Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 5
- 4 4
- 3 5
- 2 6
- 1 0
Trust in production
- Trust it - 30%
- With caveats - 35%
- Wouldn't - 35%
55% would recommend this server
How reviewers scored it
- Setup & docs 3.3
- Auth experience 3.3
- Reliability 3.8
- Maintainer responsiveness 3.9
Why it got a C
Bytebase's MIT-licensed server, very active, and the Claude Code docs' own Postgres example. execute_sql can write unless you set readonly = true in a dbhub.toml (the Claude Code plugin and MCP Bundle ship read-only); since 0.22.6 the database's own read-only mode backs that up, and 1.6.0 also stops DDL on MySQL and MariaDB. Three 2026 advisories, including a MySQL/MariaDB read-only bypass (GHSA-j656-3hf2-fvjc), were fixed before they were published, so run 1.6.0 or later with a read-only database user. Nearly all code comes from one maintainer. Biggest deduction: HTTP mode is plain HTTP on every network interface with no login unless you add --auth-token, so prefer stdio or bind it to 127.0.0.1.
How to connect
// ~/.cursor/mcp.json
{ "mcpServers": { "dbhub": { "command": "npx",
"args": ["@bytebase/dbhub@latest", "--transport", "stdio",
"--dsn", "postgres://user:password@localhost:5432/dbname"] } } }// .vscode/mcp.json in your project root
{ "inputs": [ { "type": "promptString", "id": "db-dsn",
"description": "Database connection string", "password": true } ],
"servers": { "dbhub": { "type": "stdio", "command": "npx",
"args": ["@bytebase/dbhub@latest", "--transport", "stdio",
"--dsn", "${input:db-dsn}"] } } }claude mcp add --transport stdio dbhub -- npx @bytebase/dbhub@latest --transport stdio --dsn "postgres://user:password@localhost:5432/dbname"// claude_desktop_config.json
{ "mcpServers": { "dbhub": { "command": "npx",
"args": ["@bytebase/dbhub@latest", "--transport", "stdio",
"--dsn", "postgres://user:password@localhost:5432/dbname"] } } }Is DBHub safe?
Is DBHub safe to use?
DBHub grades C (usable with care). Login is optional, so check that it is turned on in your setup. Upkeep is hard to verify (closed source or a single maintainer), so pin the version you tested. It shells out to helper programs or serves HTTP without enforced TLS, so keep it local and isolated.
Does DBHub have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does DBHub support authentication?
Optionally. It can run with a login, but it does not require one, so turn it on.
Alternatives in Databases & Data Stores
- A MongoDB MCP ServerQuery and administer MongoDB and Atlas clusters from an agent.
- A Neon MCP ServerOfficial hosted Neon server to manage Postgres projects and branches, run SQL, and inspect schema.
- A Supabase MCP ServerOfficial hosted Supabase server to manage projects, run SQL, and inspect schema.
- B BigQuery MCP ServerGoogle-hosted remote server to list datasets and tables, read schemas, and run SQL in BigQuery.
- B MCP Toolbox for DatabasesGoogle's open-source MCP server with prebuilt tools for Postgres, MySQL, BigQuery, AlloyDB, Cloud SQL, Spanner, and more.
Embed this badge
[](https://trustedmcp.io/servers/dbhub)<a href="https://trustedmcp.io/servers/dbhub"><img src="https://trustedmcp.io/badge/dbhub.svg" alt="TrustedMCP grade C" height="80"></a>Community reviews
Saves me a context switch every hour
I use this almost daily. I run it with auth enabled. Without it I would not let it near anything shared. Good choice if you need DBHub in your agent.
Used for Generating SQL for ad-hoc reports
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Easy win for our agent setup
Our agents call this dozens of times a day. I run it with auth enabled. Without it I would not let it near anything shared. Running it with the read-only flag and have not missed write access.
Used for Incident investigation
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Would not run this unattended
Gave it a fair shot over two weeks. I run it with auth enabled. Without it I would not let it near anything shared. Filed an issue and got a reply within two days.
