DATABASES AND SEARCH / Upstash
Upstash MCP
Connects a local MCP client to Upstash resource inspection and account-authorized management tools.
“The Upstash MCP server lets your agent manage and debug your Upstash resources directly, across Redis, QStash, Workflow, and Upstash Box.”
01 / THE REASONING
Why this made the selection.
- Includes resource inspection across several Upstash products rather than only generic Redis commands.
- The published package has read-only account-key detection and tool filtering; the review checks those boundaries against the package build as well as documentation.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- README.md, package.json, LICENSE, src/server.ts, src/index.ts and src/test-connection.ts at the npm-declared gitHead
- Published npm 0.3.0 tarball integrity and dist/index.js transport, credential and tool-filtering sections
- 2026-10-14 reread of retained pinned setup/configuration evidence for the specific operational details added in this batch.
Our findings
- The selected npm 0.3.0 command is matched to its registry-declared source revision. The downloaded tarball matches the registry SHA-512 integrity value.
- The published code defaults to stdio, supports credential environment variables and --disable-telemetry, and filters by tool.readonly for detected read-only account keys.
- A newer repository revision changes Box filtering, so its behavior was not substituted for the selected package version.
- README explicitly separates account credentials from the optional Box key, documents retry/schedule workflows and sends debug output to stderr. Existing source-qualified read-only-detection caveats remain applicable.
Not established by this review
- No MCP server or upstream package was installed or run.
- No authenticated account, client handshake, query, write operation or security test was performed.
- No authenticated session, installation, permission bypass or package-to-source parity test was performed.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Connect a server deliberately.
DOCUMENTED COMMAND
npx -y @upstash/mcp-server@latest --email YOUR_EMAIL --api-key YOUR_API_KEYCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- Create a scoped account API key; begin with a read-only key and no Box credential.
- The README's command uses @latest, which npm resolved to the reviewed 0.3.0 on 2026-10-13. Use @upstash/mcp-server@0.3.0 to stay on the reviewed build, and add --disable-telemetry to opt out of the diagnostic headers the README describes.
- Prefer UPSTASH_EMAIL and UPSTASH_API_KEY in the client environment over the flags, so the key is not in shared configuration. Review the exposed tools before authorizing any write operation.
Before you start
- Node.js 20 or later and npm
- An Upstash account with the necessary resource permissions
Documented configuration example
Use the client and authentication context described in the setup guidance. Configuration formats vary between hosts.
{
"mcpServers": {
"upstash": {
"command": "npx",
"args": [
"-y",
"@upstash/mcp-server@latest",
"--email",
"YOUR_EMAIL",
"--api-key",
"YOUR_API_KEY"
]
}
}
}04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/upstash/mcp-server/blob/9a0f49f9e241d604b0820251eb5b47e268dea5bd/README.md
Supports: summary, upstreamDescription, whySelected, bestFor, install, compatibility, transports, limitations, access, review, configExample
https://github.com/upstash/mcp-server/blob/9a0f49f9e241d604b0820251eb5b47e268dea5bd/LICENSE
Supports: license, access.cost
https://github.com/upstash/mcp-server/blob/9a0f49f9e241d604b0820251eb5b47e268dea5bd/src/server.ts
Supports: review, limitations, access
https://github.com/upstash/mcp-server/blob/9a0f49f9e241d604b0820251eb5b47e268dea5bd/src/index.ts
Supports: install, limitations, review
https://registry.npmjs.org/@upstash%2Fmcp-server/0.3.0
Supports: install
https://github.com/upstash/mcp-server/blob/9a0f49f9e241d604b0820251eb5b47e268dea5bd/src/test-connection.ts
Supports: review, limitations, access