Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 0
- 4 2
- 3 4
- 2 2
- 1 0
Trust in production
- Trust it - 13%
- With caveats - 63%
- Wouldn't - 25%
63% would recommend this server
How reviewers scored it
- Setup & docs 3.0
- Auth experience 3.0
- Reliability 3.1
- Maintainer responsiveness 3.9
Why it got a B
Google's open-source server, and the closest thing to an official Postgres MCP server; one binary covers about 20 databases. It is very active, with more than a dozen Google engineers committing in the last 90 days. Twelve 2026 CVEs (auth bypasses, SQL injection, SSRF) were all fixed before disclosure, so run v1.5.0 or later. Use --prebuilt=postgres/data or a tools.yaml to limit tools, and connect as a read-only database user. Biggest deduction: HTTP mode has no login and no TLS by default and accepts any Origin, so prefer --stdio.
How to connect
// .cursor/mcp.json in your project root
{ "mcpServers": { "postgres": { "command": "./PATH/TO/toolbox",
"args": ["--prebuilt","postgres","--stdio"],
"env": { "POSTGRES_HOST": "", "POSTGRES_PORT": "", "POSTGRES_DATABASE": "",
"POSTGRES_USER": "", "POSTGRES_PASSWORD": "" } } } }// .vscode/mcp.json in your project root
{ "servers": { "postgres": { "command": "./PATH/TO/toolbox",
"args": ["--prebuilt","postgres","--stdio"],
"env": { "POSTGRES_HOST": "", "POSTGRES_PORT": "", "POSTGRES_DATABASE": "",
"POSTGRES_USER": "", "POSTGRES_PASSWORD": "" } } } }// .mcp.json in your project root (Toolbox docs, Postgres guide)
{ "mcpServers": { "postgres": { "command": "./PATH/TO/toolbox",
"args": ["--prebuilt","postgres","--stdio"],
"env": { "POSTGRES_HOST": "", "POSTGRES_PORT": "", "POSTGRES_DATABASE": "",
"POSTGRES_USER": "", "POSTGRES_PASSWORD": "" } } } }// Settings > Developer > Edit Config
{ "mcpServers": { "postgres": { "command": "./PATH/TO/toolbox",
"args": ["--prebuilt","postgres","--stdio"],
"env": { "POSTGRES_HOST": "", "POSTGRES_PORT": "", "POSTGRES_DATABASE": "",
"POSTGRES_USER": "", "POSTGRES_PASSWORD": "" } } } }Is MCP Toolbox for Databases safe?
Is MCP Toolbox for Databases safe to use?
MCP Toolbox for Databases grades B (solid, with minor gaps). Login is optional, so check that it is turned on in your setup. It shells out to helper programs or serves HTTP without enforced TLS, so keep it local and isolated.
Does MCP Toolbox for Databases have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does MCP Toolbox for Databases support authentication?
Optionally. It can run with a login, but it does not require one, so turn it on.
Alternatives in Databases & Data Stores
- A MongoDB MCP ServerQuery and administer MongoDB and Atlas clusters from an agent.
- A Neon MCP ServerOfficial hosted Neon server to manage Postgres projects and branches, run SQL, and inspect schema.
- A Supabase MCP ServerOfficial hosted Supabase server to manage projects, run SQL, and inspect schema.
- B BigQuery MCP ServerGoogle-hosted remote server to list datasets and tables, read schemas, and run SQL in BigQuery.
- B OMOPHub MCP ServerOfficial server to search, map and walk the hierarchy of 11M+ OHDSI OMOP medical concepts (SNOMED CT, ICD-10, RxNorm, LOINC) over stdio or a hosted HTTPS endpoint.
Embed this badge
[](https://trustedmcp.io/servers/mcp-toolbox-for-databases)<a href="https://trustedmcp.io/servers/mcp-toolbox-for-databases"><img src="https://trustedmcp.io/badge/mcp-toolbox-for-databases.svg" alt="TrustedMCP grade B" height="80"></a>Community reviews
Quietly reliable
Started with it as an experiment, now it is a fixture. Updates land regularly, and nothing broke when I upgraded. Out of the box it runs without sign-in, so remember to enable auth before exposing it anywhere. Worth it, just do not skip the hardening steps.
Used for Checking data quality after imports
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Capable but needs guardrails
Took longer to configure than I expected. Read-only mode is the first thing I enable, and it covers most of what I need. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. I would use it in prod, but only with a human approving writes.
Used for Generating SQL for ad-hoc reports
- Setup & docs 4/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 5/5
Does what it says, no drama
Tried it on a side project first, then rolled it out at work. Out of the box it runs without sign-in, so remember to enable auth before exposing it anywhere. Good choice if you need Toolbox for Databases in your agent.
Used for Incident investigation
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Security story needs work
Not what I expected from the description. Nice to use something maintained by Google rather than a random fork. You can tell it is actively maintained, the rough edges keep getting fixed. I run it with auth enabled. Without it I would not let it near anything shared. Not something I would put in production yet.
Used for Schema exploration during a migration
- Setup & docs 1/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Good, but read the permissions first
Works well enough for what I need. Auth is optional, which is convenient locally. I turned it on before sharing it with the team. Updates land regularly, and nothing broke when I upgraded.
Used for Answering support questions from the database
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Not ready for anything that matters
I wanted to like this one. Auth is optional, which is convenient locally. I turned it on before sharing it with the team. I gave it a database user that can only read the tables it needs. Releases come often and the changelog is clear.
Used for Read-only analytics questions
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 4/5
Decent, not set-and-forget
Good for experimenting, still deciding about production. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. I run it with auth enabled. Without it I would not let it near anything shared. Keeping it to local experiments for now.
Used for Debugging data issues in staging
- Setup & docs 3/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Useful, with a few rough edges
Useful tool, though I would not hand it to a junior unsupervised. Turned on read-only mode on day one, highly recommend doing the same. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent.
Used for Prototyping queries before writing code
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.