DATABASE DEVELOPMENT / AWS Labs
AWS Labs Postgres MCP
Pins the AWS Labs Postgres server whose read-only guard parses SQL with pglast and still tells operators to use a least-privilege role.
“Turns questions into Postgres SQL for Aurora and RDS, parses read-only mode with PostgreSQL's parser, and says that guard is not the security boundary.”
01 / THE REASONING
Why this made the selection.
- The catalogue has a Postgres MCP server from another publisher and the Aurora MySQL server, not this AWS Labs Postgres server.
- The README describes the read-only parser and then says to treat it as defense in depth, not as the boundary.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- src/postgres-mcp-server/README.md
- src/postgres-mcp-server/LICENSE
Our findings
- Without --allow_write_query the server says it parses queries with pglast and allows only read statement shapes, and it still calls that guard best-effort rather than a security boundary.
- It says direct PG Wire connections use sslmode=verify-full and trust both Amazon RDS private CAs and public Amazon Trust Services roots.
- The Windows client example sets type to stdio. Credentials are supposed to come from Secrets Manager via --secretManagerARN. This review did not create a secret.
Not established by this review
- The resource was not executed and its tools were not called.
- No SQL was sent.
- The parser guard was not tested.
- TLS verification was not tested.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Connect a server deliberately.
- The install badges and JSON use uvx with awslabs.postgres-mcp-server@latest.
- The Windows example sets type to stdio and runs the package with uv tool run.
- Leave --allow_write_query off and use a least-privilege database role, which is the boundary the README names. No single shell line is recorded.
Before you start
- uv and Python
- AWS credentials and a Secrets Manager secret for the database user
- A Postgres role limited to the statements the workload needs
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Postgres MCP README ↗Checked
https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/postgres-mcp-server/README.md
Supports: parser guard and verify-full TLS
- Directory LICENSE ↗Checked
https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/postgres-mcp-server/LICENSE
Supports: Apache License Version 2.0