MCP Servers for Databases: Official Options
MongoDB, Supabase, Neon, Redis and ClickHouse each publish an MCP server for their database. MongoDB's server runs on your computer and has a --readOnly flag. Supabase and Neon run remotely and sign in with OAuth, and both can limit the server to read-only tools. Redis and ClickHouse also run on your computer, and both are safest with a read-only database user. Turn on read-only mode before you point any of them at data you can't afford to lose.
Two ways a database server runs
A database MCP server sits between your AI app and the database. It runs in one of two places, and the place decides who holds the connection.
| Kind | Where it runs | How you connect | Who holds the database login |
|---|---|---|---|
| Local (stdio) | On your computer, started by your AI app | A command in the app's config, plus a connection string or host and password in environment variables | Your computer, through the config file |
| Remote (URL) | On the vendor's servers | A URL such as https://mcp.supabase.com/mcp and an OAuth sign-in | The vendor's account system, after you sign in |
Local servers never leave your machine, but the connection string sits in a config file. Remote servers need nothing installed, but the vendor's service is in the path. For the difference in more detail, read local vs remote MCP servers.
The servers
Each entry below comes from the vendor's own repository or documentation, and each one was checked on 2026-10-20. The sources are listed at the end of the entry.
MongoDB MCP Server
MongoDB publishes the MongoDB MCP Server, which runs locally with npx. It connects to a MongoDB deployment with a connection string set in the MDB_MCP_CONNECTION_STRING environment variable. For MongoDB Atlas, the README recommends the mongodb-atlas plugin for your AI agent, which handles OAuth sign-in for you.
Read-only mode is documented. Start the server with --readOnly (or set MDB_MCP_READ_ONLY) and it allows read, connect and metadata operations only. The README's examples all include --readOnly, and it recommends removing the flag only when you need writes.
Risk: the connection string usually contains a password. Keep it in an environment variable, not in a file you share. Without --readOnly, the server can create, update and delete data.
Source: github.com/mongodb-js/mongodb-mcp-server
Supabase MCP Server
Supabase runs a remote server at https://mcp.supabase.com/mcp. You connect with OAuth, and the sign-in asks you to pick a project. The URL accepts query parameters that the README documents: project_ref limits the server to one project, and read_only=true excludes the tools that change data. The README also shows features=database,docs to limit which feature groups are exposed.
For a local Supabase stack, the Supabase CLI can expose the server at http://localhost:54321/mcp. The README says that version offers a smaller tool set and doesn't support OAuth.
Risk: without read_only=true, the server can change tables and project settings for any project you let it reach. Set project_ref so it can't see your other projects.
Source: github.com/supabase-community/supabase-mcp
Neon MCP Server
Neon runs a remote server at https://mcp.neon.tech/mcp. By default it signs in with OAuth, and the README notes that this path needs no local install or stored API key. If your client can't do OAuth, you can send a Neon API key as an Authorization: Bearer header instead.
Neon documents a read-only mode. It disables the tools that create projects, create branches or run migrations, and leaves listing projects, describing schemas, running queries and viewing performance metrics. The OAuth scopes are read and write, so a client that asks only for read gets read-only access.
Risk: with OAuth, the server works on projects in your personal Neon account. To reach an organization's projects, you name the org_id or project_id in your prompt.
Source: github.com/neondatabase/mcp-server-neon
Redis MCP Server
Redis publishes a local server, redis-mcp-server. You can install it from PyPI with pip install redis-mcp-server, or run it straight from the repository with uvx --from git+https://github.com/redis/mcp-redis.git redis-mcp-server. You point it at a database with a URL such as redis://localhost:6379/0, or with --host, --port and --password flags. Use a rediss:// URL for TLS.
The README doesn't add a read-only switch. It shows how to make one with Redis itself: create a user with ACL SETUSER readonlyuser on >mypassword ~* +@read -@write, then give that user to the server.
Risk: if you use the default user, the server can write and delete keys that user can reach. Create a read-only ACL user for exploration.
