Best Database MCP Servers for AI Agents

Pick Postgres MCP Pro for plain Postgres, Supabase MCP or Neon MCP if your database already lives there, MongoDB's server for Mongo and Atlas, and the benborla server for MySQL. Whatever you pick, connect it to a development copy with a read-only role first. An agent that can write SQL can also drop tables. This roundup compares five servers. Checked 31 October 2026.

The short version

Single-pair pages have almost no search demand, so we publish this as a category roundup. Each server links to its listing on this site, and the wider list is the MCP servers directory.

The comparison table

Repository facts on 31 October 2026:

What a database MCP server does

It gives an agent tools to read your schema, run queries, and sometimes change data or manage the hosting project. That lets you ask in plain words for the top ten customers by revenue, or why a query is slow, and get an answer from the real data.

The risk is the same capability. A tool that runs SQL runs any SQL the agent writes, including a mistaken delete. The MCP specification states that tools represent arbitrary code execution and hosts should get user consent before invoking them. For databases that means three habits: least-privilege credentials, a non-production target, and consent on every write.

Postgres MCP Pro

Maintained by Crystal DBA, MIT licensed. The README calls it a Postgres MCP server with index tuning, explain plans, health checks and safe SQL execution. The features it lists: database health analysis (index health, connection utilisation, buffer cache, vacuum health, sequence limits, replication lag), index tuning using search algorithms across possible indexes, and query plan review including simulating hypothetical indexes.

Transport. Both stdio and SSE. Install. With pipx, run pipx install postgres-mcp; a Docker route is also documented. Auth. A database URI in the DATABASE_URI variable. Safety. An --access-mode option; the README's examples use unrestricted, and the other value, restricted, limits operations to read-only transactions and caps execution time.

It is the best fit if you want an agent to tune a database, not only query it. Our listing is Postgres MCP.

Supabase MCP

Maintained by Supabase, Apache-2.0. The README describes connecting Supabase to AI assistants. The hosted server lives at https://mcp.supabase.com/mcp, and you can narrow it with URL parameters. Its example is ?project_ref=<project-ref>&read_only=true&features=database,docs. That one URL scopes the server to one project, blocks mutating tools, and exposes only database and docs features.

The README also covers running against local Supabase CLI environments at http://localhost:54321/mcp and self-hosted Supabase, noting that both offer a limited subset of tools. It links a guide on moving from development to production safely, and lists a readOnly client option for servers configured read-only.

Use those parameters every time. Scoping to a project and read-only is the difference between a helpful assistant and an unsupervised administrator. Our listing is Supabase MCP.

Neon MCP

Maintained by Neon, MIT licensed. The server bridges natural language and the Neon API, so it manages projects and branches as well as running SQL. Its headline feature is migration support through branching: a schema change is tried on a branch first.

Transport. Remote at mcp.neon.tech/mcp. Setup. The README gives three routes: a quick setup command that configures the server for Cursor, VS Code and Claude Code; a remote server with OAuth; and a remote server with an API key for agents where OAuth is not available.

A warning from the README. It says the Neon MCP Server is intended for local development and IDE integrations only, and that the team does not recommend using it in production because it can execute powerful operations that may lead to accidental data loss. Take that at face value. Our listing is Neon MCP.

MongoDB MCP server

Maintained by MongoDB, Apache-2.0. The README describes a server for interacting with MongoDB databases and MongoDB Atlas. It has two forms. The mongodb-atlas plugin connects to a MongoDB-hosted server over OAuth with nothing to run locally, and the README calls that the recommended way to reach Atlas. Plugins are listed for Cursor, VS Code, Claude, Codex, GitHub Copilot CLI and Grok. For a local server, run npx -y mongodb-mcp-server@latest setup, which walks you through a connection string or Atlas API credentials.

The README gives a security recommendation worth copying: pass connection strings and API credentials through environment variables rather than command-line arguments, since arguments can show up in process lists and logs. Our listing is MongoDB MCP.

benborla MySQL server

A community server, MIT licensed. Its README says it is read-only by default, with write operations opted into through environment flags. Install for Claude Code looks like this:

claude mcp add mcp_server_mysql \
  -e MYSQL_HOST="127.0.0.1" \
  -- npx @benborla29/mcp-server-mysql

Add user, password and database variables in the same way. The last push we saw was 27 July 2026. We did not find a first-party server from Oracle in the sources we read.

SQLite, Redis and others

Smaller needs have their own entries on this site: SQLite MCP, Redis MCP, BigQuery MCP and Snowflake MCP. The official reference set no longer carries database servers, so for anything not listed here, search the official MCP Registry at registry.modelcontextprotocol.io and check the maintainer and last-push date.

