Postgres MCP Server: Hosted PostgreSQL MCP, Read-Only

A Postgres MCP server lets an AI assistant such as Claude, ChatGPT or Cursor look inside your PostgreSQL database and answer questions with real queries. MCPifex hosts the PostgreSQL MCP server for you: you save your connection settings once, keep the database user read-only, and paste one URL into your AI app. The write tool is off until you turn it on.

What does a PostgreSQL MCP server do?

MCP (the Model Context Protocol) is how an AI app talks to outside tools. A PostgreSQL MCP server is the tool that sits between the AI and your database. The AI never gets a raw connection. It can only call the small set of tools the server offers, and each call is a plain request such as "list the tables" or "run this SELECT".

In practice you ask a question in normal language and the AI does the SQL work:

• It calls list_schemas and list_tables to find where your data lives.
• It calls describe_table to read column names, types, indexes and constraints.
• It writes a SELECT and runs it with query, then explains the result.

If you are new to the idea, what is MCP covers it in a few minutes, and what is an MCP server defines the term. This page is about the PostgreSQL server specifically. It works with any reachable PostgreSQL database, including managed ones such as Supabase, Neon or Amazon RDS, as long as you have the host, port, database name, username and password.

Which tools does the Postgres MCP server include?

The hosted server has five tools. Four only read. One can change data, and it ships switched off.

You switch any tool on or off per instance. The gateway refuses a call to a disabled tool, so turning execute off is enforced on the server side and does not depend on the AI behaving. The tool call format itself is defined in the MCP specification for tools.

How do I set up a PostgreSQL MCP server in 4 steps?

Setup happens in the MCPifex portal wizard. You need a free account (sign up here, no card) and your database connection details. The whole flow has four steps.

1. Name this instance. Pick a name you will recognise, for example "Analytics replica". You can add a short description too.
2. Connection settings. Enter the fields below. Click Test connection before you continue.
3. Choose what's allowed. The four read tools are on. execute is off. Leave it that way unless you have a reason.
4. Get connected. Create an API key (it starts with mcpx_) and copy the URL into your AI app.

These are the connection fields in step 2:

• Host and port: where your server listens. The default port is 5432.
• Database, username and password: the login MCPifex connects with. Use the read-only role described below.
• SSL mode: Disable, Require, Require with no certificate verification (the default), or Verify full with a CA bundle.

Credentials are encrypted in transit and masked in the portal once saved. The quickstart shows the same flow with screenshots, and instances and tools explains how tool switches work.

How do I connect it to Claude, ChatGPT or Cursor?

Every client uses the same gateway: https://mcp.mcpifex.com/mcp. Replace <YOUR_MCPX_KEY> below with your key. Full walkthroughs: connect Claude, connect ChatGPT and connect Cursor.

Claude Code

claude mcp add mcpifex --transport http https://mcp.mcpifex.com/mcp \
  --header "Authorization: Bearer <YOUR_MCPX_KEY>"

Cursor

Add this to .cursor/mcp.json in your project, or to Cursor's global mcp.json, then reload Cursor:

{
  "mcpServers": {
    "mcpifex": {
      "type": "http",
      "url": "https://mcp.mcpifex.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_MCPX_KEY>"
      }
    }
  }
}

Claude.ai and Claude Desktop

Use Claude's custom connector and paste https://mcp.mcpifex.com/mcp/<YOUR_MCPX_KEY> as the URL. If your organization has the Request headers option (in beta for a limited set of organizations), you can instead use the base URL https://mcp.mcpifex.com/mcp and add Authorization: Bearer <YOUR_MCPX_KEY> under Request headers. The connector guide has the clicks. If you only use Claude Desktop with a config file, this guide covers the bridge option.

ChatGPT

ChatGPT's custom MCP form has no header field, so the key goes in the URL, as the last path segment. Treat that URL like a password. See connect an MCP server to ChatGPT for the steps, and connect ChatGPT to a database for what to ask once it works.

For a Claude-focused walkthrough with sample questions, read query Postgres from Claude.

How do I make the connection read-only?

Create a dedicated Postgres role that can only read, and give MCPifex that login. Then two layers enforce read-only access: the MCPifex tool switch and the database itself. If someone later turns on execute by mistake, the role still cannot write.

Run this once as an admin user, replacing mydb and the password:

CREATE ROLE ai_reader LOGIN PASSWORD 'choose-a-strong-password';
GRANT CONNECT ON DATABASE mydb TO ai_reader;
GRANT USAGE ON SCHEMA public TO ai_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO ai_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ai_reader;

The last line matters. Without it, tables you create later are invisible to the role. Each statement is documented in the PostgreSQL manual: CREATE ROLE, GRANT and database roles.

Three more habits help. Point the instance at a read replica if you have one, so heavy questions do not slow your live app. Grant SELECT only on the tables the AI needs, not the whole schema, if some tables hold sensitive columns. And never give the AI a superuser login. The wider thinking is in control what AI agents can reach.

One more guard is built in. The open-source package behind the server has a connect_db tool that could point the connection at a different database. MCPifex never offers it, so the AI can only reach the database you configured.

What can non-developers ask it?

You do not need to know SQL. Describe the answer you want and let the AI work out the query. Good starting prompts:

• "What tables do we have, and what does each one store?"
• "How many new users signed up each week over the last two months? Show it as a table."
• "Which customers ordered more than three times but have not ordered in 60 days?"
• "Find orders with a total of zero and tell me what they have in common."
• "Compare revenue by month this year to last year and point out the biggest drop."
• "Is anything in the users table duplicated by email?"

Two tips for better answers. First, ask the AI to show the SQL it ran, so you can check the logic. Second, name the table when you know it, since the AI has to read the schema before it can choose. More examples live in ask your database in plain English.

Hosted or self-hosted: which should I use?

You can run a PostgreSQL MCP server yourself. The MCP project's reference implementation is public (now in the archived MCP servers repository), and the wider MCP servers repository lists current community options. Self-hosting costs no money but takes time: you install Node.js or a container, keep it updated, and expose it safely if a web app like ChatGPT needs to reach it.

Choose self-hosting if the database is only reachable from your own network, or if you want to read and modify the server code. Choose the hosted server if you want nothing to install, one URL that works in Claude, ChatGPT and Cursor, tool-level switches, and a call log per instance. The trade-offs are laid out in hosted vs self-hosted MCP and build vs buy MCP hosting. The free plan includes 3 MCP instances, so trying the hosted route costs nothing. See pricing.

What are the limits?

• Your database must be reachable. MCPifex connects over the network, so a database that accepts no outside connections cannot be used. For that case, self-host.
• Read answers are only as good as your schema. Tables named t1 or columns named x lead to guesses. Clear names and a few comments help.
• The AI can be wrong. It can join on the wrong column. Check the SQL before you act on a number.
• Large results are hard to read in chat. Ask for summaries, counts or the top ten rows.
• One database per instance. A second database means a second instance.
• Prompt injection is real. Text stored in your tables could try to steer the AI. Read-only access limits the damage; see prompt injection through MCP tools.

Operational notes: each AI session gets its own isolated server process, tool calls are unlimited on every plan, and plans only limit the number of instances.

Sources

1. Model Context Protocol specification: Tools
2. PostgreSQL documentation: GRANT
3. PostgreSQL documentation: CREATE ROLE
4. MCP project reference PostgreSQL server (archived)

← Back to servers