Unreleased: not public yet. Maintainers have not reviewed this result.
Results / postgres-mcp
postgres-mcp
A
Protocol4/4 points
F
Database3/7 pointscritical: mutating-sql
Coverage: low (1 of 9 tools reached with a valid call).
Protocol checks
| Check | Verdict | What happened |
|---|---|---|
| protocol Valid MCP handshake and tool schemas | pass | handshake ok, 9 well-formed tool(s) |
| tool-poisoningcritical No tool-poisoning indicators in tool metadata | pass | scanned 9 tool definition(s), including parameter text: nothing suspicious |
| robust-input Survives malformed tool input | pass | 28 invalid call(s) rejected cleanly |
| secret-echocritical No environment secret echoed in responses | pass | canary secrets absent from tools/list and 28 captured response(s) |
Database checks
| Check | Verdict | What happened |
|---|---|---|
| read-only Read-only by default | fail | writes executed through execute_sql |
| write-gate (advisory) Write approval gate | fail | writes executed with no confirmation step through execute_sql (advisory: MCP clients may add their own approval) |
| rlscritical Row-level security respected | pass | DB-enforced: the server passed the policy through and added no filtering of its own (support role saw only its own tenant on every tool) |
| mutating-sqlcritical Mutating SQL blocked | fail | EXECUTED: stacked statements (DROP), stacked statements (INSERT), COMMIT then write (read-only transaction escape), case and comment obfuscation (INSERT), data-modifying CTE (DELETE), data-modifying CTE (INSERT), function with side effects (defeats any prefix filter by construction), anonymous DO block, TRUNCATE, DDL (CREATE TABLE), DDL via SELECT INTO, session state (disable read-only, then write), PREPARE and EXECUTE in one call, function with side effects in FROM, EXPLAIN ANALYZE runs the statement; 1 of 16 blocked |
| piicritical Personal data masking respected | pass | DB-enforced: the server passed the grants through and added no filtering of its own (analyst role never received raw emails on any tool) |
| pii-masked Masked data reachable | pass | the masked view was readable and returned only masked emails |
| db-rowcap Row cap | fail | no row cap: 200,000 rows could be read through every tool |
| db-timeout Statement timeout | fail | no statement timeout within 18s (expected 10s): SELECT pg_sleep(30) on execute_sql |
| audit (advisory) Every call logged | n/a | not measured: servers do not write audit rows by themselves |
| db-privilege (advisory) Connects as the database role it was given | pass | every instance connected as exactly the role it was given (sm_admin, sm_support, sm_analyst); none is a superuser, has BYPASSRLS or owns an RLS table |
What was not covered
- HTTP: Not applicable. The server is started over stdio; the http pack needs server.url
- Files: Not applicable. No tool is classified as taking a file path with medium confidence or higher
- Git: Not applicable. No tool is classified as taking a git repository path with medium confidence or higher
- Network: Not applicable. No tool is classified as taking a URL with medium confidence or higher
- SQLite: Not applicable. No {sqlite_path} placeholder in the server config, so the harness cannot give the server a database to grade (add {sqlite_path} to the server args)
- Effects: Not applicable. No tool takes a harness-owned target (file path, repository or URL) with medium confidence or higher
- Tools that a server lists only for clients that declare roots, sampling or elicitation capabilities are not seen: the harness declares none
- Tool "list_schemas" is covered by the core checks only: the tool takes no parameters; add it under tools: to include it
- Tool "list_objects" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- Tool "get_object_details" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- Tool "analyze_workload_indexes" is covered by the core checks only: the tool has no string parameters; add it under tools: to include it
- Tool "analyze_db_health" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- Tool "get_top_queries" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- Tool "list_schemas" was not covered by the core pack: needs probes: to be called (no arguments, and not declared read-only)
Run it yourself
Started with the standard settings like this; put it in sealmark.yaml as the server:
uvx postgres-mcp==0.3.0
Each of 613 verdicts was checked independently, and Sealmark was wrong on some: how reliable Sealmark is.
Think a verdict is wrong, or want a server removed? Email disclosure@sealmark.dev with the server version. We recheck, correct the page if we were wrong, and add your reply. See the disclosure policy.