MCP.Market

pgops MCP server

by arzharch·io.github.arzharch/pgops-mcp·v0.1.9
No reviews yet

Safe, audited PostgreSQL operations for AI agents: queries, migrations, EXPLAIN, containers

B78/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B78/100

full report

Adoption
New

0 stars27 downloads/wk

Reviews

Write one

Nobody has reviewed pgops yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

pgops tools (18, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • container.execwrite action

    Run a read-only diagnostic command inside a container. Requires --approval-mode AND a confirmation token, and the command must be in the diagnostic allowlist — this tool does not offer an arbitrary shell.

  • container.logs

    Tail a container's logs, optionally filtered to a minimum Postgres severity (DEBUG/INFO/NOTICE/LOG/WARNING/ERROR/FATAL/PANIC).

  • container.restart

    Restart a container. Requires --approval-mode AND a confirmation token. Dropping connections is disruptive; relay the reason to the user first.

  • container.stats

    CPU, memory and IO snapshot for a container. Takes about a second: a CPU percentage requires two samples to compute a delta.

  • db.health

    Health snapshot: connections, cache hit ratio, dead tuples, long-running queries, waiting locks — each finding with a severity and explanation.

  • env.correlate

    Join db.health findings with the database container's resource usage and return plain-language hints about whether container pressure explains the database's symptoms.

  • env.topology

    Discover containers, compose projects, ports and health, and identify which container serves this server's DSN (matched by published host port).

  • index.advise

    Index recommendations: unused indexes, redundant indexes, sequential-scan hotspots, and the slowest statements by total time.

  • migration.apply

    Apply a plan produced by migration.plan.

  • migration.describe

    Plan a schema change described in plain English.

  • migration.history

    Applied-migration history from the ledger, including any interrupted (in_flight) migration. Each entry carries the `ledger_id` that migration.rollback and migration.resolve take.

  • migration.plan

    Plan a migration from a target schema. Executes nothing.

  • migration.resolve

    Close out an interrupted (in_flight) migration, unblocking further ones.

  • migration.rollback

    Reverse an applied migration by its ledger id (from migration.history).

  • query.explain

    Explain a statement and return the plan plus actionable verdicts.

  • query.readwrite action

    Execute a read-only statement (SELECT/WITH/EXPLAIN only).

  • query.writewrite action

    Execute a mutating statement (INSERT/UPDATE/DELETE/DDL).

  • schema.inspect

    Inspect database structure: tables, columns, indexes, constraints, sizes.

Public scan report

scanner v0.1.10 · 2026-10-29 · same rubric, same numbers if you re-run it

no findings
  • Code scan36 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 58 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How pgops compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
78/100
higher than 57% of 48,243 servers
Tools
18
the typical server has 7
Tools that change things
17%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
27
more than 14% of 12,306 servers with a package

What its tools let an agent do: 13 read · 1 create · 1 change · 3 run or deploy

Install pgops in Claude Code, Cursor or VS Code

claude mcp add pgops-mcp -- uvx pgops-mcp
Add to Cursor

What the publisher says

From the pgops repository's README, as published. We do not edit it. Read it on GitHub

pgops-mcp

<!-- mcp-name: io.github.arzharch/pgops-mcp -->

**Let an AI assistant operate your PostgreSQL database — without letting it wreck

anything.**

Point Claude, Cursor, or VS Code at a database and ask questions in plain English. Your assistant gets 18 tools for inspecting schemas, running queries, diagnosing slow ones, and planning migrations. What it does not get is a way to quietly destroy your data.

What it actually looks like

Every number below is real output from the demo database in this repo — 1.2M rows, 114 MB.

You: I want to index orders.status

Assistant: (calls migration.plan)

CREATE INDEX "idx_orders_status" ON "orders" (status)
  risk=medium   estimate=4000ms   confidence=medium
  blocks:  writes yes, reads no
  SAFER:   CREATE INDEX CONCURRENTLY "idx_orders_status" ON "orders" (status)

Assistant: A plain index build blocks writes for roughly 4 seconds. CONCURRENTLY

is slower overall but keeps writes working. Which do you want?

The tool didn't return a raw plan for the model to interpret — it returned a verdict, a duration estimate with an honest confidence level, and the safer alternative.

query.explain works the same way. Instead of handing back JSON, it says things like:

planner overestimated rows by 5833x (estimated 239,160, actual 40)
  -> run ANALYZE; if it persists the columns may be correlated, consider CREATE STATISTICS

And when something is genuinely dangerous

You: clear out the orders table

Assistant: (calls query.write with DELETE FROM orders)

CONFIRMATION_REQUIRED
DELETE has no WHERE clause and would affect every row in the table

Where your client supports it, the approval prompt goes to you — not to the assistant. Nothing runs until a human answers, and the refusal is written to the audit log whether or not you approve.

That last part is the point. The assistant cannot approve its own dangerous action, because it is not the one being asked. Where a client can't show a prompt, it degrades to a single-use token bound to that exact statement — never to "allowed".

Why this exists

Most Postgres MCP servers are thin query wrappers: introspect and SELECT. None handle migrations with lock-impact analysis, none diagnose performance from EXPLAIN and pgstatstatements, and none understand the container the database runs in. Agents operating databases today are doing it blind, and without guardrails.

pgops-mcp is the operations brain: schema intelligence → guarded queries → migration engine → performance diagnosis → environment awareness, with a safety architecture that makes every action classifiable, confirmable, and auditable.

Native AI/ML Extension Support: Because pgops builds on core Postgres catalogs rather than brittle regex parsing, it inherits native support for custom types and extensions like pgvector. Tools like migration.plan and query.explain understand vector types (vector(384)) and hnsw indexes out of the box, with zero configuration.

New here? docs/GETTING_STARTED.md is a 15-minute guided tour that assumes no MCP knowledge.

Tool surface

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

pgops: common questions

Is pgops MCP server safe?
Mostly: it is graded B (78/100). Read the pgops safety report
How do I install pgops?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does pgops need an API key?
Yes. The registry entry asks for PGOPS_DSN, PGOPS_READONLY_DSN.
Is pgops maintained?
The last commit was 65 days ago (2026-09-01). The latest release is v0.1.9.
How does pgops compare with other MCP servers?
safety score 78/100 (higher than 57% of 48,243 servers); tools 18 (the typical server has 7); tools that change things 17% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.