Database MCP servers, compared
A database MCP server is the thing that decides what an AI client can do to your data: which tools exist, whether any of them writes, and what happens when the model guesses. Seven of them have hand-written guides here, and the differences that matter are not the ones a feature table shows.
Two patterns are worth knowing before you pick. First, the name is often ambiguous, and in three different ways: “the Postgres MCP server” and “the Redis MCP server” most often refer to servers that have been archived and whose npm packages are marked deprecated, while “the Elasticsearch MCP server” is ambiguous by version— Elastic stopped publishing to npm at 0.4.0, so the widely-copied npx command installs a July 2025 build. All three install fine, which is the trap in each case. Second, none of these ships read-only by default, and two — Redis and Elasticsearch — ship no such switch at all, which is why the rows below name the guard rather than tick a box. Where a switch exists, the row says where in the configuration it lives; where it does not, the row says what you build instead.
PostgreSQL MCP Server
sources re-read 2026-08-12The name is contested: the server most tutorials still point at now lives in modelcontextprotocol/servers-archived, and its npm package carries a deprecation notice.
- What it is
- Local stdio server against any Postgres connection string. The maintained one, crystaldba/postgres-mcp, has nine tools including index tuning and health checks; the archived reference server had exactly one, query.
- How you stop it writing
- --access-mode=restricted rejects COMMIT and ROLLBACK at the parser, so a model cannot close the read-only transaction and open a writable one.
MongoDB MCP Server
sources re-read 2026-08-13One official server, but two tool surfaces — a database client and an Atlas control plane — with different credentials.
- What it is
- npx or Docker, stdio by default. Around sixty tools: find, aggregate, explain and schema inspection on the data side; cluster, user and access-list management on the Atlas side.
- How you stop it writing
- --readOnly drops every create, update and delete tool. It is off by default, and confirmation prompts depend on client elicitation support, so the flag is the boundary.
Supabase MCP Server
sources re-read 2026-08-11Not really a database server — a project server that happens to include SQL.
- What it is
- Hosted remote server at mcp.supabase.com/mcp with OAuth, covering tables, migrations, edge functions, logs and branches alongside queries.
- How you stop it writing
- Query parameters, not flags: read_only decides whether it can write, project_ref limits it to one project, features decides which tool groups exist. Supabase's own docs say not to point it at production.
Neon MCP Server
sources re-read 2026-08-12Serverless Postgres where the interesting capability is branching a database, not querying one.
- What it is
- Hosted server at mcp.neon.tech. The configuration is the URL: readonly, category and projectId are query parameters, not env vars.
- How you stop it writing
- readonly in the URL, plus the fact that a scoped URL can be verified before use by calling the public list-tools endpoint.
Redis MCP Server
sources re-read 2026-08-14Same ambiguity as Postgres and the same cause: the npm package everyone pastes is Anthropic's reference server, deprecated since April 2025, while the maintained one is a Python package no npx command can reach.
- What it is
- Local stdio server, stdio only — no hosted endpoint. Tools are grouped by Redis type: strings, hashes, lists, sets, sorted sets, JSON, Streams with consumer groups, stateful pub/sub subscriptions, and vector index management for use as an agent memory store.
- How you stop it writing
- None in the server. It is the one here with no read-only flag — the documented control is a Redis ACL user (ACL SETUSER readonlyuser on >pw ~* +@read -@write), enforced by the database rather than by which tools got registered.
Elasticsearch MCP Server
sources re-read 2026-08-14Ambiguous by version rather than by publisher: Elastic stopped shipping to npm at 0.4.0, so the npx command in most write-ups installs 0.3.1 from July 2025 and connects without complaining.
- What it is
- Container only from 0.4.0 — docker.elastic.co/mcp/elasticsearch, stdio or streamable HTTP on :8080. Five tools: list_indices, get_mappings, search, esql, get_shards. Deprecated in favour of the Agent Builder MCP endpoint on Elastic 9.2.0+, which is a Kibana route rather than a server you run.
