Felsen MCP Server Postgres

Servidor MCP em Go para PostgreSQL, com Streamable HTTP, OAuth 2.1, API keys, descoberta de schema, múltiplas conexões, consultas somente leitura e operações DML/DDL explicitamente allowlisted.

Versão atual: 0.5.0.

Quick start

Use a real random token even for local development:

$env:POSTGRES_MCP_CONFIG = "configs/example.yaml"
$env:DATABASE_URL = "postgres://user:password@localhost:5432/postgres?sslmode=disable"
$bytes = [byte[]]::new(32)
$rng = [Security.Cryptography.RandomNumberGenerator]::Create()
try { $rng.GetBytes($bytes) } finally { $rng.Dispose() }
$env:MCP_API_KEY = [BitConverter]::ToString($bytes).Replace("-", "").ToLowerInvariant()
$citationBytes = [byte[]]::new(32)
$rng = [Security.Cryptography.RandomNumberGenerator]::Create()
try { $rng.GetBytes($citationBytes) } finally { $rng.Dispose() }
$env:MCP_CITATION_SIGNING_KEY = [Convert]::ToBase64String($citationBytes)
go run ./cmd/postgres-mcp

The default local endpoint is:

http://127.0.0.1:8080/mcp

Every MCP request must send Authorization: Bearer <MCP_API_KEY>. The reader token remains read-only; the example configuration enables DDL and wildcard DML for the configured schemas so a write-scoped principal can manage tables, indexes, and rows. Set MCP_DDL_ENABLED=false or MCP_DML_ENABLED=false to disable either capability. Do not put tokens directly in YAML or commit real credentials.

server.public_base_url is required because search and fetch return absolute, user-openable citation URLs. The local Docker stack defaults it to http://localhost:8080; for a published deployment, set MCP_PUBLIC_BASE_URL to the public HTTPS origin. The example signs source URLs with MCP_CITATION_SIGNING_KEY for 15 minutes; keep that key secret.

MCP/OpenAI integration

Expose a stable HTTPS MCP endpoint, preserve bearer authentication, and use the official OpenAI MCP integration fields server_url, allowed_tools, and require_approval. A safe read-only configuration starts with:

{
  "type": "mcp",
  "server_label": "postgres",
  "server_url": "https://mcp.example.com/mcp",
  "allowed_tools": ["search", "fetch", "list_schemas", "describe_table"],
  "require_approval": "never"
}

Keep require_approval enabled for execute_dml, execute_ddl, and execute_script. The validate_* tools only inspect SQL and do not change the database. See the OpenAI MCP API documentation and MCP server guidance for plugins.

ChatGPT connector OAuth

The server can expose an embedded OAuth 2.1 provider for the ChatGPT connector. Enable it only with a public HTTPS origin:

MCP_OAUTH_ENABLED=true
MCP_OAUTH_ISSUER=https://mcp.example.com
MCP_OAUTH_RESOURCE=https://mcp.example.com
MCP_OAUTH_SIGNING_KEY=<long-random-secret-at-least-32-characters>
MCP_OAUTH_USERNAME=<connector-login>
MCP_OAUTH_PASSWORD=<long-random-password>
MCP_OAUTH_PRINCIPAL=admin
MCP_OAUTH_CALLBACK_URL=https://chatgpt.com/connector/oauth/<callback-id>
MCP_OAUTH_DEFAULT_SCOPES=read,write,ddl,admin
MCP_OAUTH_BASE_SCOPES=read,write,ddl,admin

Set MCP_ADMIN_API_KEY to create the full-access OAuth principal. Use MCP_OAUTH_PRINCIPAL=reader with read scopes for a read-only connector.

The protected-resource metadata, authorization-server metadata, DCR, authorization, and token endpoints are respectively exposed at:

/.well-known/oauth-protected-resource
/.well-known/oauth-authorization-server
/oauth/register
/oauth/authorize
/oauth/token

In ChatGPT's advanced authentication settings, use Dynamic Client Registration after the registration endpoint is discovered. If using User-Defined OAuth Client, use client ID felsen-chatgpt, leave the client secret empty, select token endpoint auth method none, and use the configured default/base scopes. Set MCP_OAUTH_CALLBACK_URL in .env to the exact callback URL shown by ChatGPT, the

... View full README on GitHub