MCP.Market

PgVouch MCP server

by Shubh-Sgr·io.github.Shubh-Sgr/pgvouch·v0.4.4
No reviews yet

Safe PostgreSQL migrations: schema drift, lock analysis, safe rewrites, data checksums. Read-only.

B83/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
Growing

0 stars53 downloads/wk

Reviews

Write one

Nobody has reviewed PgVouch yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

PgVouch tools (7)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • analyze_locks

    Parse a SQL migration with PostgreSQL's own parser and predict, per statement: the table lock taken, whether it blocks reads/writes, whether it scans or rewrites the table, and a risk level using the target table's size. Also warns about missing lock_timeout and CONCURRENTLY inside transactions.

  • check_lock_queue

    Live check on the TARGET: for each statement, compares the table lock it needs with the locks other sessions hold or are waiting for right now (pg_locks, full Postgres conflict table), and lists open transactions that CREATE INDEX CONCURRENTLY would wait for. Verdict: safe_now or would_wait (with the sessions: pid, user, application, state, transaction age, lock mode). Never returns other sessions

  • detect_drift

    Compare the SOURCE (reference) and TARGET PostgreSQL schemas: tables, columns, types, nullability, defaults, indexes, constraints, sequences. Returns every difference with a severity. 'missing' = in source but not target; 'extra' = only in target.

  • find_differing_rows

    For one table, bisect mismatched chunks (binary search over checksums) to find the exact rows that differ: missing on target, extra on target, or changed (with the changed column names). By default returns primary keys and column names only, not values.

  • plan_migration

    Build an ordered, safe migration plan that makes TARGET match SOURCE. If an LLM is configured, its plan must pass a validator (objects exist, only allow-listed statements, no unsafe DDL) and then a shadow run: PgVouch starts a disposable local Postgres container, copies the target's schema (no data) into it, applies the plan as a non-superuser and checks the result matches SOURCE. Otherwise the de

  • suggest_safe_rewrite

    Rewrite risky DDL into safe, non-blocking steps using deterministic rules (CREATE INDEX CONCURRENTLY, NOT VALID + VALIDATE, expand/contract for NOT NULL columns and type changes, batched backfills). Returns a commented script that starts with SET lock_timeout and statement_timeout. It is NOT executed.

  • verify_data

    Prove that table data is identical on source and target by comparing MD5 hashes of primary-key chunks computed inside Postgres (no rows are transferred). Returns per-table status and the key ranges of mismatched chunks, plus a check that every identity/serial sequence on the target is ahead of its data (a sequence left behind makes the next INSERT fail with a duplicate key). If the target is still

Public scan report

scanner v0.1.10 · 2026-10-14 · same rubric, same numbers if you re-run it

no findings
  • Code scan48 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 8 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How PgVouch compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
83/100
higher than 65% of 48,255 servers
Tools
7
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
53
more than 44% of 12,191 servers with a package

What its tools let an agent do: 7 read

Install PgVouch in Claude Code, Cursor or VS Code

Runs npx -y pgvouch on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add pgvouch -- npx -y pgvouch
Add to Cursor

What the publisher says

From the PgVouch repository's README, as published. We do not edit it. Read it on GitHub

PgVouch

An MCP server + CLI that lets AI assistants safely inspect, plan and prove PostgreSQL migrations. The LLM proposes; deterministic code decides.

Real output against the seeded demo databases (1M transactions, 2M ledger entries) with the target broken as in step 2 below. Typing is real-time; command run times are shortened (the verify run took 14.0 s).

The problem

Writing ALTER TABLE is the easy part of a database migration. The hard parts are:

  1. What differs? Schemas drift between environments (hotfixes, failed migrations, manual changes).
  2. What will it lock? CREATE INDEX on a busy table blocks every write until it finishes. A "1 ms" ALTER TABLE can still cause an outage by waiting in the lock queue.
  3. Is the data really the same? "Row counts match" is not proof.
  4. Which rows are wrong? When proof fails, you need the exact rows, not "something in this 2M-row table".

AI assistants now write migrations, but they hallucinate objects, ignore locks and can't prove anything. PgVouch gives them (and you) read-only tools that answer those four questions, and it wraps every AI suggestion in deterministic checks.

Results (measured, not estimated)

All numbers come from npm run eval against the seeded Docker databases. The full tables are in evals/.

Application stall during the migration, measured on the 1M-row table with a probe query every ~10 ms (evals/results-rewrite.md):

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

PgVouch: common questions

Is PgVouch MCP server safe?
Mostly: it is graded B (83/100). Read the PgVouch safety report
How do I install PgVouch?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does PgVouch need an API key?
Yes. The registry entry asks for SOURCE_DATABASE_URL, TARGET_DATABASE_URL.
Is PgVouch maintained?
The last commit was 29 days ago (2026-10-06). The latest release is v0.4.4.
How does PgVouch compare with other MCP servers?
safety score 83/100 (higher than 65% of 48,255 servers); tools 7 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.