Skip to content

AI & ML

MCP Servers for Databases Compared (2026): Postgres, Supabase, Neon, MongoDB and More

Six database MCP servers compared on read-only mode, auth, install command and transport, plus which ones are safe to point at production data.

November 13, 20267 min read#ai#mcp#api#open-source

If you want an agent to query your database, the safest pick is the server that gives you a real read-only switch: Supabase (read_only=true), Neon (readonly=true), MongoDB (--readOnly) and Postgres MCP Pro (--access-mode=restricted) all do. For a plain Postgres you run yourself, Postgres MCP Pro or DBHub is the fit. Neon's own README says its server is for local development only, so none of these should hold a production write credential.

Six servers are compared below, each checked against the project's README or docs on 13 November 2026. For the general web-dev shortlist (browsers, GitHub, docs), see best MCP servers for web developers; all the servers we track are on the MCP hub.

Side by side

ServerDatabasesRead-only switchAuthTransportLicense
Supabase MCPSupabase Postgres?read_only=trueOAuth (PAT for CI)Hosted HTTPApache-2.0
Neon MCPNeon Postgres?readonly=trueOAuth or API keyStreamable HTTPMIT
Postgres MCP ProAny Postgres--access-mode=restrictedConnection string (DATABASE_URI)stdio, SSEMIT
MongoDB MCP ServerMongoDB, Atlas--readOnlyConnection string; Atlas service accountstdio, HTTPApache-2.0
DBHubPostgres, MySQL, MariaDB, SQL Server, Oracle, SQLiteNot confirmed (README says it has a read-only mode)DSNstdio, HTTPMIT
MCP Toolbox for DatabasesPostgres, MySQL, MongoDB, Redis, BigQuery, Spanner and moreNot documented on the READMEIAM and per-tool configstdio, HTTPApache-2.0

Hosted servers tied to one platform

Supabase MCP

Manages projects, runs SQL and inspects schemas. The hosted server uses OAuth through dynamic client registration, so no personal access token is needed; a PAT in an Authorization header is the documented route for CI. Three URL parameters shape it: read_only=true runs queries as a read-only Postgres user, project_ref=<id> limits it to one project (and drops account-level tools), and features=database,docs enables only the groups you list. Storage tools are off by default.

claude mcp add --scope project --transport http supabase "https://mcp.supabase.com/mcp"

Then run claude /mcp, select supabase and choose Authenticate. Supabase's docs name prompt injection as the main risk and recommend keeping manual approval of tool calls on. They do not call the server dev-only: connect a production project only when the task needs it, scoped, read-only and with fewer feature groups. The server is not meant to be handed to customers or end users.

Neon MCP

Creates Neon projects and branches, runs SQL and migrations, describes schemas and lists slow queries. Two sign-in routes: OAuth in a browser, or an API key sent as a bearer header (an organization key limits access to that organization's projects). The server is stateless Streamable HTTP at /mcp; the older SSE endpoints return 410 Gone.

npx add-mcp "https://mcp.neon.tech/mcp?category=projects&category=branches&category=endpoints&category=querying&category=schema"

That is the README's example, with a category filter that exposes only the tool groups you name. Adding ?readonly=true restricts the tool set: run_sql stays and runs in a READ ONLY transaction, and run_sql_transaction is removed. The README says the server is "intended for local development and IDE integrations only" and warns it can make accidental or unauthorized changes. Treat it as a dev-branch tool.

Servers for any database you run

Postgres MCP Pro

A community server from Crystal DBA that adds index tuning, EXPLAIN analysis and health checks to plain query access. The nine tools include execute_sql, explain_query, get_top_queries and analyze_db_health. The connection string goes in the DATABASE_URI environment variable, set at startup rather than per call.

uvx postgres-mcp --access-mode=restricted

The README lists Docker, pipx, uv and uvx installs; uvx needs no install step and the client runs uvx postgres-mcp. Two access modes: unrestricted is full read/write for development, restricted means read-only transactions plus a query time limit, intended for production. Limits to know: restricted mode works by parsing SQL and rejecting COMMIT/ROLLBACK, and unsafe stored-procedure languages in the database could bypass it, so also use a read-only database user. Index tuning needs the pg_stat_statements and hypopg extensions. Transport is stdio by default; --transport=sse lets several clients share one server. It requires Docker or Python 3.12+ and was tested on Postgres 15-17.

