The short answer
No, not by Neon’s own advice. Neon’s docs say: “We recommend MCP for development and testing only, not production environments,” and its README says it does not recommend the server in production. Both tell you to review and authorize every action the model requests before it runs.1
If an agent needs Neon, give it a project and branches that hold nothing you can’t lose, narrowed with project scoping and read-only mode. If it truly needs production data, give it a read-only Postgres role on a branch, not the MCP server’s full tool set.
Deedglass
A tool call meets your rules before it runs
Asks to run
DELETE FROM visits;
Deletes every row in visits
Deedglass checks your rules
- Reading dataAllowed
- Deleting a whole table (DROP, TRUNCATE)Never
- Changing or deleting rows without saying which (WHERE)This one
- Other changesWait for a person
What the server can do
The Neon MCP server is not just a SQL tool. It speaks the Neon API, so it can manage the account as well as query a database. Its README groups the tools like this:2
| Group | Example tools | What a bad call costs |
|---|---|---|
| Projects | list_projects, create_project, delete_project |
A whole project, with every branch in it |
| Branches | create_branch, reset_from_parent, delete_branch, restore_snapshot |
A branch’s data, or its state reset to the parent |
| SQL and schema | run_sql, run_sql_transaction, get_connection_string |
Any row the connection’s role can write |
| Migrations | prepare_database_migration, complete_database_migration |
A schema change on the main branch |
Two rows stand out for an agent. delete_project is a single tool call. And get_connection_string hands the model a credential it can use outside the MCP server’s controls, for example from a shell tool in the same agent.
The three settings that narrow it
The remote server lives at https://mcp.neon.tech/mcp, and you narrow it with URL parameters and the key you give it.1
?projectId=<id>scopes every operation to one project. In that mode, tools without a project path are hidden, includinglist_projects,create_projectanddelete_project.12?readonly=trueturns on read-only mode.SELECTqueries and schema inspection stay; branch creation, migrations and other writes are disabled, andrun_sql_transactiongoes away. With OAuth you can pick read-only scope during authorization instead.1- An organization API key limits access to projects under that organization; with OAuth the server works on your personal account’s projects by default.2
Use all three. projectId removes the account-level tools; readonly removes the writes; the key limits which projects exist from the server’s point of view.
What read-only mode does and doesn’t cover
In read-only mode, run_sql runs each query in a READ ONLY transaction, and the migration and query-tuning tools are unavailable.2 That is a real reduction. It is also a setting inside the server, enforced by the server’s own code.
The reference Postgres MCP server shows why that matters. Datadog Security Labs found it ran each query in a BEGIN TRANSACTION READ ONLY transaction, and that a query starting with COMMIT; ended the transaction so the statements after it ran outside it.4 We have no report of the same flaw in Neon’s server, and we don’t claim one. The point is general: a read-only flag in a tool is one layer, and the database role is the layer that holds when the tool has a bug. Our post on the read-only bypass walks through that case.
So when an agent needs to read data, give it both: readonly=true on the server and a connection whose Postgres role can only SELECT the tables it needs. See read-only database access for the grants.
A setup that keeps agents off production
Neon’s branching makes the safe setup cheap. A branch is a copy-on-write clone of your data, created from a current or past state without load on the parent, and a branch can be reset to match its parent.33
A pattern that works:
- One project for agent work, or a dedicated child branch of production that the agent may use. Never the production branch itself.
- Scope the MCP server to that project with
projectId, and use a key that can’t see your production project at all. - Let the agent create and break branches. If it ruins one, reset it from the parent or delete it. The cost is minutes.
- Promote changes by your normal path. Schema changes reach production through your migration tool and review, not through the agent’s MCP session.
- Keep approval on. Neon’s docs say to review and authorize each action.1 An “always allow” on
run_sqlturns that off for every query that follows.
We compare Neon’s branches with Supabase’s and others in database branches compared.
Migrations through the server
The migration tools are Neon’s most agent-friendly feature. prepare_database_migration creates a temporary branch to apply and test the migration before it affects the main branch; complete_database_migration then applies it to the main branch and removes the temporary resources.2
That gives you a test run on real-shaped data. It doesn’t give you a review. The completing call is still a single tool call that changes the main branch. Read the SQL the agent prepared, and if your main branch is production, run the final step yourself through your migration tool rather than letting the agent complete it.
A checklist
- Server URL carries
projectIdfor a non-production project. - Server URL carries
readonly=trueunless the task needs writes. - The API key belongs to an organization that doesn’t hold production, or OAuth was granted read-only scope.
- Every tool call is approved by a person; no “always allow” on
run_sql. - The Postgres role behind the connection string can do no more than the task needs.
- No other agent tool (shell, HTTP) can use a connection string the server hands back.
- Migrations to production go through your normal review, not
complete_database_migration. - Before you start, the agent’s full config has been scanned: paste the agent’s MCP config into the check page or run
npx deedglass scan(how the grade works); the scan Action repeats it on each pull request.
To try the checks in your browser without installing anything, open the playground.
Questions people ask
Does the Neon MCP server have a read-only mode?
Yes. Add readonly=true to the URL, or choose read-only scope during OAuth. Reads and schema inspection stay; writes, migrations and run_sql_transaction are disabled.1
Can the Neon MCP server delete a project?
Yes, through delete_project, unless you scope the server to one project, which hides that tool.2
Is it safe to run migrations with the Neon MCP server?
The prepare step tests the migration on a temporary branch first; the complete step applies it to the main branch.2 Review the SQL before the second step, and keep production migrations in your own pipeline.
Written with AI assistance and checked against our claims register.