Read-only is enforced by the transaction — BEGIN READ ONLY, not a pattern match over the SQL — which is the version of that guarantee actually worth having. The write tool then sits behind three independent layers: it does not exist unless enabled, the guardrails can demand a WHERE clause and cap insert size, and the destructive annotation makes a compliant client ask before each call. That layering, plus being maintained by Yugabyte, is the argument for it over a generic Postgres server.
Yugabyte's own server for YugabyteDB and PostgreSQL. It summarises a schema, runs SELECTs inside a read-only transaction, and — only when explicitly enabled — executes write statements through a configurable guardrail layer.
- summarize_database lists a schema's tables with their columns and row counts, read-only
- run_read_only_query executes a SELECT under BEGIN READ ONLY and returns the result as JSON, so the constraint is enforced by the transaction rather than by inspecting the SQL string
- run_write_query covers INSERT, UPDATE, DELETE, MERGE, TRUNCATE and DDL behind a guardrail blocklist, and does not exist at all unless it has been enabled
- The write tool is annotated destructiveHint, so a client such as Claude Desktop asks for confirmation before every call even where the guardrails would have let the statement through
- Guardrails you set yourself: a cap on how many rows an INSERT … VALUES may carry, defaulting to 1000, and optional refusal of an UPDATE or DELETE that has no WHERE clause
- Stdio by default, or HTTP — with stateless Streamable HTTP for a self-hosted deployment running several replicas
- Optional OAuth through AWS Cognito or a generic OIDC provider, with Origin-header validation for a remote deployment
Python 3.10 or newer, published on PyPI as yugabytedb-mcp-server and runnable through uvx, pipx, uv tool or pip — while v2 is still a release candidate, installing it needs an explicit version or a pre-release flag. YUGABYTEDB_URL takes a libpq connection string. Writes require YB_MCP_ENABLE_WRITE_QUERY, with the insert-row cap and the WHERE-clause requirements as separate settings. In HTTP mode it binds to 127.0.0.1 by default; exposing it on all interfaces makes MCP_AUTH_PROVIDER mandatory, alongside MCP_BASE_URL and an Origin allowlist.
One command plus a key — pipx install yugabytedb-mcp-server, then supply credentials