How to Build a Postgres MCP Server: Four Layers of Defense for Natural-Language SQL

The session opens with a demo in which GitHub Copilot, working through Opus 4.6, queries Postgres and answers a question using local bee observation data. The agent recognizes the MCP server, decides to use it, and executes SQL on its own.

MCP is an open protocol that defines how AI applications and agents retrieve context from external data sources. It was first proposed by Anthropic, later broadly adopted, and now sits under the Linux Foundation.

Before MCP, every data source typically required a custom integration. Pamela explains that by putting an MCP server in front of each source, developers now get a common access mechanism instead.

The core of the talk is a defensive design that makes it safer to let agents write SQL freely. The first layer is a least-privilege role that allows only SELECT access to a specific schema, blocking INSERT, DROP, and DELETE at the database level.

Even CTE-based evasions using `WITH` clauses can be stopped when the database itself enforces those restrictions. Function calls with side effects can likewise be prevented through the least-privilege role.

On top of that, DDoS-style operations such as `pg_sleep()` or huge `CROSS JOIN`s are handled by giving the tool a timeout and terminating the query. The message is that only by combining multiple layers can teams have confidence in executing generated SQL.

In the closing section, Pamela reviews several ways to build an MCP server on top of Postgres. An exploratory design is flexible because it can answer a wide range of questions, but it also carries the risk of permitting any SQL operation.

A fully typed toolset is safer, but the scope of questions it can answer is narrower. Between those extremes sits the option of read-only SQL queries.

She concludes that because so much can be enforced at the database level, this becomes the safest practical approach. The talk ends by recommending natural-language database interaction for both internal and external users, while emphasizing the need for careful server design.