MCP Postgres Server: Connect Claude, ChatGPT and Cursor

An MCP Postgres server lets AI tools such as Claude, ChatGPT, Cursor and VS Code inspect your schema, run SQL, apply migrations and read logs through one standard protocol instead of a pasted connection string. StitchDB runs a remote MCP server at https://stitchdb.com/platform/mcp, so there is nothing to install or host: you add the URL to your client, sign in with OAuth or a personal access token, and choose read-only or read-write access per connection. This guide has the setup for each client, the tools you get and the settings that keep it safe.

#How it works

The Model Context Protocol (MCP) is a standard way for an AI client to discover and call tools on a server. StitchDB's server speaks the Streamable HTTP transport and exposes tools like list_tables, describe_table and execute_sql. The client decides when to call them; you approve the calls.

Authentication is one of two kinds:

Create tokens under Access tokens in the dashboard. Each has a name, an access level (Read-only or Read-write), an expiry (7, 30 or 90 days, a year, or never) and a project scope. The token is shown once; only a hash is stored.

Before connecting anything, decide the scope. Add options to the URL to restrict a connection, whatever the token allows:

https://stitchdb.com/platform/mcp?project_ref=abcdefghijklmnop&read_only=true

?project_ref= limits the connection to one project, ?read_only=true hides every tool that changes anything, and ?features= offers only some tool groups (for example database,docs or debugging). See OAuth and URL options.

#Claude Code

One command with a token:

claude mcp add --transport http stitchdb https://stitchdb.com/platform/mcp \
  --header "Authorization: Bearer sdb_pat_..."

Or with OAuth, which avoids storing a token:

claude mcp add --transport http stitchdb https://stitchdb.com/platform/mcp
# in Claude Code: /mcp → stitchdb → Authenticate

--scope user makes the server available in every folder; --scope project shares it through .mcp.json, in which case keep the token in an environment variable and out of the file. Run /mcp to check that stitchdb is connected. Details: Claude Code.

#claude.ai and Claude Desktop

On claude.ai open Settings → Connectors → Add custom connector, name it StitchDB, enter the server URL (optionally with ?project_ref=), click Connect and approve read-only or read-write access to all or chosen projects. On Team and Enterprise plans an owner adds the connector for the organization first, and each member connects their own StitchDB account. Then enable the connector in a chat from the tools menu.

Claude Desktop accepts the same custom connector. If you prefer a token, add the server to claude_desktop_config.json through mcp-remote (needs Node.js):

{
  "mcpServers": {
    "stitchdb": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://stitchdb.com/platform/mcp", "--header", "Authorization:${STITCHDB_AUTH}"],
      "env": { "STITCHDB_AUTH": "Bearer sdb_pat_..." }
    }
  }
}

Restart the app afterwards.

#ChatGPT

In ChatGPT open Settings → Apps & Connectors → Advanced settings and turn on Developer mode. Developer mode is offered on some paid ChatGPT plans, and OpenAI changes which ones, so check OpenAI's help center for your account. Then click Create, name it StitchDB, enter the server URL and choose OAuth. Sign in and approve access.

In a chat, add StitchDB from the + menu. ChatGPT asks you to confirm actions that change data. Outside developer mode, such as in deep research, ChatGPT uses the search and fetch tools, which search the StitchDB docs and your project tables.

#Cursor and VS Code

Cursor reads ~/.cursor/mcp.json (all projects) or .cursor/mcp.json in a repository:

{
  "mcpServers": {
    "stitchdb": {
      "url": "https://stitchdb.com/platform/mcp",
      "headers": { "Authorization": "Bearer sdb_pat_..." }
    }
  }
}

Remove headers to sign in with OAuth instead. Do not commit a file with a token in it.

