mcp-postgres in 2026: Read-Only Views Are the Right Default for AI Agents

TL;DR — The Postgres MCP server lets agents inspect schemas and run SELECTs through a read-only transaction. Mount it against a scoped role pointed at a curated set of v_* views and you get the analytical superpowers of an LLM without giving it a foot-gun. We do exactly this for the CallSphere admin layer.

What the MCP server does

@modelcontextprotocol/server-postgres is the reference Postgres MCP from Anthropic. It exposes two surfaces to an LLM client: a resource list that returns schema metadata for every table the role can see (column names, types, primary keys), and a single query tool that accepts arbitrary SQL and runs it inside a BEGIN TRANSACTION READ ONLY block. The transaction wrapper is the security story — even if the LLM hallucinates an UPDATE, Postgres throws.

Postgres MCP Pro (crystaldba/postgres-mcp) is the production-grade fork: it adds index recommendations, query plan analysis, configurable read/write modes, and connection pooling. For agents that just need to answer questions about your data, the reference server is enough.

flowchart LR
 A[LLM Client] -->|JSON-RPC| B[mcp-postgres]
 B -->|BEGIN READ ONLY| C[(Postgres)]
 C -->|rows| B
 B -->|tool result| A
 D[Schema Discovery] -->|resources/list| B

Auth + transport (sse/stdio/http)

The reference server is stdio-only — it runs as a child process of the MCP client (Claude Desktop, Cursor, your own host) and reads JSON-RPC from stdin. There's no built-in network listener, so auth is just whatever Postgres role you point it at via the DATABASE_URL.

For remote use, wrap the stdio server in an HTTP shim (mcp-proxy or AWS Lambda streamable-HTTP) and put OAuth 2.1 + PKCE in front. We deploy our internal Postgres MCP via streamable HTTP behind WorkOS, with a per-user role swap at session start.

How CallSphere uses it

CallSphere ships 37 specialist agents across 6 verticals (healthcare, real estate, IT services, salon, behavioral health, generic), and the data they read lives in 115+ Postgres tables. We do not mount the raw schema. Instead we expose a curated set of v_* views — v_calls_today, v_unified_pipeline, v_voice_session_summary — that pre-join, pre-aggregate, and PII-mask. The MCP role only has SELECT on the reporting schema; even with read-only off, it would have nothing to break.

Concrete shape: our Healthcare deployment runs 14 specialist tools (intake, copay quote, prior-auth status, formulary lookup), and the MCP-fronted Postgres views feed the analytics dashboards behind those tools. Our Real Estate OneRoof deployment uses 10 specialist agents and 90+ tools, and Postgres MCP is the read path for every "what did the agent do last week?" question.

Build / install

1. Create a Postgres role: CREATE ROLE mcp_reader LOGIN PASSWORD '...'; GRANT USAGE ON SCHEMA reporting TO mcp_reader; GRANT SELECT ON ALL TABLES IN SCHEMA reporting TO mcp_reader;.
2. Install: npx -y @modelcontextprotocol/server-postgres "postgres://mcp_reader:...@host:5432/db?sslmode=require".
3. Register in your MCP client config (claude_desktop_config.json or .cursor/mcp.json) with the postgres command and the connection string in env.
4. For remote: run inside a Docker sidecar and front it with mcp-proxy over Streamable HTTP; put it behind your IdP.
5. Add a description resource per view so the LLM knows which view to query — comment your views in SQL and the MCP server surfaces those comments.
6. Test with the MCP Inspector (npx @modelcontextprotocol/inspector) before shipping.

FAQ

Why not just expose tables directly? LLMs hallucinate column names. Views give you a stable contract and let you mask PII once.

Can the agent do migrations? Not with the reference server. Postgres MCP Pro has a write mode behind a flag — gate it behind human-in-the-loop.

What about row-level security? RLS works perfectly. Set the JWT claim from the MCP session and let Postgres filter rows by tenant.

How do I handle long queries? Add SET LOCAL statement_timeout = '15s' in a prepare hook so a runaway agent can't tank your DB.

Explore a live demo and compare current plans to find the right fit for your business.

Sources

• PostgreSQL MCP Server (npm)
• Postgres MCP Pro (crystaldba)
• Supabase MCP Docs
• pgEdge Postgres MCP

mcp-postgres in 2026: Read-Only Views Are the Right Default for AI Agents: production view

mcp-postgres in 2026: Read-Only Views Are the Right Default for AI Agents usually starts as an architecture diagram, then collides with reality the first week of pilot. You discover that vector store choice (ChromaDB vs. Postgres pgvector vs. managed) is not really a vector store choice — it's a latency, freshness, and ops choice. Picking wrong forces a re-platform six months in, exactly when you have customers depending on it.

Serving stack tradeoffs

The big fork is managed (OpenAI Realtime, ElevenLabs Conversational AI) versus self-hosted on GPUs you operate. Managed wins on cold-start, model freshness, and zero-ops; self-hosted wins on unit economics past a certain conversation volume and on data residency for regulated verticals. CallSphere runs hybrid: Realtime for live calls, self-hosted Whisper + a hosted LLM for async, both routed through a Go gateway that enforces per-tenant rate limits.

Latency budgets are non-negotiable on voice. End-to-end target is sub-800ms ASR-to-first-token and sub-1.4s first-audio-out; anything beyond that and turn-taking feels stilted. GPU residency in the same region as your TURN servers matters more than choosing a slightly bigger model.

Observability is the unglamorous backbone — every conversation produces logs, traces, sentiment scoring, and cost attribution piped to a per-tenant dashboard. HIPAA aligned isolation keeps healthcare traffic separated from salon traffic at the storage layer, not just the API.

FAQ

Why does mcp-postgres in 2026: read-only views are the right default for ai agents matter for revenue, not just engineering? The healthcare stack is a concrete example: FastAPI + OpenAI Realtime API + NestJS + Prisma + Postgres healthcare_voice schema + Twilio voice + AWS SES + JWT auth, all HIPAA aligned. For a topic like "mcp-postgres in 2026: Read-Only Views Are the Right Default for AI Agents", that means you're not starting from scratch — you're configuring an agent template that's already been hardened across thousands of conversations.

What are the most common mistakes teams make on day one? Day one is integration mapping (scheduler, CRM, messaging) and prompt tuning against your top 20 real call transcripts. Day two through five is shadow-mode running, where the agent transcribes and recommends but a human still answers, so you can compare side-by-side. Go-live is the moment your eval pass-rate clears your internal bar.

How does CallSphere's stack handle this differently than a generic chatbot? The honest answer: it scales until your tool catalog gets stale. The agent is only as good as the integrations it can actually call, so the operational discipline is keeping schemas, webhooks, and fallback paths green. The platform handles the rest — observability, retries, multi-region routing — without your team owning the GPU layer.

Talk to us

Explore a live demo and compare current plans to find the right fit for your business.