What is Postgres MCP Server (Microsoft)?
Microsoft's postgres-mcp is a general PostgreSQL MCP server, not one tied to Azure. It works with local, Docker and on-premises Postgres as well as Azure Database for PostgreSQL, Amazon RDS and Aurora, Google Cloud SQL and AlloyDB, and other wire-compatible servers. It ships as a self-contained binary inside the npm package @microsoft/postgres-mcp and runs with npx -y @microsoft/postgres-mcp run over stdio. It needs Node.js 22 or later.
It is marked as a preview. The repository was created in July 2026, has about 72 GitHub stars and is MIT-licensed. Version 0.3.0 reached npm on 22 October 2026, and v0.2.0 renamed every tool from pgsql_* to postgres_mcp_*. Even so, it had 27,344 npm downloads in the week to 29 October 2026. Connections are saved as named profiles with passwords in the operating system keyring. Azure hosts sign in with Microsoft Entra ID automatically when no password is stored.
How to install Postgres MCP Server (Microsoft)
npx -y @microsoft/postgres-mcp runIs Postgres MCP Server (Microsoft) worth it?
The best thing about this server is its security documentation, which is unusually frank. The usage guide says the server is "a gateway, not a policy engine": it cannot tell a query you meant from one a prompt-injected model invented, so anything the database role can do, the agent can do. The guide then lays out who is responsible for what and gives a ten-point hardening checklist covering least-privilege roles, read-only profiles, pgaudit and statement timeouts. Most database MCP servers leave that unsaid.
The design backs it up where it can. postgres_mcp_query accepts only single read-only statements, and writes go through a separate postgres_mcp_modify tool that a profile set to access_mode ro blocks. Passwords never enter the client config or the agent's tool arguments; they are set by CLI into the OS keyring. Secrets are scrubbed from error text, and Entra ID connections always verify TLS certificates. The catch is that new profiles allow writes unless you say otherwise.
Its 13 tools are fewer than crystaldba's Postgres MCP Pro offers for tuning, and there is no index-advisor equivalent. postgres_mcp_get_metrics_group collects performance metrics, postgres_mcp_db_context returns CREATE scripts for the schema, and a COPY-based CSV loader reads only from approved paths. That approval includes the server's startup directory by default, which can surprise people.
The preview label is meaningful. Tool names and environment variables changed in v0.2.0 less than two months after launch, and the changelog for v0.3.0 says only "Bug fixes". Telemetry is on by default: pseudonymous tool names, durations and outcomes, but no query text, until you pass --no-telemetry. The server speaks stdio only, so a shared remote deployment needs something else in front of it.
Where it earns its place
A backend engineer debugging a slow Postgres 16 service
Ask the agent what is slowing the server down right now
postgres_mcp_get_server_capabilities probes what is available, postgres_mcp_get_metrics_group pulls the metric groups, and postgres_mcp_query reads pg_stat views. Free; set a read-only profile and role first so the agent cannot fix things unasked.
A platform team on Azure Database for PostgreSQL with Entra-only auth
Give developers agent access without handing out database passwords
Profiles on *.postgres.database.azure.com sign in with az login or a service principal, and --login-as-user lets the token act as an Entra group role. The database bill is unchanged; agent traffic shows under that role for auditing.
A data analyst at a 30-person retailer
Load a supplier CSV into a staging table and compare it with last month's orders
allow-access-to-path approves the imports folder, postgres_mcp_bulk_load_csv loads it with COPY, and read-only queries do the comparison. Keep writes behind client approval; the guide warns against auto-approving bulk loads.
Before you commit
- Setup
- Run npx -y @microsoft/postgres-mcp connection add <name> "<uri>" and connection set-password <name>, then add npx -y @microsoft/postgres-mcp run to the client. Snippets cover Copilot CLI, Claude Code, Cursor, Claude Desktop, VS Code, Codex and Open Code. Node.js 22+; minutes to a first query.
- Integrations
- 13 tools: connection profile management, list databases, db_context for CREATE scripts, read-only query, modify for DDL and DML, CSV describe and bulk load, and two diagnostics tools. Four of them change state.
- Data and privacy
- Runs as the profile's database role. Profiles live in ~/.postgres-mcp/connections.yaml; passwords live in the OS keyring. Pseudonymous telemetry of tool names and outcomes is on unless you pass --no-telemetry. Query results and comments are untrusted input that can carry prompt injection.
- Cost at scale
- Free; cost is your Postgres instance. Each query result enters the model's context, so wide SELECTs are the main token cost. The default query timeout is 9 minutes.
- Limits
- Preview status, stdio only, and MCP protocol version 2024-11-05 per the guide. There is no index advisor or query-plan tuning tool to match Postgres MCP Pro. The CSV allowlist includes the startup directory unless POSTGRES_MCP_DISABLE_CWD_ACCESS is set.
What’s good
- Passwords in the OS keyring, never in client config
- Read-only query tool separate from DDL and DML
- Entra ID sign-in, including group login, for Azure Postgres
- Clear published security model and hardening checklist
What’s not
- Preview; tool names changed in v0.2.0
- New profiles permit writes unless set to read-only
- Telemetry on by default
- stdio only; no hosted or HTTP mode
Best for
Teams pointing coding agents at Postgres, especially on Azure, who want credentials out of config files and a clear read-only path.
Postgres MCP Server (Microsoft) alternatives
Postgres MCP Server (Microsoft): common questions
- Is Postgres MCP Server (Microsoft) worth it?
- Microsoft's Postgres server gets credentials right and is honest that it is plumbing, which makes it the safer default while it is still in preview. We rate it 4.0 out of 5.
- How much does Postgres MCP Server (Microsoft) cost?
- Free and open source (MIT). You pay only for your PostgreSQL hosting.
- What are the downsides of Postgres MCP Server (Microsoft)?
- Preview; tool names changed in v0.2.0; new profiles permit writes unless set to read-only; telemetry on by default; stdio only; no hosted or HTTP mode.
- Who is Postgres MCP Server (Microsoft) best for?
- Teams pointing coding agents at Postgres, especially on Azure, who want credentials out of config files and a clear read-only path.
- How much does Postgres MCP Server (Microsoft) cost for a team or in production?
- Free; cost is your Postgres instance. Each query result enters the model's context, so wide SELECTs are the main token cost. The default query timeout is 9 minutes.
- Is Postgres MCP Server (Microsoft) safe for company data?
- Runs as the profile's database role. Profiles live in ~/.postgres-mcp/connections.yaml; passwords live in the OS keyring. Pseudonymous telemetry of tool names and outcomes is on unless you pass --no-telemetry. Query results and comments are untrusted input that can carry prompt injection.
- What are the best Postgres MCP Server (Microsoft) alternatives?
- The closest alternatives we have reviewed are DBHub, Supabase MCP Server, Neon MCP Server and MCP Toolbox for Databases.
Answers checked Oct 31, 2026.
Make Postgres MCP Server (Microsoft)? Show this rating on your site