Used for Schema exploration during a migration
- Setup & docs 1/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 2/5
Better than the DIY script it replaced
Clear tool names, sensible outputs, very few surprises. I run it with auth enabled. Without it I would not let it near anything shared. Running it with the read-only flag and have not missed write access.
Used for Answering support questions from the database
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Works, just lock it down
Useful tool, though I would not hand it to a junior unsupervised. Out of the box it runs without sign-in, so remember to enable auth before exposing it anywhere. I gave it a database user that can only read the tables it needs.
Used for Generating SQL for ad-hoc reports
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Struggled to get it stable
Not what I expected from the description. Used a fine-grained token with short expiry and it works fine with that. Out of the box it runs without sign-in, so remember to enable auth before exposing it anywhere. For anything real I would look elsewhere.
Used for Debugging data issues in staging
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Recommended it to two teams already
Set this up for our team after comparing a few options. Auth is optional, which is convenient locally. I turned it on before sharing it with the team.
Used for Debugging data issues in staging
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Too many sharp edges
Ran into problems pretty quickly. Updates land regularly, and nothing broke when I upgraded. Auth is optional, which is convenient locally. I turned it on before sharing it with the team. I gave it a database user that can only read the tables it needs. Not something I would put in production yet.
Used for Answering support questions from the database
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 2/5
Set it up once, forgot about it
Hooked DBHub into Claude Code and it worked on the first try. Running it with the read-only flag and have not missed write access. Auth is optional, which is convenient locally. I turned it on before sharing it with the team.
Used for Prototyping queries before writing code
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Worth the five minutes to set up
Tried it on a side project first, then rolled it out at work. Out of the box it runs without sign-in, so remember to enable auth before exposing it anywhere. You can tell it is actively maintained, the rough edges keep getting fixed. It is in our production agent and I sleep fine.
Used for Debugging data issues in staging
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Our team uses it every day
Been running this for about a month now. You can tell it is actively maintained, the rough edges keep getting fixed. Out of the box it runs without sign-in, so remember to enable auth before exposing it anywhere. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent.
Used for Schema exploration during a migration
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Fine once configured properly
Some tools are great, a couple feel half finished. I gave it a database user that can only read the tables it needs. Fine in production if you sandbox it.
Used for Checking data quality after imports
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 5/5
Security story needs work
I wanted to like this one. Running it with the read-only flag and have not missed write access. I run it with auth enabled. Without it I would not let it near anything shared. Keeping it to local experiments for now.
Used for Prototyping queries before writing code
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 1/5
- Maintainer responsiveness 3/5
Too much access for my comfort
Setup was rough and the result was flaky. Read-only mode is the first thing I enable, and it covers most of what I need. I will check back in a few releases.
Used for Checking data quality after imports
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Decent, not set-and-forget
Good for experimenting, still deciding about production. Out of the box it runs without sign-in, so remember to enable auth before exposing it anywhere. Token setup is the fiddliest part, after that it is smooth.
Used for Read-only analytics questions
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Does the job, docs could be better
I like it, with reservations. Out of the box it runs without sign-in, so remember to enable auth before exposing it anywhere. Filed an issue and got a reply within two days.
Used for Schema exploration during a migration
- Setup & docs 3/5
- Auth experience 2/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Fine for a demo, not for prod
It works in a demo, but things got shaky under real use. Auth is optional, which is convenient locally. I turned it on before sharing it with the team. I gave it a database user that can only read the tables it needs.
Used for Prototyping queries before writing code
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 2/5
The DBHub integration I wanted
Installed it on a Friday, it was part of my workflow by Monday. I run it with auth enabled. Without it I would not let it near anything shared. Happy to run it in production.
Used for Incident investigation
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Good, but read the permissions first
Mostly reliable, with the odd timeout. I gave it a database user that can only read the tables it needs. Updates land regularly, and nothing broke when I upgraded.
Used for Read-only analytics questions
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Exactly what I needed from DBHub
Started with it as an experiment, now it is a fixture. Auth is optional, which is convenient locally. I turned it on before sharing it with the team. Would recommend without hesitation.
Used for Checking data quality after imports
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.