There is a single tool, query, taking a sql string, and the description says read-only and stops there. Anything a client might otherwise reach through a typed helper — which tables exist, what a column holds, how large a result will be — has to be written as SQL and sent through that same call, so the model's SQL is the interface. The trade reads cleanly in both directions: nothing here can write, and nothing here will describe the schema for you either.
A single-tool PostgreSQL server: query takes a sql string and runs it read-only against the database named in the connection string the server was started with.
- query runs a read-only SQL statement and returns its result; the sql string is the entire input.
- The target database is fixed by the connection string given at startup, so a running session cannot be pointed at a different database part-way through a conversation.
- Schema discovery goes through the same call: with query as the only entry point, finding out which tables exist is itself SQL.
A PostgreSQL database you can reach and its connection string; the server itself takes no separate credentials.
One command — docker run -i --rm mcp/postgres postgresql://host.docker.internal:5432/mydb