VS Code uses .vscode/mcp.json, asks for the token once and stores it securely; the tools are then available to Copilot Chat in agent mode:

{
  "inputs": [
    { "type": "promptString", "id": "stitchdb-token", "description": "StitchDB access token", "password": true }
  ],
  "servers": {
    "stitchdb": {
      "type": "http",
      "url": "https://stitchdb.com/platform/mcp",
      "headers": { "Authorization": "Bearer ${input:stitchdb-token}" }
    }
  }
}

Other clients that support Streamable HTTP work with the URL and an Authorization header. Clients that only start local servers can use npx mcp-remote as a bridge. See Cursor and VS Code.

#From your own code: the OpenAI Responses API

The Responses API can call remote MCP tools directly. Keep the token on your server:

import OpenAI from 'openai'

const openai = new OpenAI()
const response = await openai.responses.create({
  model: 'gpt-5',
  tools: [{
    type: 'mcp',
    server_label: 'stitchdb',
    server_url: 'https://stitchdb.com/platform/mcp',
    headers: { Authorization: 'Bearer ' + process.env.STITCHDB_TOKEN },
    require_approval: 'always',
  }],
  input: 'Which tables in my project have Row Level Security disabled?',
})
console.log(response.output_text)

With require_approval: 'always', the response contains mcp_approval_request items you approve in a follow-up request. Use allowed_tools to offer only some tools, for example ['list_tables', 'execute_sql'] with a read-only token. The OpenAI Agents SDK connects with MCPServerStreamableHttp in the same way (OpenAI API).

#What the AI can do

A few that are worth trying first:

• "Which tables have Row Level Security disabled?" uses list_tables and get_advisors.
• "Why are sign-ups failing since this morning?" uses get_logs and query_logs across Auth and the API.
• "Add a due_date column to todos and regenerate my types" uses apply_migration and generate_typescript_types.

execute_sql runs as the project owner role, with a 15-second timeout and at most 1,000 rows. On read-only connections it accepts a single statement inside a READ ONLY transaction. Every tool carries readOnlyHint and destructiveHint annotations, so clients can ask before running anything that changes data. The full list is in MCP tools.

#What the AI cannot see

• The service_role key, the JWT secret and the database password are never returned by any tool. get_anon_key returns only the public key.
• SQL runs only in your own project database, never as a superuser.
• A read-only connection does not even list tools that change things.

#Safe defaults

The server protects secrets; your settings decide how much an assistant can change. Start conservative:

1. Use read-only by default. Most useful work, such as explaining a schema, writing a query or finding a slow endpoint, needs no writes.
2. Scope to one project with ?project_ref=. A development project is better than production.
3. Approve each write. Do not turn on automatic approval for read-write connections.
4. Give tokens an expiry and revoke them when a laptop or a CI job no longer needs them. Each token is limited to about 120 requests in a burst and 2 per second after that.
5. Watch for prompt injection. Rows written by your users can contain instructions. Results are marked as untrusted data, but no model is perfectly safe.

For an agent that writes regularly, use an agent key (sdb_agt_…) as the MCP token instead of a personal token. It gets its own Postgres role, a query firewall, approvals for risky statements and per-session undo, and the server offers it a smaller set of tools: execute_sql through the firewall, list_tables, describe_table, get_approval, get_session, undo_session and check_exposure. That setup is covered in letting AI agents write to your database safely, and the way back in undo what an AI agent changed.

#FAQ

#Do I need to run a local MCP server for Postgres?

No. The server is remote and hosted at https://stitchdb.com/platform/mcp. Only clients that cannot talk to remote servers need the mcp-remote bridge.

#Can the AI see data from all my projects?

Only what the token or OAuth grant allows. Pick chosen projects when creating it, and add ?project_ref= to the URL for one project.

#Can I connect a generic Postgres MCP server with my connection string instead?

You can, but it runs everything as the role in that string, usually the owner, without the read-only switch, the tool annotations or the secret filtering. The hosted server is the safer default.

#How do I disconnect an app?

Revoke the token under Access tokens, or disconnect OAuth apps under Authorized apps on the same page. Revoking takes effect within seconds.

Connect your AI tools to Postgres the safe way: create a free project, then follow the AI tools overview.