server itself does not check what the agent may do
- Loading and describing CSV reads local files from approved folders
This is third-party code. Review the repository files before installing.
What it does
Postgres MCP from Microsoft is a PostgreSQL server that the client starts with `npx -y @microsoft/postgres-mcp run`. No installation is needed: it is a ready binary inside an npm package and talks to the client over stdio. A database connection is described by a profile. The `connection add` command writes the address and parameters to `~/.postgres-mcp/connections.yaml`, and `connection set-password` puts the password in the OS keyring, so it never reaches the client config. The agent finds saved profiles itself and opens a connection pool. The server offers 13 tools. For connections these are listing, adding and removing profiles, `postgres_mcp_connect` and a database list. `postgres_mcp_db_context` returns `CREATE` scripts for tables, indexes, functions and sequences. `postgres_mcp_query` runs a single read-only query, while `postgres_mcp_modify` runs DDL and DML. For data there is a CSV file description and loading it into a table through `COPY`; for diagnostics there is a check of the server's available capabilities and a collection of performance metric groups. For Azure Database for PostgreSQL hosts with no saved password the server signs in through Microsoft Entra ID, taking credentials from Azure variables, from workload identity or from `az login`. Amazon RDS and Aurora, Google Cloud SQL and AlloyDB, and local or self-run installations use an ordinary password.
Who it is for. For developers and administrators who work with PostgreSQL from Claude Code, Codex, OpenCode, Cursor, VS Code or Copilot CLI and keep databases locally or in the Azure, Amazon and Google clouds. It is especially handy for Azure teams that sign in through Entra ID.
Good fit when
- A database password must not sit in the client config, and the OS keyring already holds it
- The database lives in Azure Database for PostgreSQL and sign-in must go through Entra ID, including as a group
- An agent needs `CREATE` scripts for tables and functions to design a schema
- A CSV file has to be described and loaded into a table through `COPY`, with limits on the folders the server may read
- You need to find out what is slowing the server down, through performance metric groups
Not a fit when
- There is no Node.js 22 or newer: the server starts through `npx` and will not run on older versions
- The agent has to tune indexes and assess database health: the postgres-mcp-pro entry has such tools
- Writing to the database is unacceptable and there is no separate read-only role: the server does not check permissions itself
- The platform is not on the list: the package is built for Linux and macOS on x64 and arm64 and for Windows on x64
Example request
Show the 10 most recent orders from my PostgreSQL database and tell me which query is loading the server the most right nowMCP
- Transport
- stdio
- Authentication
- key is optional
Environment variables
POSTGRES_MCP_CONNECTION_STRINGsecret- Connection string for environments with no keyring, such as CI or a container
POSTGRES_MCP_ALLOWED_PATHS- Files and folders approved for CSV reads
POSTGRES_MCP_QUERY_TIMEOUT_MS- Query timeout in milliseconds, 540000 by default
POSTGRES_MCP_MANAGED_IDENTITY- The value 1 allows an Azure managed identity for sign-in
Limitations
- The project is a preview, and the changelog lists version 0.1.0.
- A profile created with `connection add` permits write tools until `access_mode: ro` is set. For autonomous agents you need both a read-only profile and a database role with the same rights.
- The server collects pseudonymous telemetry: machine and session identifiers, tool names, duration and outcome, without query text. It is switched off with the `run --no-telemetry` flag.
- On hosts with no keyring, such as Docker and CI, the connection string with the password goes into `POSTGRES_MCP_CONNECTION_STRING`, and other processes in the environment can see it.
- The `sslmode=require` mode encrypts the connection but does not verify the certificate. Verification is enabled with `verify-ca` and `verify-full`.
- Sign-in through `az login` needs Azure CLI 2.54.0 or newer.
- The license is MIT.
How to disable. Remove the postgres entry from the client config and restart the agent. Profiles and passwords are removed with `npx -y @microsoft/postgres-mcp connection remove <name>`, and the list of folders allowed for CSV is in `~/.postgres-mcp/approved_paths.yaml`.
FAQ
How do I connect Microsoft's Postgres MCP to Claude Code?
Save a profile with `npx -y @microsoft/postgres-mcp connection add local "postgresql://postgres@localhost:5432/postgres"`, set the password with `connection set-password local` and add an `mcpServers` entry with the `npx` command and the arguments `-y`, `@microsoft/postgres-mcp`, `run`. Credentials never reach the client config: the agent finds the profile when it connects.
How do I make Postgres MCP read-only?
Create a profile with the `ro` access mode and give the database role read-only rights. The profile blocks write tools inside the server and the role limits the database itself, so you need both. Even without that, `postgres_mcp_query` runs only single read-only queries.
Where is the database password stored?
In the OS keyring: Keychain on macOS, Secret Service on Linux, Credential Manager on Windows. `connections.yaml` has no password. Where there is no keyring, such as in a container, the password goes in a connection string through an environment variable.
Does the server work with Azure Database for PostgreSQL through Entra ID?
Yes. If the host looks like an Azure address and no password is saved, the server takes a token from Azure variables, workload identity or `az login`. Managed identity is enabled separately with `POSTGRES_MCP_MANAGED_IDENTITY=1`. To sign in as a group, set `loginAsUser` in the profile.
Which CSV files may the server read?
Only those under approved paths. By default the folder the client started the server from is approved, unless it is the home directory or the disk root. The `allow-access-to-path` command permits other files and folders, and `POSTGRES_MCP_DISABLE_CWD_ACCESS=1` excludes the start folder.
Which PostgreSQL databases suit the server?
Local ones, in Docker and on your own servers, as well as Azure Database for PostgreSQL, Amazon RDS and Aurora, Google Cloud SQL and AlloyDB and any wire-compatible server.
Discussion
No questions or reviews yet.
Related
MCP serverspgEdge Postgres MCP
pgEdge Postgres MCP Server
Postgres MCP in Go with read-mode queries, EXPLAIN plans, semantic search, several databases and a ready chat client and web interface
An MCP server for PostgreSQL with several databases at once, table descriptions from the catalog, PostGIS and pgvector hints and query plans
Google's open-source MCP server for databases: ready tools for Postgres, MySQL, BigQuery, Spanner and more, plus custom tools in tools.yaml
Official MongoDB MCP server: queries and aggregations, index management, Atlas clusters and local deployments
A Python MCP server for MySQL: listing tables, reading data, running SQL and inspecting schema through a controlled interface
A Go MCP server and REST API for databases: PostgreSQL, MySQL, ClickHouse, Snowflake, BigQuery and more, with personal data masking and a cache
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Postgres MCP (Microsoft) (this entry) | no | key is optional | 61 | |
| Postgres MCP Pro | no | API key | 3,420 | a server aimed at administration: index tuning, database health checks and plans with hypothetical indexes, with the connection string in DATABASE_URI |
| pgEdge Postgres MCP | no | not required | 239 | a Go server with a YAML config, several databases, semantic search, a chat client and a web interface |
| DBHub | no | not required | 3,712 | a server for PostgreSQL, MySQL, MariaDB, SQL Server and SQLite with two tools by default and a read-only mode |
README in short
A short guide goes from saving a connection profile through configuring the client to the first question to the agent. The larger USAGE.md walks through setup for GitHub Copilot CLI, Claude Code, Cursor, Claude Desktop, VS Code, Codex and OpenCode, sign-in methods, a security model with a responsibility table and a hardening checklist, TLS modes, a reference for tools and environment variables and common errors. Beside it sit a changelog and a vulnerability reporting policy.