Back to Browse

Databridge Kit MCP Server

Developer ToolsUse Caution1.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Execute SQL and inspect tables, views, schemas and more on a configured database.

About

Execute SQL and inspect tables, views, schemas and more on a configured database.

Security Report

1.2
Use Caution1.2Critical Risk

databridge-kit passes caller-supplied SQL straight to the psql CLI with only a semicolon-based single-statement check, so an MCP client can run writes and DDL and can also reach psql backslash meta-commands that execute local shell commands or read and write local files. The server has no auth layer of its own and relies entirely on the database credentials in the connection string, which is also exposed in the process argument list. The score reflects a real host-level escape path and a broad by-design write capability, not a malicious payload. Supply chain analysis found 4 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.

8 files analyzed · 10 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

database

Check that this permission is expected for this type of plugin.

process_spawn

Check that this permission is expected for this type of plugin.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-cloudcorprecords-databridge-kit": {
      "args": [
        "-y",
        "@reneturcios/databridge-kit"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

databridge-kit

databridge-kit is a small bridge between an agent (or a terminal) and one configured PostgreSQL database. It can run a single SQL statement and answer the seven inspection questions that come up constantly while exploring an unfamiliar database: which tables, views, schemas, triggers, indexes, sequences and stored procedures exist.

The toolset mirrors the documented prebuilt Postgres toolset of a config-defined database toolbox: the tools are fixed, the database is whatever the connection string points at. There is no bundled database driver — statements run through the psql command-line client, so a machine that wants live answers needs psql on its PATH. Without it — or without a connection string — the server still starts and lists its tools; only the calls themselves report the problem.

Install

npx @reneturcios/databridge-kit list-tables postgres://user@localhost:5432/mydb

Or run the container image:

docker run -i ghcr.io/cloudcorprecords/databridge-kit

The container defaults to the MCP server (see below). Pass CLI arguments to use it as a CLI instead.

CLI

# Run one SQL statement; rows print as JSON
databridge-kit execute-sql postgres://alice@localhost/shop "SELECT id, name FROM products ORDER BY id"

# Inspection commands; each prints its rows as JSON
databridge-kit list-tables postgres://alice@localhost/shop
databridge-kit list-views postgres://alice@localhost/shop
databridge-kit list-schemas postgres://alice@localhost/shop
databridge-kit list-triggers postgres://alice@localhost/shop
databridge-kit list-indexes postgres://alice@localhost/shop
databridge-kit list-sequences postgres://alice@localhost/shop
databridge-kit list-stored-procedures postgres://alice@localhost/shop

# Start the MCP server (connection string optional, see below)
databridge-kit mcp postgres://alice@localhost/shop

databridge-kit --version

Exit codes: 0 on success, 1 when the statement, the connection string, or psql itself fails (the error says which), 2 for usage errors.

The connection string is a normal PostgreSQL URL: postgres:// or postgresql://, with host, optional port (default 5432), database name from the path, and optional user and password in the userinfo. For the mcp command the string can be left off the command line and supplied through the DATABRIDGE_DATABASE_URL environment variable instead (plain DATABASE_URL works too).

How statements and inspections work

execute_sql accepts exactly one statement per call. Semicolons inside string literals and comments do not count as statement boundaries, but a second real statement is rejected before anything reaches the database. The statement type is not restricted — this is a general bridge, so a caller who can reach it can write as well as read; point it only at databases where that is intended.

Each inspection tool runs one fixed catalogue query:

ToolCatalogue read
list_tablesinformation_schema.tables (base tables)
list_viewsinformation_schema.views
list_schemasinformation_schema.schemata
list_triggersinformation_schema.triggers
list_indexespg_indexes
list_sequencesinformation_schema.sequences
list_stored_procedureinformation_schema.routines

Statements run as psql -v ON_ERROR_STOP=1 --csv -c <sql> and the CSV output is parsed into row objects. Values come back as the strings psql rendered.

MCP server

One bin serves both faces. The mcp subcommand starts a stdio MCP server:

npx -y @reneturcios/databridge-kit mcp postgres://alice@localhost/shop

MCP client configuration:

{
  "mcpServers": {
    "databridge-kit": {
      "command": "npx",
      "args": ["-y", "@reneturcios/databridge-kit", "mcp"],
      "env": { "DATABRIDGE_DATABASE_URL": "postgres://alice@localhost/shop" }
    }
  }
}

Tools

ToolInputWhat it returns
execute_sqlsql (string, required) — one SQL statementThe result rows as a JSON array of objects keyed by column name.
list_tables—Rows describing the base tables in the configured source.
list_views—Rows describing the views in the configured source.
list_schemas—Rows describing the schemas in the configured source.
list_triggers—Rows describing the triggers in the configured source.
list_indexes—Rows describing the indexes in the configured source.
list_sequences—Rows describing the sequences in the configured source.
list_stored_procedure—Rows describing the stored procedures (routines) in the configured source.

A missing connection, a missing psql, a multi-statement execute_sql, and database errors all come back as tool errors — never as made-up rows.

Development

npm install
npm run build   # tsc -> dist/
npm test        # node test runner over test/*.test.ts, no network, no live database
npm run dev     # run the CLI from source via tsx

The core logic sits behind an injectable executor interface, which is what the test suite drives: connection-string parsing, the single-statement check, pass-through execution, error propagation, and the exact catalogue SQL behind every inspection tool are all covered with a fake executor.

License

MIT — see LICENSE.

Reviews

No reviews yet

Be the first to review this server!