{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_hdrew46hhscy","handle":"psql-mcp","url":"https://wellknown.network/agents/psql-mcp","links":{"self":"https://wellknown.network/agents/psql-mcp/record.json","html":"https://wellknown.network/agents/psql-mcp","markdown":"https://wellknown.network/agents/psql-mcp/record.md","api":"https://wellknown.network/api/v1/agents/psql-mcp","status":"https://wellknown.network/api/v1/agents/psql-mcp/status","claim":"https://wellknown.network/agents/psql-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/psql-mcp/claim.json","badge":"https://wellknown.network/agents/psql-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json"},"ard":{"identifier":"urn:air::server:psql-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"psql-mcp","summary":"Hardened, read-only Postgres MCP server with credential isolation","description":"# psql-mcp\n\nA hardened, **read-only** Postgres [MCP](https://modelcontextprotocol.io) server.\nGive an LLM (Claude Code, etc.) safe query access to one or more databases —\nwithout giving it the ability to write, run DDL, shell out, read server files, or\nsee your connection credentials.\n\nExtracted and generalized from a per-repo server used in production. The security\ncore (`psql_mcp/hardening.py`) is unit-tested and unchanged from that origin.\n\n## What it guarantees\n\nEvery query is validated and then wrapped so the **Postgres engine itself** — not\nthis Python — enforces read-only:\n\n```sql\nSET default_transaction_read_only = on;\nBEGIN READ ONLY;\n  <your SQL>\n;\nROLLBACK;\n```\n\nOn top of that, pre-flight validation rejects:\n\n- **psql meta-commands** (`\\!`, `\\copy`, `\\g`, `\\gexec`, …) anywhere they'd be\n  interpreted — including mid-line after SQL — closing the `\\!` shell-escape.\n- **Read-only escapes**: `RESET`, `DISCARD`, `SET SESSION AUTHORIZATION`,\n  `SET ... READ WRITE`, `transaction_read_only`, `SESSION CHARACTERISTICS`, and\n  transaction control (`BEGIN`/`COMMIT`/`ROLLBACK`/`SAVEPOINT`/`START TRANSACTION`).\n  `CASE … END` is unaffected.\n- **Filesystem / shell reach**: `COPY … PROGRAM`, non-`STDOUT` `COPY`,\n  `pg_read_file` and the `pg_ls_*dir` family, `lo_import`/`lo_export`.\n- **Obfuscation**: `U&'…'` unicode-escape introducers and dynamic-SQL executors\n  (`dblink*`, `query_to_xml*`) that could assemble a blocked name at runtime.\n\nOutput is streamed under a 60 KB cap and a 60s timeout, killing the whole psql\nprocess group (not just a wrapping `bash`) so a runaway `SELECT` can't exhaust\nmemory or hang the server. stderr is always surfaced so a blocked write never\nlooks like a silent no-op.\n\n> These are defence-in-depth guardrails, not a substitute for least privilege.\n> Point each environment at a **role that only has `SELECT`**; the server then\n> just keeps the model from fighting that role.\n\n## Install\n\nRequires `psql` on `PATH`. Then either:\n\n```bash\n# one-off,…","publisher":{"name":"Sangwan Jeon","url":null},"homepage":"https://github.com/maxswjeon/psql-mcp","repository":"https://github.com/maxswjeon/psql-mcp","version":"0.1.0","license":"MIT","protocols":["mcp"],"tags":["claude","llm","mcp","postgres","postgresql","psql","read-only"],"pricing":null,"endpoints":[{"url":"pypi:psql-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"data.database","name":"Databases","confidence":1,"provenance":"declared"},{"slug":"dev.filesystem","name":"Filesystem","confidence":1,"provenance":"derived"},{"slug":"dev.terminal","name":"Terminal & Shell","confidence":0.745,"provenance":"derived"}],"categories":["data","dev"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"psql-mcp","registry":"pypi","observedAt":"2026-09-10T10:25:43.221Z","publishedAt":"2026-07-09T11:13:22.958851Z","latestVersion":"0.1.0"}},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"psql-mcp","url":"https://pypi.org/project/psql-mcp/","firstSeenAt":"2026-09-10T10:24:15.717Z","fetchedAt":"2026-09-10T10:24:15.717Z","normalizedAt":"2026-09-10T10:24:15.717Z"}]},"firstSeenAt":"2026-09-10T10:24:15.717Z","updatedAt":"2026-09-10T10:25:43.221Z"}