The best Postgres MCP server depends on its brakes: five compared

The short answer

There is no single best Postgres MCP server, but there is a clear way to choose: pick the one whose safety controls fit where it will run. For a hosted Supabase or Neon project, use the platform’s own server with read-only mode and project scoping on.¹² For any other Postgres, Postgres MCP Pro’s restricted mode limits it to read-only transactions with a time limit.³ Don’t use the archived reference server, @modelcontextprotocol/server-postgres: it was archived in May 2025, and its read-only transaction could be escaped with a stacked COMMIT;.⁵⁶

Whichever you choose, the database role it connects as is the control that holds when everything else fails.

What to compare

Feature lists for MCP servers focus on what they can do. For a server that can run SQL on your data, compare what stops it:

1. Read-only mode. Does it exist, and how is it enforced: a read-only role, a read-only transaction, or parsing the SQL?
2. Scoping. Can you limit it to one project, one database or a subset of tools?
3. Confirmations. Does the server ask before destructive operations, and can that be switched off?
4. Role. Can you choose the Postgres role it uses?
5. What its own docs say about production. Vendors are often blunter in their docs than in their marketing.

The comparison

Each cell comes from the server’s own documentation, read on 26 October 2026.

Server notes

Supabase. The hosted server at mcp.supabase.com/mcp is narrowed with URL parameters: project_ref scopes it to one project and disables account tools, read_only=true runs every query as a read-only Postgres user, and features enables only the tool groups you name.¹ It can ask the client to confirm destructive SQL for execute_sql and apply_migration, outside read-only mode, but each confirmation can be skipped with skip_elicitations.¹ Its docs name prompt injection as the main risk and say the server runs with your developer permissions, so it shouldn’t be given to customers or end users.¹ Our is Supabase MCP safe post goes deeper.

Neon. Neon recommends its MCP server for development and testing only and says never to connect MCP agents to production databases.² Its parameters mirror Supabase’s: readonly=true, projectId, category, plus roleName to choose the role SQL tools connect as. The docs add a warning worth repeating: roles created in Neon’s Console, CLI or API belong to neon_superuser, which can read all data, so create a limited role in SQL.²

Postgres MCP Pro. It works with any Postgres. Unrestricted mode gives full read and write access and is meant for development; restricted mode limits operations to read-only transactions and an execution time limit, and the project parses SQL to reject statements containing commit or rollback.³ Its own caveats are honest: unsafe stored procedure languages could get around its read-only protections, and it says more measures may be added to make restricted mode safe for production.³

Prisma. Prisma’s remote server can manage databases, run SQL and restore backups. Its docs warn that tools that change or delete resources can cause data loss, and note that the Prisma CLI’s safeguards apply to CLI commands, not to MCP tool calls.⁴ That second point matters if you relied on the check Prisma added to stop AI coding tools running prisma migrate reset without confirmation⁸: it doesn’t cover the MCP path.

The archived reference server. Anthropic archived @modelcontextprotocol/server-postgres on 28 May 2025.⁵ Datadog Security Labs then showed that it ran each query in a read-only transaction that a query starting with COMMIT; could end, so the statements after it ran outside the transaction; their demonstration dropped every table.⁶ Our read-only bypass post has the details. If it’s still in your config, replace it.

The one control that matters most

Look at the read-only column again. The modes are enforced in different places: a read-only Postgres user (Supabase), a read-only transaction (Postgres MCP Pro, and the reference server), or the server’s own code. A transaction can be ended; server code can have bugs; a role’s privileges are enforced by Postgres itself on every statement.

So whatever server you choose, give it a role that can only do what the task needs. For a reporting agent:

Code A database command in SQL. The text around it says what it does.

CREATE ROLE mcp_reader LOGIN PASSWORD '…';
GRANT CONNECT ON DATABASE app TO mcp_reader;
GRANT USAGE ON SCHEMA public TO mcp_reader;
GRANT SELECT ON public.orders, public.products TO mcp_reader;
ALTER ROLE mcp_reader SET default_transaction_read_only = on;
ALTER ROLE mcp_reader SET statement_timeout = '5s';

The grants are the real boundary; the two settings are defence in depth. List tables explicitly rather than granting on all tables, so a new table with sensitive data isn’t readable by default. The read-only database access entry and the read-only role comparison explain the trade-offs.

A setup checklist for any of them

1. Not production, unless the task needs production data. Two of the four live vendors’ docs say so directly.²¹
2. Read-only mode on, and a read-only role underneath it.
3. Scope to one project and only the tool groups the task needs.
4. Keep confirmations on for anything that writes; don’t pass a skip parameter.¹
5. Approve tool calls yourself in interactive use.
6. Remove the archived reference server from every config.

What this comparison leaves out

Cells marked “not described” mean the page we read didn’t describe the control, not that the server lacks it; check the current docs. Features change monthly. And no server here judges whether an allowed query is the right one: a read-only agent can still read data it shouldn’t share.

To find which MCP servers your machine is configured to run, deedglass scan reports an “Archived Postgres MCP server” finding for @modelcontextprotocol/server-postgres at any version in the configs it reads, with two fixes: a role that can only SELECT, or routing it through Deedglass.⁷ For gateways that sit in front of any of these servers, see the MCP gateway comparison. To see the checks on a real database in your browser, try the playground; the scan’s grade is explained here, and npx deedglass scan runs it.

Written with AI assistance and checked against our claims register.