PostgreSQL (hardened, read-only) MCP配置与使用教程

{
  "id": "io.github.Eszetael/postgres-mcp-hardened",
  "type": "mcp-server",
  "version": "0.1.10",
  "displayName": "PostgreSQL (hardened, read-only)",
  "description": "Read-only PostgreSQL over MCP. Writes refused at the parsed SQL, plus a READ ONLY transaction.",
  "repository": {
    "url": "https://github.com/Eszetael/postgres-mcp-hardened",
    "source": "github"
  },
  "homepage": "https://github.com/Eszetael/postgres-mcp-hardened",
  "distribution": {
    "packages": [
      {
        "registryType": "npm",
        "identifier": "postgres-mcp-hardened",
        "version": "0.1.10",
        "runtimeHint": "npx",
        "transport": "stdio",
        "environmentVariables": [
          {
            "name": "DATABASE_URL",
            "description": "Connection string for the role the server connects as. Use a role that cannot write — the server refuses writes twice, but a read-only role is the layer that does not depend on us being correct. `--print-setup-sql` prints the SQL that creates one.",
            "isRequired": true,
            "isSecret": true
          },
          {
            "name": "MCP_STATEMENT_TIMEOUT",
            "description": "Server-side statement timeout, e.g. `5s`. A question that would pin the database is cancelled by PostgreSQL, not by hope."
          },
          {
            "name": "MCP_ALLOW_TABLES",
            "description": "Comma-separated allowlist. A table off the list is refused by name, and hiding it inside a CTE, a view or a join does not help."
          },
          {
            "name": "MCP_AUDIT_LOG",
            "description": "Path to the tamper-evident audit log. Entries are chained by hash and survive a restart; `--verify-audit` checks the chain against an off-host anchor."
          }
        ]
      },
      {
        "registryType": "oci",
        "identifier": "ghcr.io/eszetael/postgres-mcp-hardened:0.1.10",
        "transport": "streamable-http",
        "environmentVariables": [
          {
            "name": "DATABASE_URL",
            "description": "Connection string for a role that cannot write.",
            "isRequired": true,
            "isSecret": true
          },
          {
            "name": "MCP_ADDR",
            "description": "Address to bind, default 127.0.0.1:8080."
          }
        ]
      }
    ],
    "remotes": []
  },
  "dependencies": [],
  "installTargets": [
    "claude-code",
    "claude-desktop",
    "cursor",
    "vscode",
    "trae",
    "cherry-studio",
    "lingma",
    "windsurf",
    "cline",
    "workbuddy"
  ],
  "keywords": [],
  "provenance": {
    "origin": "official-mcp-registry",
    "originalId": "io.github.Eszetael/postgres-mcp-hardened",
    "originalUrl": "https://registry.modelcontextprotocol.io/v0.1/servers/io.github.Eszetael%2Fpostgres-mcp-hardened/versions/latest",
    "isOfficial": true,
    "status": "active"
  }
}