{ "type": "comparison", "id": "database-mcp-servers", "title": "Database MCP servers compared", "summary": "Google's MCP Toolbox for Databases and the MongoDB, Neon and Supabase MCP servers compared on what they connect to, where they run, how they authenticate, how read-only mode and scoping work, and what guards their write tools.", "author": "Agentica Author", "tags": [ "mcp", "database", "postgres", "mongodb", "read-only", "security", "mcp-servers" ], "published": "2026-10-18", "last_verified": "2026-10-18", "entries": [ "mcp-toolbox-databases", "mongodb-mcp-server", "neon-mcp-server", "supabase-mcp", "postgres-mcp-pro", "neon-agent-skills", "supabase-agent-skills", "mcp-inspector", "mcp-authorization", "gemini-cli", "google-antigravity", "pgvector" ], "links": { "html": "https://indexagentica.com/compare/database-mcp-servers/", "markdown": "https://indexagentica.com/compare/database-mcp-servers.md", "json": "https://indexagentica.com/api/longform/compare/database-mcp-servers.json", "source": "https://github.com/Drudley/indexagentica/blob/main/content-long/compare/database-mcp-servers.md" }, "status": "published", "comparison": { "subjects": [ { "id": "mcp-toolbox-databases", "name": "MCP Toolbox for Databases", "summary": "Google's open-source MCP server for databases: prebuilt tools for MCP clients plus a framework for defining secure custom database tools for agents.", "url": "https://indexagentica.com/entries/mcp-toolbox-databases/", "json": "https://indexagentica.com/api/entries/mcp-toolbox-databases.json" }, { "id": "mongodb-mcp-server", "name": "MongoDB MCP Server", "summary": "Official MCP server for querying and managing MongoDB databases and MongoDB Atlas clusters, with a read-only mode.", "url": "https://indexagentica.com/entries/mongodb-mcp-server/", "json": "https://indexagentica.com/api/entries/mongodb-mcp-server.json" }, { "id": "neon-mcp-server", "name": "Neon MCP Server", "summary": "Lets AI assistants manage Neon serverless Postgres projects and databases through the Neon Management API.", "url": "https://indexagentica.com/entries/neon-mcp-server/", "json": "https://indexagentica.com/api/entries/neon-mcp-server.json" }, { "id": "supabase-mcp", "name": "Supabase MCP Server", "summary": "Connects AI assistants to your Supabase projects over MCP (hosted with OAuth 2.1, or locally via the Supabase CLI).", "url": "https://indexagentica.com/entries/supabase-mcp/", "json": "https://indexagentica.com/api/entries/supabase-mcp.json" } ], "criteria": [ "Connects to", "Where it runs", "Auth", "Read-only mode", "Scoping and tool filters", "Write safeguards", "Intended use", "License" ], "rows": { "mcp-toolbox-databases": { "Connects to": "Many engines: AlloyDB, BigQuery, Cloud SQL (PostgreSQL, MySQL, SQL Server), Spanner, Firestore, PostgreSQL, MySQL, SQL Server, Oracle, MongoDB, Redis, Elasticsearch, ClickHouse, Neo4j, Snowflake and more", "Where it runs": "You run it: binary, container, Homebrew or npx @toolbox-sdk/server; stdio (--stdio) or HTTP at :5000/mcp; deployable to Cloud Run. Google also offers managed Google Cloud MCP servers", "Auth": "Database credentials in tools.yaml or env vars; optional auth services (Google Sign-In, generic OIDC) for authorized tool calls and parameters filled from token claims; OAuth 2.1 resource-server mode for the whole MCP endpoint", "Read-only mode": "Engine-level session lock, write-tool pruning and readOnlyHint for Cloud SQL PostgreSQL and MySQL, AlloyDB and BigQuery (env var or readOnly: true on a source). For other engines, use a SELECT-only database user", "Scoping and tool filters": "Prebuilt toolsets (--prebuilt=postgres/data loads 8 of 29 tools); custom tools.yaml with fixed, parameterized SQL; toolsets served at /mcp/", "Write safeguards": "readOnlyHint annotations for client approval, which the docs say are not a security boundary; optional screening of traffic with Google Cloud Model Armor; the docs recommend database permissions and parameterized tools", "Intended use": "Prebuilt configs are for build-time use with trusted developers; custom tools are the path for production agents", "License": "Apache-2.0" }, "mongodb-mcp-server": { "Connects to": "MongoDB (any cluster by connection string) and the MongoDB Atlas admin API", "Where it runs": "Local: npx mongodb-mcp-server or Docker; stdio by default, HTTP bound to 127.0.0.1. For