English Français العربية

io.github.Kitalon-Labs-LLC/pgmoat

Official registry Data and databases

Governed, read-only Postgres access for AI agents: SQL safety, RLS, budgets, tamper-evident audit.

Source code Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package pgmoat
Claude Code 
claude mcp add pgmoat -e 'PGMOAT_DATABASE_URL=<your pgmoat_database_url>' -- npx -y pgmoat@0.1.1
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "pgmoat": {
            "command": "npx",
            "args": [
                "-y",
                "pgmoat@0.1.1"
            ],
            "env": {
                "PGMOAT_DATABASE_URL": "<your pgmoat_database_url>"
            }
        }
    }
}

Environment variables

  • PGMOAT_DATABASE_URL required secret Postgres connection URL (use a read-only role)

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. pgmoat
  2. Quickstart
  3. Add descriptions and hide sensitive data
  4. Commands
  5. What pgmoat does not do
  6. Docker
  7. Contributing
  8. Links
  9. License

pgmoat

Governed Postgres access for AI agents.

pgmoat is an open-source MCP server that gives AI agents read-only access to Postgres. It checks every query with the real Postgres parser, hides the tables and columns you mark hidden, applies row limits and timeouts, binds Row-Level Security to the caller's identity, and writes a tamper-evident audit log.

Requires Node.js 22.12 or newer and Postgres 15 to 18.

Quickstart

Run it against your database with safe defaults, no config file needed:

npx -y pgmoat postgresql://readonly_user:password@localhost:5432/mydb

Add it to Claude Code:

claude mcp add pgmoat -- npx -y pgmoat postgresql://readonly_user:password@localhost:5432/mydb

Or to Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "pgmoat": {
      "command": "npx",
      "args": ["-y", "pgmoat", "--url-env", "PGMOAT_DATABASE_URL"],
      "env": { "PGMOAT_DATABASE_URL": "postgresql://readonly_user:password@localhost:5432/mydb" }
    }
  }
}

Passing the URL through --url-env keeps the password out of process listings.

Use a dedicated read-only role. pgmoat warns at startup if the role is a superuser or can write.

Add descriptions and hide sensitive data

export PGMOAT_DATABASE_URL=postgresql://readonly_user:password@localhost:5432/mydb
npx pgmoat init          # writes pgmoat.yaml; auto-hides columns like password_hash and token_hash
npx pgmoat validate      # checks the file against the schema and the database
npx pgmoat doctor        # checks the role for unsafe privileges
npx pgmoat start         # starts the server with ./pgmoat.yaml

A pgmoat.yaml looks like this:

version: 1
server:
  name: mydb
connection:
  url: ${PGMOAT_DATABASE_URL}
  schemas: [public]
mode: read-only
budgets:
  max_rows: 200
  max_query_ms: 5000
tables:
  users:
    description: "One row per login account"
    columns:
      password_hash: { hidden: true }
      email:         { sensitive: high }

Commands

CommandWhat it does
pgmoat <postgres-url>Start with safe defaults (no config file)
pgmoat initCreate pgmoat.yaml from your database
pgmoat startStart the MCP server from pgmoat.yaml
pgmoat validateCheck pgmoat.yaml against the schema and the database
pgmoat doctorCheck the database role for unsafe privileges
pgmoat audit verifyVerify the audit log hash chain
pgmoat schema-exportWrite the visible schema as Markdown

Run pgmoat --help for all options.

What pgmoat does not do

  • It does not stop prompt injection. It removes the write path, hides what you mark hidden, and labels returned data as untrusted, but an agent with other tools (web access, email) can still be tricked into sending readable data elsewhere.
  • It does not replace Postgres permissions. The strongest control is a dedicated role with only the grants it needs.
  • It does not make RLS policies correct. It sets the session variables your policies read. A flawed policy stays flawed.
  • It does not guarantee audit delivery to a remote destination during an outage. It buffers, alarms, and records drops.

Docker

docker run -i --rm \
  -e PGMOAT_DATABASE_URL="postgresql://readonly_user:password@host.docker.internal:5432/mydb" \
  ghcr.io/kitalon-labs-llc/pgmoat:latest

Contributing

See CONTRIBUTING.md. Report vulnerabilities privately as described in SECURITY.md.

License

MIT (c) 2026 Kitalon Labs

Frequently asked questions

What is io.github.Kitalon-Labs-LLC/pgmoat?

Governed, read-only Postgres access for AI agents: SQL safety, RLS, budgets, tamper-evident audit.

How do I install io.github.Kitalon-Labs-LLC/pgmoat?

It runs on your machine. In Claude Code: claude mcp add pgmoat -e 'PGMOAT_DATABASE_URL=<your pgmoat_database_url>' -- npx -y pgmoat@0.1.1. For other clients, paste the JSON configuration from this page into their MCP settings.

Does io.github.Kitalon-Labs-LLC/pgmoat need an API key?

Yes. It expects PGMOAT_DATABASE_URL, which you set in its configuration.

Is io.github.Kitalon-Labs-LLC/pgmoat open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains io.github.Kitalon-Labs-LLC/pgmoat?

It is published by Kitalon-Labs-LLC. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.