Back to Browse

Pgcloud MCP Server

Developer ToolsUse Caution4.6MCP RegistryLocal
Free

Server data from the Official MCP Registry

Neon Postgres projects, branches, SQL, and migrations from your MCP client.

About

Neon Postgres projects, branches, SQL, and migrations from your MCP client.

Security Report

4.6
Use Caution4.6High Risk

pgcloud handles its Neon API key correctly: it is read from NEON_API_KEY, sent only as a Bearer token to api.neon.tech, and never logged, and its dependencies are legitimate. The score is held down by permissive SQL execution, including EXPLAIN ANALYZE that runs DML, get_connection_string returning database passwords into tool output, and irreversible delete tools with no confirmation step. The capabilities match the server's stated purpose, but users should be aware of these risks before granting it production database access. Supply chain analysis found 4 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.

5 files analyzed · 12 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

database

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

NEON_API_KEYRequired

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-cloudcorprecords-pgcloud": {
      "env": {
        "NEON_API_KEY": "your-neon-api-key-here"
      },
      "args": [
        "-y",
        "@reneturcios/pgcloud"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

pgcloud

pgcloud puts a Neon Postgres account within reach of an MCP client or a terminal. Projects and their branches can be listed, described, created, and deleted; compute endpoints and organizations can be inspected; and any database in a project can be queried directly — single statements, multi-statement transactions, table and column introspection, slow-query reports, and execution plans. Schema changes follow Neon's two-phase pattern: a migration or tuning session is prepared on a temporary branch, exercised there, and only then completed onto the original branch.

A Neon API key is required. Put it in the NEON_API_KEY environment variable; it is sent to the Neon API as a Bearer token and never appears in output. When the variable is missing, every call fails with an error that names it.

Install

npx @reneturcios/pgcloud list_projects

Or run the container image:

docker run -i -e NEON_API_KEY ghcr.io/cloudcorprecords/pgcloud

The container defaults to the MCP server (see below). Pass CLI arguments to use it as a CLI instead.

CLI

Every MCP tool is also a CLI subcommand. Tool arguments are passed as one JSON object with --json:

export NEON_API_KEY=<your Neon API key>

pgcloud list_projects
pgcloud list_projects --json '{"limit": 5, "search": "billing"}'
pgcloud describe_project --json '{"projectId": "snowy-pond-12345678"}'
pgcloud create_branch --json '{"projectId": "snowy-pond-12345678", "branchName": "dev"}'
pgcloud run_sql --json '{"projectId": "snowy-pond-12345678", "sql": "select now()"}'
pgcloud get_connection_string --json '{"projectId": "snowy-pond-12345678", "pooled": true}'

pgcloud --version

Results print as JSON. Exit codes: 0 on success, 1 when an API or SQL call fails (including a missing NEON_API_KEY), 2 for usage errors.

MCP server

One bin serves both faces. The mcp subcommand starts a stdio MCP server:

npx -y @reneturcios/pgcloud mcp

MCP client configuration:

{
  "mcpServers": {
    "pgcloud": {
      "command": "npx",
      "args": ["-y", "@reneturcios/pgcloud", "mcp"],
      "env": { "NEON_API_KEY": "your Neon API key" }
    }
  }
}

Tools

ToolInput (required in bold)What it does
list_projectslimit, search, org_idLists projects in the account.
describe_projectprojectIdDescribes one project.
create_projectname, region_id, org_idCreates a project.
delete_projectprojectIdDeletes a project and its resources.
create_branchprojectId, branchName, parentBranchIdCreates a branch with a read-write compute.
delete_branchprojectId, branchIdDeletes a branch.
describe_branchprojectId, branchIdBranch record plus its databases.
list_branch_computesprojectId, branchIdLists compute endpoints.
list_organizationssearchLists organizations the user can access.
get_connection_stringprojectId, branchId, databaseName, roleName, pooledResolves a Postgres connection string.
run_sqlsql, projectId, branchId, databaseName, roleNameRuns one SQL statement.
run_sql_transactionsql (array), projectId, …Runs statements in one transaction.
get_database_tablesprojectId, branchId, databaseNameLists tables via information_schema.
describe_table_schemaprojectId, tableName, …Lists a table's columns.
list_slow_queriesprojectId, limit, …Slowest queries from pg_stat_statements.
explain_sql_statementsql, projectId, …Returns the EXPLAIN plan for a statement.
prepare_database_migrationmigrationSql, projectId, …Runs migration SQL on a temporary branch.
complete_database_migrationmigrationId, projectId, …Applies a prepared migration to the original branch.
prepare_query_tuningsql, projectId, …Opens a tuning session on a temporary branch with the plan.
complete_query_tuningtuningId, projectId, applyChangesCloses a tuning session, applying or discarding.

Management calls go to https://api.neon.tech/api/v2. SQL calls first resolve the branch's connection URI from the API, then POST the statement to the database host's HTTP SQL endpoint with the URI in the Neon-Connection-String header; SQL text is passed through as given. Migration and tuning sessions are held in the server process, so a session must be completed by the same process that prepared it.

Development

npm install
npm run build   # tsc -> dist/
npm test        # node test runner over test/*.test.ts, no network (fake fetch fixtures)
npm run dev     # run the CLI from source via tsx

License

MIT — see LICENSE.

Reviews

No reviews yet

Be the first to review this server!