run_ddl_query

THE RISK

Critical Risk

Why run_ddl_query needs a policy

DDL operations include DROP (irreversible deletion of tables, schemas, databases), ALTER (structural changes that can destroy data), and TRUNCATE. Since the tool permits arbitrary raw DDL, an AI agent could issue DROP TABLE or DROP DATABASE, causing catastrophic and unrecoverable data loss. This warrants the Destructive category at critical severity.

From the tool's definition 'Run a raw DDL SQL query, like CREATE, ALTER, DROP, etc.' — explicitly includes DROP which irreversibly destroys database objects

Documented attack patterns abuse exactly the kind of access run_ddl_query gives an agent:

POLICY

How to control run_ddl_query

PolicyLayer is an MCP gateway — it sits between your AI agents and Pgsql, and nothing reaches the server without passing your rules. This is the rule we recommend for run_ddl_query:

policy.json

{
  "version": "1",
  "default": "deny",
  "hide": [
    "run_ddl_query"
  ]
}

run_ddl_query disappears from the agent's tool list entirely, and any attempt to call it is denied. The rest of the server keeps working.

Create a free account and register Pgsql — nothing to install.
Add this policy — paste it, or build it visually.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

RESTRICT THIS TOOL →

Free to start. No card required.

EXPLORE

Related tools and policies

More Pgsql tools

Destructive run_dml_query Run a raw DML query, like INSERT, UPDATE, DELETE, etc. Execute run_dcl_query Run a raw DCL SQL query, like GRANT, REVOKE, etc. Read run_dql_query Run a raw DQL SQL query, like SELECT, SHOW, DESCRIBE, EXPLAIN, etc. Read get_columns Get all columns in a table. Read get_foreign_keys Get foreign keys in a table. Read get_indexes Get all indexes in a table. Read get_schema_names Get all schema names. Read get_tables Get all tables in a schema.

All 9 Pgsql tools →

Destructive tools on other servers

Android Forensics ADB MCP Server create_full_backup 0xarchive web3_revoke_key Frida Game Hacking MCP clear_scan cPanel MCP Server clear_spam_box

Go deeper

Critical-risk tools in Pgsql → Every critical-risk tool this server exposes, in one view.
All critical-risk MCP tools → Every critical-risk tool across the catalogue, and the policy pattern that contains them.
The MCP Attack Database → Documented attack patterns against MCP deployments — and the policies that stop them.
Blast radius → How much damage one compromised or confused agent can do — and how to bound it.
Tool call approval → Approval gates on individual tool calls: auto-allow, prompt, or deny.
Rate Limiting MCP Tool Calls: A Practical Guide →
MCP Security: Why Prompt Guardrails Aren't Enough →

FAQ

Questions about run_ddl_query

What does the run_ddl_query tool do? +

Run a raw DDL SQL query, like CREATE, ALTER, DROP, etc. It is categorised as a Destructive tool in the Pgsql MCP Server, which means it can permanently delete or destroy data. Block by default and require explicit approval.

How do I enforce a policy on run_ddl_query? +

Register the Pgsql MCP server in PolicyLayer and add a rule for run_ddl_query: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Pgsql. Nothing to install.

What risk level is run_ddl_query? +

run_ddl_query is a Destructive tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.

Can I rate-limit run_ddl_query? +

Yes. Add a rate_limit block to the run_ddl_query rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block run_ddl_query completely? +

Set action: deny in the PolicyLayer policy for run_ddl_query. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides run_ddl_query? +

run_ddl_query is provided by the Pgsql MCP server (twn39/pgsql-mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

Enforce policy on every Pgsql tool call.

Start from Pgsql, add the rest of your stack, and see everything your agents can call. Then put policy on all of it.

CHECK YOUR STACK →