Safe setup, step by step

1. Pick a non-production target. A local database, a Neon branch or a Supabase project made for development.
2. Create a least-privilege role. Grant SELECT on the tables the agent needs. Do not reuse your admin credentials.
3. Turn on the server's read-only mode if it has one: read_only=true for Supabase, restricted access mode for Postgres MCP Pro, the default for the MySQL server.
4. Scope the server. Use project_ref and features on Supabase. Limit the schemas the role can see.
5. Keep secrets out of arguments. Use environment variables or your agent's secret store.
6. Keep human approval on. Do not auto-approve database tool calls.
7. Log what happens. Turn on query logging in the database so you can see what the agent ran.
8. Test a bad request. Ask the agent to delete a row and confirm the role refuses.

Prompts that work, and prompts that do not

The tools return what you ask for, so the prompt sets the risk.

Good, bounded prompts. "List the tables and columns in the billing schema." "Show the ten slowest queries from the last day and explain why the top one is slow." "Count orders by status for the last 30 days." Each has a limit, a scope and a read-only shape.

Prompts to avoid. "Clean up the duplicate customers." "Fix the broken rows in orders." "Optimise the database." Each invites writes, and the agent will pick its own definition of clean, broken or optimised. If you want a change, ask for the SQL first, read it, and run it yourself or approve it explicitly. On Neon, ask for the migration on a branch and diff the result before you merge.

Schema first. A good habit is to start every session by asking the agent to read the schema and summarise it. It anchors later answers in your real table names and cuts down guesses. The Postgres, Supabase and MongoDB servers all expose schema-reading tools, so this costs little.

Hosting and cost notes

The servers are free and open source, but what they connect to is not. A Supabase or Neon project has its own plan limits, and an agent that runs heavy queries counts against them. Neon's branching is useful here because a branch is a cheap copy for experiments. For Atlas, MongoDB's hosted plugin means no local process to maintain, at the cost of sending requests through MongoDB's service. If you want everything on your own machine, the local stdio servers (Postgres MCP Pro, the MongoDB npx server, the MySQL server) keep traffic between your agent and your database, apart from what the model vendor receives.

If you are choosing a database host as well as a server, our hosting section lists providers, and the Neon and Supabase listings show the install line for each agent.

Large databases

Agents ask innocent questions that become expensive queries. Before you aim one at a table with millions of rows:

• Give the role a statement timeout so one bad query cannot run for an hour.
• Point it at a read replica when you have one.
• Make sure the columns it filters on are indexed. Postgres MCP Pro's index tuning and explain plans help here.
• Tell it in your project instructions to always add a LIMIT and to use COUNT queries for totals rather than fetching rows.
• Watch result size. A server that returns 50,000 rows into the agent's context costs tokens and produces nothing useful.

Which to pick for which job

Security and privacy

• Data goes to your model vendor. Query results enter the agent's context and are sent to whichever model you use. Do not point an agent at tables with personal data unless your vendor terms allow it.
• Hosted servers add a party. Supabase, Neon and Atlas servers run on the vendor's side and see your requests.
• Prompt injection. Rows in your database are untrusted input. A customer could store text that tells your agent to do something. Keep write tools off.
• Credentials. Never commit connection strings. Rotate any key you pasted into a chat.

A staged path from laptop to production

Most teams skip straight to the database that matters. Move through these stages instead, and stop at the stage your risk tolerance allows.

Stage 3 is where most teams should stop. It gives real answers and cannot change data. A write to production through an agent should be a conscious exception with a person watching, not a default.

The permission matrix to write down

Fill in one row per server before you install it.

The table reuses facts from above, and the point is the habit: you should be able to say who the agent connects as, whether it can change data and which machine sees your queries, before the first prompt.

Questions people ask

Which is safest to start with? Postgres MCP Pro in restricted access mode against a local copy, or the MySQL server in its default read-only state. In both cases writes stay off until you turn them on.

Can the agent see my other projects on Supabase? Use project_ref to scope it to one project, and add read_only=true. The server's features filters narrow the tools further.

What if my database is not on the list? SQLite, Redis and other options are covered above. Check each repository's last push date and licence before you rely on it, as we did for the five main servers.

Our take

Treat every one of these as a power tool. Postgres MCP Pro is the strongest general choice because it goes beyond running SQL into health and tuning, and the host-specific servers from Supabase and Neon are the right fit when you already live there, provided you use their scoping options. MongoDB's own server is the clear pick for Mongo.

We did not run these against a shared dataset, so we make no claims about answer quality or speed. The table comes from each repository's README on 31 October 2026, and the open points are marked. If you take one rule from this page, take this one: a development copy and a read-only role, before anything else.

Related pages

• Postgres MCP and Supabase MCP
• Best MCP servers
• Best docs MCP servers
• MCP vs API