{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_c29dajnzbg7j","handle":"pg-guard-mcp","url":"https://wellknown.network/agents/pg-guard-mcp","links":{"self":"https://wellknown.network/agents/pg-guard-mcp/record.json","html":"https://wellknown.network/agents/pg-guard-mcp","markdown":"https://wellknown.network/agents/pg-guard-mcp/record.md","api":"https://wellknown.network/api/v1/agents/pg-guard-mcp","status":"https://wellknown.network/api/v1/agents/pg-guard-mcp/status","claim":"https://wellknown.network/agents/pg-guard-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/pg-guard-mcp/claim.json","badge":"https://wellknown.network/agents/pg-guard-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json"},"ard":{"identifier":"urn:air::server:pg-guard-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"pg-guard-mcp","summary":"A PostgreSQL MCP server that enforces read-only access at the protocol and privilege level — not by parsing the query string.","description":"# pg-guard-mcp\n\n[![PyPI](https://img.shields.io/pypi/v/pg-guard-mcp.svg)](https://pypi.org/project/pg-guard-mcp/)\n\nA PostgreSQL MCP server that enforces read-only access at the **protocol and privilege level** — not by parsing the query string and hoping.\n\n## Install\n\n```bash\npip install pg-guard-mcp\n# or, without installing anything permanently:\nuvx pg-guard-mcp\n```\n\n## Why this exists\n\nThe official `@modelcontextprotocol/server-postgres` shipped a read-only mode that a single `COMMIT;` could bypass: it wrapped the agent's query in `BEGIN TRANSACTION READ ONLY` and sent the whole thing as one string. Postgres accepts semicolon-separated multiple statements in that mode, so `SELECT 1; COMMIT; DROP SCHEMA public CASCADE;` closed the read-only transaction early and ran the drop as an ordinary write. The package was deprecated over it. ([Datadog Security Labs writeup](https://securitylabs.datadoghq.com/articles/mcp-vulnerability-case-study-SQL-injection-in-the-postgresql-mcp-server/))\n\npg-guard-mcp exists because that bug class — \"read-only\" enforced only by string inspection — is still common across the MCP ecosystem. It defends in three independent layers, so no single mistake is fatal:\n\n1. **Protocol layer (the real boundary).** Every query runs through Postgres's *extended* query protocol (`Parse`/`Bind`/`Execute`), never the simple query protocol. The extended protocol structurally rejects more than one statement per `Parse` message — Postgres itself refuses it, before any of our code runs. This is why the Datadog exploit cannot work here regardless of what string is submitted.\n2. **Session layer.** Every connection sets `default_transaction_read_only = on` at the session level, so even a query that somehow reached the database as a write is rejected by Postgres.\n3. **Pre-flight layer.** Before a query is even sent, it's checked for multiple statements and transaction-control keywords (`COMMIT`, `ROLLBACK`, `BEGIN`, `SAVEPOINT`, ...) and rejected with a clear err…","publisher":{"name":"Berkant Acun","url":null},"homepage":null,"repository":null,"version":"0.2.0","license":"MIT","protocols":["mcp"],"tags":["mcp","model-context-protocol","postgres","postgresql","read-only","security"],"pricing":null,"endpoints":[{"url":"pypi:pg-guard-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","summary":"pypi","version":"pypi","description":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"data.database","name":"Databases","confidence":1,"provenance":"declared"},{"slug":"dev.package-management","name":"Packages & Dependencies","confidence":0.768,"provenance":"derived"}],"categories":["data","dev"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"pg-guard-mcp","registry":"pypi","observedAt":"2026-09-10T09:27:02.967Z","publishedAt":"2026-08-24T17:06:12.757465Z","latestVersion":"0.2.0"}},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"pg-guard-mcp","url":"https://pypi.org/project/pg-guard-mcp/","firstSeenAt":"2026-09-10T09:26:11.632Z","fetchedAt":"2026-09-10T09:26:11.632Z","normalizedAt":"2026-09-10T09:26:11.632Z"}]},"firstSeenAt":"2026-09-10T09:26:11.632Z","updatedAt":"2026-09-10T09:27:02.967Z"}