Unreleased: not public yet. Maintainers have not reviewed this result.
Results / @henkey/postgres-mcp-server
@henkey/postgres-mcp-server
A
Protocol4/4 points
F
Database3/7 pointscritical: mutating-sql
Coverage: low (1 of 18 tools reached with a valid call).
Protocol checks
| Check | Verdict | What happened |
|---|---|---|
| protocol Valid MCP handshake and tool schemas | pass | handshake ok, 18 well-formed tool(s) |
| tool-poisoningcritical No tool-poisoning indicators in tool metadata | pass | scanned 18 tool definition(s), including parameter text: nothing suspicious |
| robust-input Survives malformed tool input | pass | 70 invalid call(s) rejected cleanly |
| secret-echocritical No environment secret echoed in responses | pass | canary secrets absent from tools/list and 70 captured response(s) |
Database checks
| Check | Verdict | What happened |
|---|---|---|
| read-only Read-only by default | fail | writes executed through pg_execute_sql |
| write-gate (advisory) Write approval gate | fail | writes executed with no confirmation step through pg_execute_sql (advisory: MCP clients may add their own approval) |
| rlscritical Row-level security respected | pass | DB-enforced: the server passed the policy through and added no filtering of its own (support role saw only its own tenant on every tool) |
| mutating-sqlcritical Mutating SQL blocked | fail | EXECUTED: stacked statements (DROP), stacked statements (INSERT), COMMIT then write (read-only transaction escape), case and comment obfuscation (INSERT), data-modifying CTE (DELETE), data-modifying CTE (INSERT), function with side effects (defeats any prefix filter by construction), anonymous DO block, TRUNCATE, DDL (CREATE TABLE), DDL via SELECT INTO, PREPARE then EXECUTE, session state (disable read-only, then write), PREPARE and EXECUTE in one call, function with side effects in FROM, EXPLAIN ANALYZE runs the statement; 0 of 16 blocked |
| piicritical Personal data masking respected | pass | DB-enforced: the server passed the grants through and added no filtering of its own (analyst role never received raw emails on any tool) |
| pii-masked Masked data reachable | pass | the masked view was readable and returned only masked emails |
| db-rowcap Row cap | fail | no row cap: 200,000 rows could be read through every tool |
| db-timeout Statement timeout | fail | no statement timeout within 18s (expected 10s): SELECT pg_sleep(30) on pg_execute_sql |
| audit (advisory) Every call logged | n/a | not measured: servers do not write audit rows by themselves |
| db-privilege (advisory) Connects as the database role it was given | pass | every instance connected as exactly the role it was given (sm_admin, sm_support, sm_analyst); none is a superuser, has BYPASSRLS or owns an RLS table |
What was not covered
- HTTP: Not applicable. The server is started over stdio; the http pack needs server.url
- Files: Not applicable. The server config has no {sandbox} placeholder, so the harness cannot tell which directory the server is allowed to use (a server with a wider root would read the canary legitimately); pass {sandbox} as its directory argument
- Git: Not applicable. No tool is classified as taking a git repository path with medium confidence or higher
- Network: Not applicable. No tool is classified as taking a URL with medium confidence or higher
- SQLite: Not applicable. No {sqlite_path} placeholder in the server config, so the harness cannot give the server a database to grade (add {sqlite_path} to the server args)
- Effects: Not applicable. No tool declares annotations, so there is nothing to compare with what the sandbox observed
- Tool "pg_manage_query" was not probed as a SQL tool: also requires operation, which the harness cannot fill in, so it is not probed
- Tool "pg_execute_query" was not probed as a SQL tool: also requires operation, which the harness cannot fill in, so it is not probed
- Tool "pg_manage_indexes" (path) was not probed by the fs pack: the server config has no {sandbox} placeholder, so the harness cannot tell which directory the server is allowed to use (a server with a wider root would read the canary legitimately); pass {sandbox} as its directory argument
- Tools that a server lists only for clients that declare roots, sampling or elicitation capabilities are not seen: the harness declares none
- Tool "pg_analyze_database" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- Tool "pg_debug_database" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- Tool "pg_manage_schema" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- Tool "pg_manage_functions" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
Run it yourself
Started with the standard settings like this; put it in sealmark.yaml as the server:
npx -y @henkey/postgres-mcp-server@1.0.7
Each of 613 verdicts was checked independently, and Sealmark was wrong on some: how reliable Sealmark is.
Think a verdict is wrong, or want a server removed? Email disclosure@sealmark.dev with the server version. We recheck, correct the page if we were wrong, and add your reply. See the disclosure policy.