PostgreSQL through MCP: design the access path deliberately

Use a separate role for the read path with only necessary permissions. Grant access to approved schemas and objects, not all tables by default. Also assess role memberships, object ownership, function permissions and default permissions for new objects. A read-only transaction can provide additional support, but does not replace restricted permissions and checks on callable functions. Define how user scope maps to the database identity. Shared accounts require particular attention to reliable context propagation. Test using the actual execution role, not just an administrator account. A prompt prohibiting changes does not enforce a database restriction; the server and database must enforce it themselves.

Row-level security, or RLS, can enforce policies governing visible rows when correctly enabled and applied. Note the exceptions: superusers and roles with BYPASSRLS bypass RLS; table owners are generally exempt unless appropriate settings change that. Do not casually run the MCP path under such an identity. With connection pooling, user context must be reliably set and cleared so a subsequent request does not inherit earlier context. Example: a hypothetical branch manager may read only their own branch’s results. Explicitly test another branch, a missing identity and reuse of the same connection. Include views and functions in these tests; reviewing policy text alone is insufficient.

The host contains user interaction and the MCP client; the server executes permitted database functions. Tools can expose focused queries, resources can explain view definitions and prompts can structure an analytical task. Support varies by implementation. When results go from the host to an external model provider, external processing takes place; select only necessary context for that. Avoid sensitive parameters, full results and secrets in logs. Prefer recording duration, role, tool and error category with appropriate access and retention. Keep writes separate: require explicit permission for the action and check authority, current state and business rules within the transaction. A previously displayed proposal does not replace those final checks.