Source: github.com/redis/mcp-redis
ClickHouse MCP Server
ClickHouse publishes mcp-clickhouse, a local server that runs with uv. The README's Claude Desktop example starts it with uv run --with mcp-clickhouse --python 3.12 mcp-clickhouse, and it reads the host, port, user and password from CLICKHOUSE_HOST, CLICKHOUSE_PORT, CLICKHOUSE_USER and CLICKHOUSE_PASSWORD.
Read-only is the default. The README says queries run in read-only mode unless you set CLICKHOUSE_ALLOW_WRITE_ACCESS=true. Even then, destructive statements such as DROP need a second opt-in flag.
Risk: the default protects you from accidental writes, but the database user still decides what can be read. Use a user that can only see the tables you need.
Source: github.com/ClickHouse/mcp-clickhouse
Read-only options at a glance
| Server | Read-only option | Default |
|---|---|---|
| MongoDB MCP Server | --readOnly flag | Read and write |
| Supabase MCP Server | read_only=true in the server URL | Read and write |
| Neon MCP Server | Read-only mode, and the read OAuth scope | Read and write |
| Redis MCP Server | A read-only ACL user in Redis | Whatever the connected user can do |
| ClickHouse MCP Server | Read-only by default | Read-only |
The Redis row is different from the others. Redis doesn't have a switch in the server itself, so the protection comes from the database user you connect with.
Postgres and MySQL
The reference Postgres server in the modelcontextprotocol/servers repository is archived. Its listing in the archive describes it as "Read-only database access with schema inspection", but the archive is no longer maintained, so don't rely on it for new setups. MCP server examples explains what the archived reference servers are for.
If your Postgres database is hosted by Neon or Supabase, use the server from that provider above. We didn't find a vendor-published MCP server for a self-hosted Postgres or for MySQL in the sources we checked, so this page doesn't list one.
Protect your data before you connect
Whichever server you pick, set up the database side first:
- Use a database user with the smallest set of permissions you need. Read-only is the safest default for exploration.
- Keep connection strings and passwords in environment variables or a secrets store, not in a config file you share.
- Start with a development or copy database, not production.
- Check the tool list in your AI app before you start. A server that exposes write tools can change data if the model decides to use them.
Sandboxing local servers covers limiting what a local server can reach, and MCP security best practices covers the wider threat model.
Search the MCPBundles directory
If you'd rather search for a database by name, the MCPBundles directory lists MCP servers you can search without signing in. Type the database or service name in the search box, or open a search URL directly, such as www.mcpbundles.com/?q=postgres. Each server has its own listing page at https://www.mcpbundles.com/skills/<slug> with the connection steps for your AI app.
Listings are third-party, so check the publisher on each one before you connect it. Discovering MCP servers explains the filters and labels, and evaluate an MCP server gives a checklist to run before you connect one.
FAQ
Is there an official MCP server for Postgres?
The reference Postgres server in the modelcontextprotocol/servers repository is archived. If your database is hosted by Neon or Supabase, use the MCP server that provider publishes. For a self-hosted Postgres database, check the vendor docs of the tool you use to host it.
How do I make a database MCP server read-only?
It depends on the server. MongoDB uses the --readOnly flag, Supabase uses read_only=true in the server URL, and Neon has a read-only mode and a read OAuth scope. Redis has no switch in the server, so connect it with a read-only Redis user.
Should I run a database MCP server locally or use the remote one?
Use a local server when you want the connection string to stay on your computer. Use a remote server when you want to sign in with OAuth and skip the install. Either way, start with a read-only setup on a copy of your data.
Can an AI app change my database with an MCP server?
Yes, if the server exposes write tools and the database user allows writes. Read-only settings, a read-only database user and a copy of the data each reduce that risk.
- How to find MCP serversWhere to look for servers beyond the vendor lists on this page.
- Evaluate an MCP serverThe checks to run before you connect a server to your data.
- MCP server examplesReference servers and vendor servers, grouped by what they do.
- Sandbox local serversLimit what a local server can reach on your machine.
- MCP security best practicesThe threat model and checklist for users and builders.