Four tools - postgres_query (read-only, bounded in rows and bytes), postgres_execute, postgres_list_tables
and postgres_describe_table - in two modes chosen by the catalog entry, as for minio-mcp.
Internal: the session arrives with x-postgres-scope set to the execution's id, and the server makes a
database and a user <prefix><execution id> if they are not there, closes the database to everyone else
and connects as that user, so the model can do anything inside it and nothing outside. Checked on a real
PostgreSQL, as a catalog user who is not a superuser: it cannot switch role, make users or databases, read
the server's files or reach another execution's database. The password is derived from the name and a
secret shared with the workflow manager, whose storage nodes use the same convention; both test suites
assert the same known name and password.
External: the model opens a session with a host and credentials it is given. It is off until
POSTGRES_MCP_ALLOWED_HOSTS names the hosts it may use.
The client's query_timeout is not used: with a cursor it arms a timer that is never cleared and that,
when it fires, throws outside any handler and takes the server down.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
