Pg Readonly MCP server

<!-- mcp-name: io.github.les-k/pg-readonly-mcp -->

pg-readonly-mcp

In plain terms: this lets an AI look at your database and do nothing else.

Not because it was told not to write — the database login it uses is physically

incapable of writing. The official version of this tool had a published flaw

that let a "delete everything" command slip past its safety check; this one is

tested against that exact attack.

A read-only Postgres MCP server that parses SQL rather than pattern-matching it — because the alternative has already failed in public, once, in a way that is worth being specific about.

The bypass this exists to close

Anthropic's reference Postgres MCP server enforced "read-only" by wrapping each query in a read-only transaction. It also accepted semicolon- delimited multi-statement input. That combination is exploitable:

SELECT 1; COMMIT; DROP SCHEMA public CASCADE;

The COMMIT ends the read-only transaction early. Everything after it runs at full session privilege. Datadog Security Labs disclosed this in 2026; the server was deprecated and archived — and the vulnerable package was still pulling 21,000 weekly downloads after that.

A read-only transaction is a property of how a query runs. It says nothing about what the query is, which is exactly why it was possible to talk your way out of it. This server checks the second thing instead.

Two independent layers

Either one alone would have stopped the disclosed bypass. Both exist because a flaw in one should not be the only thing standing between an agent and a write.

1. The SQL is parsed, not scanned. guard.py uses sqlglot to build a real syntax tree and applies three checks:

semicolons the way a driver would, so the payload above becomes three statements and is refused before any of them reach a connection.

• Exactly one statement. sqlglot.parse splits on statement-terminating

EXCEPT, or a CTE built from those. DROP TABLE users is refused here.

• The outer statement is a read shape — SELECT, UNION, INTERSECT,

other two cannot replace: Postgres allows a CTE to carry a data-modifying statement, so WITH x AS (DELETE FROM t RETURNING ) SELECT FROM x is, at the outer level, a SELECT. A check that only looks at the outer shape misses this completely. Walking every node finds the DELETE regardless of how many levels down it sits.

• No write anywhere in the tree, walked in full. This is the check the

An unrecognised statement shape — anything sqlglot has no specific rule for — is refused by the same rule as everything else. Unfamiliar is not the same as safe.

2. The connection itself cannot write, independent of what it is asked to run. checkconnectionis_readonly refuses to start if the connected role is a superuser, can create databases or roles, can bypass row-level security, or holds any grant beyond SELECT on any table it can see. Not exhaustive — Postgres privilege can also arrive through ownership, PUBLIC grants, or RLS policies this check does not enumerate — but it catches the two ways a misconfiguration most commonly shows up, stated here rather than implied.

What it does not protect against

Shortened. The full README is on GitHub.