MCP Server
PostgreSQL MCP server
Run a governed MCP server in front of PostgreSQL so an AI agent can read it without holding your credentials. The agent sees only the tables and columns you allow. Schema-qualified tables, native types, and real foreign keys — so query_related can follow declared relationships instead of guessing joins.
What to check before an agent reads PostgreSQL
Specific to this engine, not to MCP. Each one changes what a scoped token can reach.
Row-level security applies to the agent too
If RLS policies are enabled, the agent's token sees what its database role is permitted to see and nothing more. That is a second, independent boundary underneath the gateway's allowlist, and it is worth checking which role the gateway connects as before assuming the allowlist is the only thing standing between an agent and a row.
A jsonb column can hide PII from a column-name scan
Sensitivity detection works per column. An email address sitting inside a jsonb blob is not an email column, so it is not masked by column name alone. Deny the column, or expose a named view that projects only the keys you intend.
A view can read past the base table's grants
Views execute with their owner's privileges unless declared with security_invoker, so an allowlisted view can return rows from a table the agent is denied. Allowlist views as deliberately as tables.
Connecting an agent to PostgreSQL
Any MCP client works — the endpoint is the same, only the client's config file differs.
{
"mcpServers": {
"dbshifts": {
"url": "https://dbshifts.com/api/v1/agent-gateways/mcp",
"headers": { "Authorization": "Bearer agt_your_token_here" }
}
}
}How it works
Register the database
Connect it once with read-only credentials. The schema is introspected and scanned for PII automatically — you see what's sensitive before anything is exposed.
Set the policy
Pick the tables and columns agents may read. Set PII masking, a row cap, a rate limit, and daily/monthly usage budgets. Default is deny.
Issue a scoped token
One agt_ token per agent, revocable independently, optionally IP-bound and time-windowed. Never your database password.
Point the agent at it
Drop the endpoint and token into your client's MCP config. Every call is policy-checked, masked, capped and logged.
Tools the agent gets
Exactly the 26 tools the MCP server exposes — no raw SQL is accepted from the agent on any of them. What each one does.
Frequently asked questions
Do I have to give the AI agent my PostgreSQL password?
No — that's the entire point. The agent authenticates with a scoped agt_ token issued by the gateway. The database credentials stay on the server and are never sent to the agent, the model provider, or the client machine. Revoke a token and that agent loses access immediately, without touching any other agent or rotating your database password.
Can the agent read columns I haven't allowed?
No. The policy is default-deny: an agent sees only the tables and columns you explicitly allow. Denied columns are not returned, and PII columns are masked server-side before results ever leave the gateway — including inside aggregates, so a masked column can't be grouped or filtered back into visibility.
Can the agent modify or delete data?
Reads are read-only by construction. Writes exist only as named, parameterized actions you define in advance — the agent can propose one, but a human approves it (in-app or from Slack) before anything executes. Approved writes are audited and carry a one-click undo, plus a version-controlled history of the affected table.
What stops an agent from pulling the entire database?
Layered limits: a per-query row cap, a per-minute rate limit, and cumulative usage budgets (daily queries, daily rows, monthly rows) per token and gateway-wide. Tokens can also be IP-bound and time-windowed, so a leaked token is useless outside your network or outside working hours.
How do I see what the agent actually did?
Every call is logged: which token, which tool, which table, which columns were masked, how many rows came back, and what was denied. You can replay any logged read to see exactly what the agent saw at the time.
Set up your MCP client
Not connecting an agent yet? The gateway's policy sits on top of whatever the database user is allowed to do, so the read-only user underneath it is worth getting right first — the exact commands for PostgreSQL are on the Data Console page for it.
Ship agents without betting the database on them.
Free to start — no card. Read-only, masked, rate-limited, fully audited.
Get started