io.github.sparta2025/postgres-mcp

Database health overview. Args: health_type: Принимается для совместимости со старой схемой инструмента, но пока не используется — отчёт всегда включает все проверки (default: "all"). database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Analyze index usage and find unused/duplicate indexes. Args: schema_name: Schema to analyze (default: "public"). database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Execute a SQL query. Args: sql: SQL statement to execute. database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Get query execution plan. Args: sql: SQL statement to explain. analyze: If true, actually executes the query for real timing data (default: value of EXPLAIN_ANALYZE in .env, normally false). WARNING: true really runs the query, including any INSERT/UPDATE/DELETE it contains — use with care. database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Format/beautify a SQL query for readability. Args: sql: Raw SQL text to format.

List currently running queries and their duration. Args: database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Get general database information: version, size, extensions, server settings. Args: database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Show current database locks and blocking queries. Args: database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Get columns of a table or view. Args: schema_name: Schema containing the object. object_name: Table or view name. database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Show table sizes including indexes and total. Args: schema_name: Schema to analyze (default: "public"). sort_by: Sort order — "total", "table", or "indexes" (default: "total"). database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

Top queries by resource usage (requires pg_stat_statements extension). Args: limit: How many queries to return (optional, defaults to TOP_QUERIES_DEFAULT_LIMIT from .env). sort_by: Принимается для совместимости со старой схемой инструмента, но пока не используется — сортировка всегда по total_exec_time (default: "resources"). database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

List tables/views/sequences in a schema. Args: schema_name: Name of the schema to list objects from. object_type: One of "table", "view", "sequence" (default: "table"). database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

List all schemas in the database. Args: database_url: Database URL (optional, uses DATABASE_URL from .env if omitted).

List all available MCP tools of this server with their descriptions. Returns a JSON array with one entry per tool: name, description and inputSchema (parameters). Does NOT require a database connection — useful for discovering capabilities at runtime. Returns: JSON string: [{"name": ..., "description": ..., "parameters": ...}, ...]

Manage the Data Encryption Certificate (Fernet key) for stored secrets. Args: action: One of: - "status" (default) — list all certs with metadata, no changes. - "generate" — create a new cert, set as active. ttl_days applies. - "rotate" — create a new cert (version+1), set as active, previous one becomes ROTATING (decrypt still works in grace period). - "rekey" — re-encrypt connections.json and llm_connections.json with the new active cert (run after rotation). - "revoke" — mark cert by `kid` as REVOKED (compromised). Decrypt NO longer works for it. - "validate" — same as status, but also tries to decrypt a known secret (currently no-op placeholder, returns status). ttl_days: Certificate lifetime for generate/rotate (default 90). subject: Subject CN for new certs (default "postgres-mcp secrets"). use_passphrase: If true, new cert will be passphrase-protected (raw key encrypted with PBKDF2(passphrase)). Passphrase is read from env CERT_PASSPHRASE. kid: For action="revoke" — which certificate to revoke. reason: Free-text reason recorded in audit log and cert notes. Returns: JSON with details of the operation. For "status" — list of certs. For generate/rotate — new cert metadata. For revoke — boolean. For rekey — statistics {scanned, rekeyed, skipped, errors}. Examples: # See current state action="status" # Create a new cert (auto-active) action="generate" ttl_days=90 # Rotate (new active, old → ROTATING for grace period) action="rotate" # Re-encrypt connections files with new cert action="rekey" # Revoke a compromised cert action="revoke" kid="dec-abc123..." reason="leaked on GitHub"