- How you stop it writing
- None in the server. The Elasticsearch API key is the boundary: a role descriptor granting read and view_index_metadata on named index patterns, which is also what the Agent Builder endpoint scopes its tools by.
ClickHouse MCP Server
sources re-read 2026-08-12Columnar analytics, where the common failure is configuration rather than SQL.
- What it is
- Python server over the HTTP interface, plus chDB for querying files and URLs with no cluster at all.
- How you stop it writing
- Two tiers: writes need CLICKHOUSE_ALLOW_WRITE_ACCESS, and DROP or TRUNCATE needs CLICKHOUSE_ALLOW_DROP on top of it.
Choosing between them
Start with the engine, because the tools that make these servers worth installing are engine-specific: Postgres’ index tuning, Atlas’ performance advisor, ClickHouse’s chDB, Redis’ vector index and Streams consumer groups, Elasticsearch’s ES|QL and shard inspection. A generic “SQL” server would be a driver with extra steps.
Then decide how much surface you are exposing, which is a separate decision from which database you use. Neon and Supabase reach past the data into project and branch management; MongoDB reaches into Atlas and can create billable clusters if you give it service account credentials. Those capabilities are the reason to install the server or the reason not to, depending on who is holding the client.
Finally, set the read-only switch andconnect as a user that cannot write. The switch is the server refusing to register the tool; the grant is the database refusing the statement. They fail independently, which is the point of having both — and on Redis and Elasticsearch, where there is no switch, the grant is carrying the whole load on its own.
Database MCP servers: common questions
What is a database MCP server?
A process that exposes your database to an AI client through the Model Context Protocol, so the model can list collections or tables, read schemas, run queries and — if you let it — write. It is not a driver replacement and not an ORM: the model calls named tools like find or query, and the server is what decides which of those tools exist at all.
Which database MCP server should I install?
The one for the database you have — there is no cross-database server worth using, because the value is in the tools that understand that engine's plans, indexes and schema. The choice that actually matters is within an engine: for Postgres and Redis, whether you install the archived reference server or the maintained one; for Elasticsearch, whether you are on the npm build or the container, and whether your cluster is new enough for the Agent Builder endpoint instead; for MongoDB, whether you also hand it Atlas control-plane credentials.
Is it safe to connect an MCP server to a production database?
Only with a read-only mode enabled at the server and a database user that cannot write, which is two independent guards for a reason. Five of the seven servers here ship a read-only switch and none of them has it on by default. The other two do not have one: Redis expects an ACL user, Elasticsearch expects an API key whose role descriptor grants only read and view_index_metadata — so for those, the credential is the only guard there is. Treat a confirmation prompt as a convenience rather than a control: MongoDB's confirmations, for example, depend on the client supporting elicitation, and a client that does not simply runs the tool.
Can an MCP server drop my tables?
If you leave write tools registered and connect with a privileged user, yes — drop-collection, drop-database and DROP statements are all real tools in these servers. The reliable prevention is a role that lacks the permission, because that holds regardless of which tool the model decides to call and regardless of how the client handles confirmations.
Do database MCP servers work with Claude, Cursor and VS Code?
Yes — all seven are ordinary MCP servers. The local ones (Postgres, MongoDB, Redis, Elasticsearch, ClickHouse) launch over stdio from a client config file; the hosted ones (Neon, Supabase) are added as a URL and authorised with OAuth. Redis is stdio-only, so a client that supports remote servers exclusively cannot connect to it at all; Elasticsearch also offers streamable HTTP, and a stdio-only client reaches that through mcp-proxy. The most common client-side failure is PATH: a client launched from the desktop does not inherit a shell-managed Node, Python or uv, so a bare npx, uvx or mcp-proxy can resolve differently than in your terminal.
Looking for something other than a database? DevOps MCP servers, compared · Code and browser MCP servers, compared · Workspace MCP servers, compared · All setup guides.