MongoDB MCP Server

MongoDB's official server queries collections and, with Atlas API credentials, manages Atlas clusters.

npx -y mongodb-mcp-server@latest --readOnly

--readOnly (or MDB_MCP_READ_ONLY=true) stops the create, update and delete tools from being registered at all, which is stronger than a prompt asking the model to behave. --disabledTools removes tools by name, operation type or category. Destructive tools such as drop-database and delete-many ask for confirmation by default if the client supports it. The connection string comes from MDB_MCP_CONNECTION_STRING (marked deprecated in favor of MDB_MCP_CONNECTION_STRINGS); Atlas tools need MDB_MCP_API_CLIENT_ID and MDB_MCP_API_CLIENT_SECRET, and the README advises minimum project-level roles, never Organization Owner. Transport is stdio, or HTTP bound to 127.0.0.1:3000; the HTTP mode has no built-in authentication, so do not expose it. Needs Node.js 22.13.0 or later.

DBHub

Bytebase's DBHub is one server for Postgres, MySQL, MariaDB, SQL Server, Oracle and SQLite. Default tools are execute_sql and search_objects; explain_sql and health_check are opt-in, and you can define custom tools in dbhub.toml.

npx @bytebase/dbhub@latest --transport http --port 8080 --dsn "postgres://user:password@localhost:5432/dbname?sslmode=disable"

The README mentions a read-only mode, row limiting, query timeouts, SSH tunneling and TLS but the page we read gives no flag names or default values, so check its docs before relying on them. Needs Node.js 22.5.0 or later.

MCP Toolbox for Databases

Google's open source server (formerly Gen AI Toolbox for Databases) covers AlloyDB, BigQuery, Cloud SQL, Spanner, Postgres, MySQL, MongoDB, Redis and more. --prebuilt=<database> loads standard tools for one database, and --prebuilt=postgres/data limits it to SQL tools.

npx @toolbox-sdk/server --config tools.yaml

For prebuilt use the README configures the client with npx, --prebuilt=postgres and --stdio; for HTTP it points a client at http://127.0.0.1:5000/mcp, with a toolset selectable as /mcp/{toolset_name}. It mentions IAM authentication but we found no read-only flag on the README. Instead, define only the tools you want in tools.yaml.

What about SQLite?

The reference SQLite and PostgreSQL servers from the MCP project now sit in the servers-archived repository, archived on 29 May 2025. Its README says no security updates or fixes are coming and gives no security guarantees. For a local SQLite file, DBHub is the maintained option we found in the vendor docs.

Read-only, in practice

"Read-only" means different things, and the strength is in the mechanism:

  • Tools not registered (MongoDB --readOnly): the agent cannot call a write tool at all.
  • Read-only transaction (Neon, Postgres MCP Pro restricted): writes fail at the database, but the server still sees whatever you can read.
  • Read-only role (Supabase read_only=true runs as a read-only Postgres user): the database enforces it.
  • Best of all: a read-only database user. Whatever the server promises, give it a credential that cannot write. Postgres MCP Pro's own docs note that parsing SQL has limits.

How to choose

  • On Supabase or Neon: use that vendor's hosted server, pinned to one project, read-only on, against a dev branch.
  • Self-hosted or managed Postgres: Postgres MCP Pro in restricted mode if you want tuning and health checks; DBHub if you also run MySQL or SQLite.
  • MongoDB: the official server with --readOnly.
  • Several engines, including Google Cloud: MCP Toolbox, with tools declared explicitly.
  • Never point a write-enabled server at production, and keep approval of tool calls on. Query results come from your own data, so a hostile row can carry instructions.

If you would rather give the agent an ORM than raw SQL, Drizzle ORM covers Postgres, MySQL and SQLite with typed schemas, and PocketBase is a self-hosted backend that bundles its own database. Agents also learn database habits from skills: Supabase's supabase-postgres-best-practices is listed in the Skills registry, and what agent skills are explains how they install.

Sources

Checked 13 November 2026: Supabase MCP docs, Neon MCP README, Postgres MCP Pro README, MongoDB MCP Server README, DBHub README, MCP Toolbox README, archived reference servers.

All database servers we track are on the MCP servers hub. Related: best MCP servers for web developers.