// SCAN REPORT

Postgres

36 tools. 13 can modify or destroy data without limits.

1 destructive tool with no built-in limits. Policy required.

Last updated: 2 Jul 2026

13 can modify or destroy data

23 read-only

36 tools total

Community server · catalogue entry verified 02/07/2026

How to control Postgres ↓

TOOL MAP

What Postgres exposes to your agents

Read (23) Write / Execute (12) Destructive / Financial (1)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Postgres tools

Financial · Critical transfer_objects Transfer schema (DDL) and/or data from one configured server/database to another (same server, different DB, or fully remote). Builds on the Execute · High batch_execute This tool runs SQL code with effects determined by the caller. Execute · High begin_transaction begin_transaction initiates a database operation with external effects (transaction state changes in PostgreSQL) and is a prerequisite for controlled multi-statement execution. Execute · High dry_run_sql_file This tool executes arbitrary SQL code with real transactional consequences during the dry-run phase.

13 of Postgres's 36 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Postgres

PolicyLayer is an MCP gateway — it sits between your AI agents and Postgres, and nothing reaches the server without passing your rules. These are the rules we recommend:

Block financial tools by default

{
  "transfer_objects": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Requires human approval."
      }
    ]
  }
}

Financial tools should be explicitly enabled per use case, not open by default.

Rate limit write operations

{
  "commit_transaction": {
    "limits": [
      {
        "counter": "commit_transaction_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "analyze_db_health": {
    "limits": [
      {
        "counter": "analyze_db_health_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Postgres — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON POSTGRES →

Instant setup, no code required.

FULL CATALOGUE

All 36 Postgres tools

FINANCIAL 1 tools

Financial transfer_objects Transfer schema (DDL) and/or data from one configured server/database to another (same server, different DB, o

EXECUTE 8 tools

Execute batch_execute Execute multiple SQL queries in parallel. Returns all results keyed by query name. Efficient for fetching mult Execute begin_transaction Start a new database transaction. Returns a transactionId to use with execute_sql, commit_transaction, or roll Execute dry_run_sql_file Execute a SQL file in dry-run mode - actually runs ALL statements within a transaction, captures REAL results Execute execute_sql Execute SQL queries. Supports SELECT, INSERT, UPDATE, DELETE (if not in readonly mode). Use $1, $2 placeholder Execute execute_sql_file Execute a .sql file from the filesystem. Useful for running migration scripts, schema changes, or data imports Execute kill_query Cancel or terminate a backend session by PID. mode= Execute mutation_dry_run Execute INSERT/UPDATE/DELETE in dry-run mode - actually runs the SQL within a transaction, captures REAL resul Execute safe_alter_table Convert a high-level intent (

WRITE 4 tools

Write commit_transaction Commit an active transaction, making all changes permanent. Write export_to_sql_file Export schema (DDL) and/or data from the connected database to a .sql file. Supports four content kinds via th Write generate_seed_data Generate schema-aware fake seed data for a table. Respects NOT NULL, UNIQUE/PK (with retry-with-collision-suff Write switch_server_db Connect to a PostgreSQL server and database. MUST be called before executing queries. Use list_servers to find

READ 23 tools

Read analyze_db_health Run comprehensive database health checks: cache hit rates, connection usage, index health (invalid/unused/dupl Read analyze_query_indexes Recommend indexes for specific SQL queries. Provide up to 10 SELECT queries and get index recommendations. Read analyze_workload_indexes Analyze database workload and recommend indexes. Uses pg_stat_statements to find slow queries and suggests ind Read column_profile Single-pass profile per column: null %, distinct count, top-K values with frequencies, min/max, and type-aware Read describe_table Single rich call describing a table: columns (type/nullable/default + null %/distinct ratio from pg_stats), pr Read detect_migration_state Probe the database for migration tool tracker tables (Liquibase, Flyway, Alembic, Prisma, Knex, Sequelize, Dja Read explain_query Show PostgreSQL Read find_blocking_queries Show currently-blocking sessions in a friendly tree (blocker → blocked) using pg_stat_activity ⨝ pg_blocking_p Read find_dependents Find what depends on a database object before dropping it. Recursively walks pg_depend, classifies dependents Read get_current_connection Get current connection status. Returns server name, database, schema, and access mode (readonly/full). Call th Read get_object_details Get detailed info about a table/view/sequence: columns, data types, constraints, indexes, size, row count. Use Read get_top_queries Find slowest queries from pg_stat_statements. Requires pg_stat_statements extension enabled. Use this to ident Read get_transaction_info Get information about an active transaction, including its name, server, database, and when it started. Read list_databases List databases in a specific PostgreSQL server. REQUIRES serverName parameter - use list_servers first to get Read list_objects List tables, views, materialized views, sequences, or extensions in a schema. Requires active connection. Opti Read list_schemas List all schemas in the current database. Requires active connection (use switch_server_db first). Optionally Read list_servers List all configured PostgreSQL servers. Call this FIRST to discover available server names before using list_d Read list_transactions List all active transactions. Returns transaction details including name, server, database, and start time. Read lock_check Static analysis of a SQL statement to determine the PostgreSQL lock level it will require, whether it forces a Read mutation_preview Preview the effect of INSERT/UPDATE/DELETE without executing. Shows estimated rows affected and sample of rows Read preview_sql_file Preview a SQL file without executing it. Shows statement count, types breakdown, and warnings for potentially Read rollback_transaction Rollback an active transaction, undoing all changes made within it. Read schema_diff Compute the DDL delta between two { server, database, schema } endpoints. Returns objects to CREATE (in source

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Postgres

Can an AI agent move money through the Postgres MCP server? +

Yes. The Postgres server exposes 1 financial tools including transfer_objects. Without a policy, an autonomous agent can call these with no spend caps, no rate limits, and no approval flow. PolicyLayer lets you block financial tools by default, require human approval, or set per-tool rate limits — enforced on every call.

How do I prevent bulk modifications through Postgres? +

The Postgres server has 4 write tools including commit_transaction, export_to_sql_file, generate_seed_data. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Postgres.

How many tools does the Postgres MCP server expose? +

36 tools across 5 categories: Destructive, Execute, Financial, Read, Write. 23 are read-only. 13 can modify, create, or delete data.

How do I enforce a policy on Postgres? +

Register the Postgres MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Postgres tool call.

Deterministic rules across all 36 Postgres tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON POSTGRES →

Instant setup, no code required.

36 Postgres tools catalogued and risk-classified — across an index of 43,000+ MCP servers.