Mmcp.market

Is PostgreSQL (hardened, read-only) MCP server safe?

Probably. Read the findings first.

C68/100grade C

Use with care. Some checks failed or could not be verified.

Public scan report

scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it

2 medium
  • Code scan4 source files scanned15/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (2)

  • mediumnpm install lifecycle script presentinstall.script
  • mediumnpm install lifecycle script presentinstall.script
    package.json: … "README.md" ], "scripts": { "postinstall": "node scripts/postinstall.js", "tes…
Overall 68/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Other servers that do what PostgreSQL (hardened, read-only) does

  • DB Access
    MCP server for Postgres/MySQL/Redshift/SQL Server over SSH/SSM tunnels with secret providers.
    A
  • DBHub
    Token-efficient database MCP server for PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLite
    A
  • PostgreSQL
    MCP server for PostgreSQL: local, Docker, RDS, Neon, Supabase, or behind an SSH bastion.
    B

PostgreSQL (hardened, read-only) reviews, tools and install