--- title: "AWS Labs Postgres MCP: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/mcp-servers/awslabs-postgres/ description: "Pins the AWS Labs Postgres server whose read-only guard parses SQL with pglast and still tells operators to use a least-privilege role." --- # AWS Labs Postgres MCP: review, setup & limitations · Undominated.ai > Pins the AWS Labs Postgres server whose read-only guard parses SQL with pglast and still tells operators to use a least-privilege role. [← Explore all mcp servers](/mcp-servers/) DATABASE DEVELOPMENT / AWS Labs # AWS Labs Postgres MCP Pins the AWS Labs Postgres server whose read-only guard parses SQL with pglast and still tells operators to use a least-privilege role. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/awslabs/mcp/tree/8840003820a78dd018561d55c7ab12fcdd708464/src/postgres-mcp-server) SOURCE REVIEW Reviewed 2026-10-14 Evidence 2 linked sources Publisher AWS Labs Licence [Apache-2.0 ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/postgres-mcp-server/LICENSE) Revision 8840003820a7 [Read what was—and wasn’t—checked ↓](#review) “Turns questions into Postgres SQL for Aurora and RDS, parses read-only mode with PostgreSQL's parser, and says that guard is not the security boundary.” [AWS Labs · upstream description ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/postgres-mcp-server/README.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The catalogue has a Postgres MCP server from another publisher and the Aurora MySQL server, not this AWS Labs Postgres server. - The README describes the read-only parser and then says to treat it as defense in depth, not as the boundary. ### A good fit for - Querying Aurora or RDS Postgres from a local MCP client with a role that cannot write ### Weigh up before choosing - This review did not execute the resource. - install.command is null. The uvx invocation is inside a badge URL and a JSON args array, not one shell line. - The README does not mention a licence. The directory LICENSE is Apache-2.0. - The known-function list is the README's claim through PostgreSQL 18. It was not checked against a server. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - src/postgres-mcp-server/README.md - src/postgres-mcp-server/LICENSE ### Our findings - Without --allow_write_query the server says it parses queries with pglast and allows only read statement shapes, and it still calls that guard best-effort rather than a security boundary. - It says direct PG Wire connections use sslmode=verify-full and trust both Amazon RDS private CAs and public Amazon Trust Services roots. - The Windows client example sets type to stdio. Credentials are supposed to come from Secrets Manager via --secretManagerARN. This review did not create a secret. ### Not established by this review - The resource was not executed and its tools were not called. - No SQL was sent. - The parser guard was not tested. - TLS verification was not tested. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Connect a server deliberately. [Upstream setup instructions ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/postgres-mcp-server/README.md) - The install badges and JSON use uvx with awslabs.postgres-mcp-server@latest. - The Windows example sets type to stdio and runs the package with uv tool run. - Leave --allow_write_query off and use a least-privilege database role, which is the boundary the README names. No single shell line is recorded. ### Before you start - uv and Python - AWS credentials and a Secrets Manager secret for the database user - A Postgres role limited to the statements the workload needs ### Compatibility Kiro · Cursor · VS Code ### Implementation python ### Transports stdio ### SQL with a best-effort read-only parser - Generate and run Postgres SQL - Reject non-read shapes only when --allow_write_query is absent - Rely on the database role as the boundary the README describes ### Cost model Apache-2.0; no database connection was opened 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Postgres MCP README ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/postgres-mcp-server/README.md) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/postgres-mcp-server/README.md Supports: parser guard and verify-full TLS - [Directory LICENSE ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/postgres-mcp-server/LICENSE) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/postgres-mcp-server/LICENSE Supports: Apache License Version 2.0 KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Aurora DSQL MCP ↗ AWS Labs MCP server that turns questions into Postgres-compatible SQL for Aurora DSQL, read-only unless --allow-writes is passed, and only on the same host as the client.](/mcp-servers/awslabs-aurora-dsql/)[### Aurora MySQL MCP ↗ AWS Labs MCP server that turns natural language into SQL for Aurora MySQL on the same host as the client, with a keyword guard the README says is not a security boundary.](/mcp-servers/awslabs-mysql/)[### AWS Labs SQL Server MCP ↗ Pins the AWS Labs SQL Server server, whose default mode blocks mutating keywords and still says that filter is not the security boundary.](/mcp-servers/awslabs-mssql/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Inspect resource evidence](/tools/) - [Choose a host](/agents/) - [Inspect reusable workflows](/skills/) - [Use Undominated data](/api/)