MCP.Market

sw-postgres-mcp server

by jpka·io.github.jpka/sw-postgres-mcp·v0.3.1
No reviews yet

Safe-write Postgres MCP server with preview-before-execute writes and rollback safety.

B83/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
Growing

0 stars31 downloads/wk

Reviews

Write one

Nobody has reviewed sw-postgres-mcp yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

sw-postgres-mcp tools (8, 6 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • delete_rowswrite action

    Preview a DELETE (two-phase). Runs the statement inside a transaction, returns the exact affected row count and a sample of affected rows, then rolls back. Nothing is changed until execute_plan is called with the returned plan_token. Requires a WHERE clause unless confirm_full_table is true.

  • describe_schema

    Describe the database schema: tables, columns with types, foreign keys, and row-count estimates. Respects the read allowlist in config.

  • execute_planwrite action

    Execute a previously previewed write. Pass the exact plan_token, statement, and params from the preview (delete_rows, insert_rows, update_rows, or run_migration). The token is single-use, expires, and refuses any statement that does not match the preview. For delete_rows and update_rows, it also refuses to commit if the affected row set changed since the preview; insert_rows and run_migration have

  • explain_plan

    Return the planner's estimated cost and row count for a candidate read statement, without executing it. A cheap pre-check to reject obviously expensive statements before running them. Takes a `reason` string.

  • insert_rowswrite action

    Preview an INSERT (two-phase). Runs the statement inside a transaction, returns the exact row count and a sample of inserted rows via RETURNING, then rolls back. Nothing is changed until execute_plan is called with the returned plan_token. Note: a rolled-back preview still advances any serial/identity sequence the table's columns default from — Postgres sequences are not transactional, so previewi

  • querywrite action

    Run a read-only SELECT against the database and return the rows. Runs on the readonly role, so mutating statements are refused by the database. Respects the read allowlist in config. Takes a `reason` string.

  • run_migrationwrite action

    Preview a DDL migration (two-phase): CREATE TABLE, ALTER TABLE, DROP TABLE, or CREATE INDEX. Runs the statement inside a transaction, then rolls back — Postgres DDL is transactional, so nothing is changed until execute_plan is called with the returned plan_token. Unlike delete_rows/insert_rows/update_rows, run_migration ALWAYS requires human approval through the localhost approval UI before execut

  • update_rowswrite action

    Preview an UPDATE (two-phase). Runs the statement inside a transaction, returns the exact affected row count and a sample of affected rows (post-update) via RETURNING, then rolls back. Nothing is changed until execute_plan is called with the returned plan_token. Requires a WHERE clause unless confirm_full_table is true (the same guard delete_rows uses).

Public scan report

scanner v0.1.9 · 2026-09-23 · same rubric, same numbers if you re-run it

no findings
  • Code scan38 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 19 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How sw-postgres-mcp compares

Against every graded Databases MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
83/100
higher than 60% of 802 Databases servers
Tools
8
the typical Databases server has 8
Tools that change things
75%
typical: 10%. Fewer write tools means less an agent can break
Downloads a week
31
more than 18% of 324 Databases servers with a package

What its tools let an agent do: 2 read · 1 create · 2 change · 1 delete · 2 run or deploy

Install sw-postgres-mcp in Claude Code, Cursor or VS Code

Runs npx -y sw-postgres-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add sw-postgres-mcp -- npx -y sw-postgres-mcp
Add to Cursor

What the publisher says

From the sw-postgres-mcp repository's README, as published. We do not edit it. Read it on GitHub

Safe-write Postgres MCP server

An agent can read and modify a database without being able to cause an unrecoverable accident. The differentiator is the safety layer, not the tool coverage: 8 MCP tools, 3 of them read-only, 4 write tools that only ever preview a change, and one execute_plan that commits a previewed change and nothing else.

Architecture

Claude (agent)
      │  MCP stdio (tools/call)
      ▼
 sw-postgres-mcp
 │
 ├─ describe_schema / query / explain_plan ──► readonly pool ──► Postgres "readonly" role (SELECT only)
 │
 ├─ delete_rows / insert_rows / update_rows / run_migration
 │     │
 │     ▼
 │  TwoPhaseWrite.preview()
 │     BEGIN → run the real statement → ROLLBACK
 │     DML (delete_rows/insert_rows/update_rows): capture exact RETURNING count + sample
 │     DDL (run_migration): no RETURNING to capture — reports 0 affected rows, a `target`
 │                           table/schema extracted from the statement text, and always
 │                           goes to "awaiting_approval" regardless of that row count
 │     └─► plan_token = sha256(statement + params)   ("statementFingerprint")
 │           ├─ affected_rows ≤ approvalRequiredAboveRows  → status: "previewed"
 │           ├─ affected_rows >  approvalRequiredAboveRows → status: "awaiting_approval"
 │           └─ affected_rows >  hardMaxRows               → refused outright, no token issued
 │           (run_migration ignores both thresholds — every DDL preview is "awaiting_approval")
 │
 ├─ execute_plan(plan_token, statement, params) ──► writer pool ──►

Two Postgres connection pools, each authenticated as a distinct role (see Threat model below): readonly for describeschema/query/explainplan, writer for the four write-preview tools and executeplan. All 4 write tools — deleterows, insertrows, updaterows, runmigration — share one core, TwoPhaseWrite (src/writeCore.ts): every one of them previews inside a transaction that always rolls back, then requires a separate executeplan call with the exact plan token to actually commit. There is no 5th write tool and no tool that skips the preview step — execute_plan is the only thing in this server that commits anything, and it only ever replays a statement that was already previewed. See Tools below for what each tool takes and returns, and Two-phase writes for the mechanics.

Threat model

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

sw-postgres-mcp: common questions

Is sw-postgres-mcp server safe?
Mostly: it is graded B (83/100). Read the sw-postgres-mcp safety report
How do I install sw-postgres-mcp?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does sw-postgres-mcp need an API key?
Yes. The registry entry asks for DATABASE_URL_READONLY, DATABASE_URL_WRITER.
Is sw-postgres-mcp maintained?
The last commit was 59 days ago (2026-09-04). The latest release is v0.3.1.
What can I use instead of sw-postgres-mcp?
Servers from other publishers that do the same job: Quarry MCP server, CogniCore MCP server and Appwrite MCP server.
How does sw-postgres-mcp compare with other Databases MCP servers?
safety score 83/100 (higher than 60% of 802 Databases servers); tools 8 (the typical Databases server has 8); tools that change things 75% (typical: 10%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to sw-postgres-mcp

Same job from other publishers: the closest match first, then the best rated.

  • Quarry
    Safety-railed database access: Postgres, MySQL, SQLite, Redis. Read-only by default.
    A
  • CogniCore
    Memory, reflection and safety for AI agents. Hosted or local, no vector database.
    A
  • Appwrite
    Build and deploy backends: auth, Postgres/MySQL/vector databases, storage, functions, hosting, CDN
    A
  • Ekwo OS — open source accounting: ledger, invoices and VAT on your own Supabase or Postgres
    Double-entry books an agent keeps as the user: invoices, VAT returns, 174 country packs.
    A
  • Run402
    x402 pay-per-call infra for agents: $0.03 image generation, Postgres, auth, storage, functions.
    B