Every Postgres MCP Server I Tested in 2026

There is no single best Postgres MCP server. There's a best one for what you're actually doing: tuning a database, giving a team read access, or running everything on a platform like Supabase or Neon. This is a neutral rundown of the real options in 2026, what each is genuinely good at, and the one you should not use.

The options at a glance

Star counts are from GitHub as of July 2026 and move over time. Check the repo before you commit.

Postgres MCP Pro (Crystal DBA)

The most capable single-database server if your goal is understanding and tuning Postgres. crystaldba/postgres-mcp (~3.1k stars) goes well past "run a query." It does index tuning by exploring thousands of candidate indexes, reviews EXPLAIN plans, simulates hypothetical indexes before you create them, and runs health checks on vacuum, buffer cache, and replication lag. It ships two modes: Restricted (read-only, resource-capped) and Unrestricted (full read/write).

Two honest caveats most roundups skip. First, the README examples default to Unrestricted, so the agent gets full write and arbitrary SQL unless you deliberately switch to Restricted, set it before you point it at anything real. Second, Crystal DBA was acquired by Temporal in September 2025, and there has been no tagged release since v0.3.0 in May 2025, although commits continued into August 2026. Great tool, watch the maintenance.

DBHub (Bytebase)

The pick if you have more than one database engine. bytebase/dbhub (~3.2k stars) is a universal server that speaks PostgreSQL, MySQL, SQL Server, MariaDB, and SQLite through one process. It deliberately exposes just two tools, one to run SQL and one to explore schema, to stay token-efficient, and it's read-only by design in its default mode. The tradeoff is depth: it doesn't have the Postgres-specific index tuning and health suite that Crystal DBA does. Breadth over depth.

Supabase MCP and Neon MCP

If your Postgres lives on Supabase or Neon, use their official server, it knows the platform, not just the database.

Supabase MCP (~2.7k stars) manages the whole project, auth, storage, edge functions, and database branching, not only queries. Add read_only to run as a read-only user and disable the mutating tools. Neon MCP (~565 stars, also offered as a hosted remote server) has the safest migration flow of the bunch: the agent tests a change against a real branch of your data and only an explicit commit step touches production. Both are only relevant if you're on that platform.

MCP Toolbox for Databases (Google)

Google's MCP Toolbox for Databases (the repo was renamed from genai-toolbox) covers many databases, Postgres included, and takes a different approach from the rest: beyond its prebuilt tools, you define your own tools and resources in YAML, so the agent calls named, parameterized queries instead of writing free-form SQL. Its prebuilt list_tables returns your table and column comments, and a resource can serve a hand-written glossary file, which is more business context than most servers here can carry.

The catch for Postgres: the Postgres source has no read-only mode, so read-only rests entirely on the database role you connect with, or on exposing only your own parameterized tools. Create a read-only role before you point it at anything real.

AWS Labs Postgres MCP

If you're on Aurora or RDS Postgres, AWS Labs ships an official server that does natural-language to SQL with IAM auth and the RDS Data API. It's read-only by default (a keyword blocklist), with writes behind an explicit flag. Tied to AWS-hosted Postgres.

Where Contextflo fits

The servers above mostly do one thing: run the query. Contextflo adds the part a raw MCP connection skips, the context. You connect your Postgres, then point it at your code and your docs (even a single markdown file), and it learns what your tables and columns actually mean, so Claude's answers come out right instead of merely plausible.

That matters even if you're one person. You connect Postgres, add your code and docs, and you're ready: read-only enforced (not just a role), every query logged, no server to run. A bare MCP server hands Claude a connection; it doesn't tell it that amt_net excludes refunds. Just MCP is not enough for answers you can trust, solo or not.

Start with Contextflo if you want accurate answers from your own context, or if you're building solo today with a team in mind, since shared definitions and per-user access are already there when you grow into them. Solo and just want a plain local connection? Use our open-source server, @contextflo/postgres-mcp (MIT). It is a drop-in replacement for the archived reference server, read-only at four layers, and it keeps business definitions in a markdown file in your project that the agent reads and writes new notes back to as it learns. None of the servers above let the agent add to its own context. The launch post explains why we built it, and we cover the setup in how to use Claude with Postgres.

How to pick

• Tuning and diagnosing Postgres performance, solo: Postgres MCP Pro (Crystal DBA). Set Restricted mode.
• Several database engines, one server: DBHub (Bytebase).
• On Supabase, Neon, Aurora, or RDS: their native server.
• Named, parameterized queries instead of free-form SQL, across several databases: MCP Toolbox for Databases (Google). Bring a read-only role.
• Accurate answers from your own data, solo or team: Contextflo. It adds the context (schema, code, docs) a raw server skips, and the access control and audit trail are there when you grow.
• A local read-only connection with your definitions kept in the project: @contextflo/postgres-mcp, ours.
• A throwaway query tool on your own database, no team ever: any open-source server above.
• Never: the archived @modelcontextprotocol/server-postgres.

FAQ

What is the best Postgres MCP server?

It depends on the job. For tuning and diagnosing Postgres solo, Postgres MCP Pro by Crystal DBA is the most capable. For several database engines through one server, DBHub by Bytebase. For a team that needs shared context and access control, a managed layer like Contextflo. There is no single winner.

Is the official Postgres MCP server safe to use?

No. The original @modelcontextprotocol/server-postgres was archived in July 2025 and its frozen version has a confirmed SQL-injection vulnerability that can bypass its read-only guard. Use a maintained server instead, and never point the archived package at production.

Are Postgres MCP servers read-only?

Not all of them, and not always by default. DBHub and the AWS Labs server are read-only by default; Postgres MCP Pro defaults to unrestricted read/write in its examples, and Google's MCP Toolbox has no read-only mode for Postgres at all. Always confirm the mode before connecting, and prefer a setup that enforces read-only rather than trusting the database role alone.

What is the best Postgres MCP server for a team?

The single-server open-source options are built for one person, though some, including @contextflo/postgres-mcp, can be self-hosted over HTTP for a small group. For a team, you want shared metric definitions, per-user table access, individual sign-in, and a query log, which is what a managed layer like Contextflo adds on top of the raw connection.

Here is a more in-depth look at Contextflo and how it works.