Query Postgres from Cursor with an MCP server

While you are coding in Cursor, you often want to check what is actually in the database. A local read-only MCP server does that for you. When teammates need the same answers, Contextflo connects once and everyone signs in with their own account.

Option 1: a local Postgres MCP server in Cursor

Start with a read-only role. Run this against your database:

CREATE ROLE contextflo_ro LOGIN PASSWORD '<generated>';
GRANT CONNECT ON DATABASE mydb TO contextflo_ro;
GRANT USAGE ON SCHEMA public TO contextflo_ro;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO contextflo_ro;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO contextflo_ro;

Point it at a read replica, not your primary.

Then add @contextflo/postgres-mcp to ~/.cursor/mcp.json (global) or .cursor/mcp.json (this repo only). It is MIT licensed and enforces read-only in four layers:

{
  "mcpServers": {
    "postgres": {
      "command": "npx",
      "args": [
        "-y",
        "@contextflo/postgres-mcp",
        "postgresql://contextflo_ro:<password>@replica-host:5432/mydb"
      ]
    }
  }
}

@bytebase/dbhub also works. Do not use the archived @modelcontextprotocol/server-postgres: it has a SQL injection bypass.

The connection string holds the password, so keep a repo-level .cursor/mcp.json out of version control.

Option 2: Contextflo

Use the same role SQL from above. Then in Contextflo, go to Data Sources, then Add data source, and paste a postgresql:// connection string for the read-only role. It works with RDS, Supabase, Neon, Cloud SQL, Azure, Railway, Render and self-hosted databases.

Pick the tables you want to expose and invite your team. Then add this to Cursor:

{
  "mcpServers": {
    "contextflo": {
      "url": "https://mcp.contextflo.com/mcp"
    }
  }
}

Cursor starts the OAuth sign-in when it needs it. Contextflo runs SELECT only, and the role under it is read-only as well.

Contextflo generates table and column descriptions. Your team saves corrections and definitions as shared context, so the same question gets the same answer. Each person only sees the tables they have access to. You get an audit trail of prompts and the SQL that ran, plus a weekly digest. Postgres alone gives you pg_stat_statements, which has query text but not the person.

Which one to use

Solo, one database, one repo? Option 1 is quick. Once your team asks too, use Contextflo: shared context, per-person table access, and an audit trail.

For more servers, see the best Postgres MCP servers. Using Claude? See Claude with Postgres.

You do the modeling, we do the rest. Connect Postgres free.

FAQ

Which Postgres MCP server should I use in Cursor? @contextflo/postgres-mcp is MIT licensed and enforces read-only in four layers. @bytebase/dbhub is another option. Avoid the archived @modelcontextprotocol/server-postgres, which has a known SQL injection bypass.

Should Cursor point at my production Postgres? Point it at a read replica with a read-only role. Then a bad query cannot touch writes or compete with your app.

Does this work with Supabase, Neon or RDS? Yes. Contextflo takes a postgresql:// connection string and works with RDS, Supabase, Neon, Cloud SQL, Azure, Railway, Render and self-hosted Postgres.

Can Postgres tell me who ran a query from Cursor? pg_stat_statements has the query text, not the person. Contextflo's audit trail records each person's prompt and the SQL that ran.