Atlas, MongoDB recommends its hosted Atlas MCP server over OAuth (the mongodb-atlas plugin)", "Auth": "Connection string; Atlas service-account client ID and secret for Atlas tools; OAuth on the Atlas-managed server", "Read-only mode": "--readOnly (MDB_MCP_READ_ONLY) keeps only read, connect and metadata tools; without Atlas credentials that took the tool count from 27 to 18 in our dry run", "Scoping and tool filters": "--disabledTools by name, operation type or category; result caps of 100 documents and 16 MiB per query by default; optional indexCheck rejects collection scans", "Write safeguards": "Confirmation through MCP elicitation for drop-database, drop-collection, delete-many, drop-index and some Atlas tools, and for $out or $merge pipelines; runs without confirmation if the client lacks elicitation. Results are wrapped with a prompt-injection warning by default", "Intended use": "Runs next to one agent or IDE by default; for shared servers MongoDB points to the Atlas-managed server or building on its library", "License": "Apache-2.0" }, "neon-mcp-server": { "Connects to": "Neon serverless Postgres: SQL plus the Neon Management API (projects, branches, computes, roles, migrations, logs)", "Where it runs": "Hosted only, at https://mcp.neon.tech/mcp (Streamable HTTP; SSE at /sse is deprecated). The repository is the remote server's source", "Auth": "OAuth with read and write scopes, or a Neon API key as a Bearer header; neon init can set it up", "Read-only mode": "readonly=true on the URL, or untick Allow writes on the OAuth consent page; run_sql then runs each query in a READ ONLY transaction and connection strings are withheld (119 tools published unfiltered, 51 read-only)", "Scoping and tool filters": "projectId, category and roleName URL parameters (roleName pins the Postgres login role for SQL); with OAuth they are fixed at consent. /api/list-tools previews the tool set without auth", "Write safeguards": "Branch-based migrations (prepare, then complete); README asks you to review every action before it runs", "Intended use": "Local development and IDE integrations only; Neon does not recommend it in production", "License": "MIT" }, "supabase-mcp": { "Connects to": "Supabase projects: Postgres SQL and migrations, logs and advisors, Edge Functions, branching, storage config, docs search and account tools", "Where it runs": "Hosted at https://mcp.supabase.com/mcp; also built into the Supabase CLI (localhost:54321/mcp) and self-hosted Supabase, each with a subset of tools and no OAuth 2.1; npm package can serve your own endpoint", "Auth": "OAuth 2.1 with dynamic client registration; a scoped personal access token in the Authorization header for CI; or a manual OAuth app", "Read-only mode": "read_only=true runs all queries as a read-only Postgres user and drops mutating tools", "Scoping and tool filters": "project_ref scopes to one project and hides account tools; features= picks tool groups (storage is off by default)", "Write safeguards": "Elicitation forms confirm destructive SQL and paid project or branch creation when the client supports them; SQL results are wrapped with anti-injection instructions", "Intended use": "A developer tool; Supabase says not to give it to your customers or end users", "License": "Apache-2.0" } }, "table": [ { "entry": "mcp-toolbox-databases", "name": "MCP Toolbox for Databases", "url": "https://indexagentica.com/entries/mcp-toolbox-databases/", "values": { "Connects to": "Many engines: AlloyDB, BigQuery, Cloud SQL (PostgreSQL, MySQL, SQL Server), Spanner, Firestore, PostgreSQL, MySQL, SQL Server, Oracle, MongoDB, Redis, Elasticsearch, ClickHouse, Neo4j, Snowflake and more", "Where it runs": "You run it: binary, container, Homebrew or npx @toolbox-sdk/server; stdio (--stdio) or HTTP at :5000/mcp; deployable to Cloud Run. Google also offers managed Google Cloud MCP servers", "Auth": "Database credentials in tools.yaml or env vars; optional auth services (Google Sign-In, generic OIDC) for authorized tool calls and parameters filled from token claims; OAuth 2.1 resource-server mode for the whole MCP endpoint", "Read-only mode": "Engine-level session lock, write-tool pruning and readOnlyHint for Cloud SQL PostgreSQL and MySQL, AlloyDB and BigQuery (env var or readOnly: true on a source). For other engines, use a SELECT-only database user", "Scoping and tool filters": "Prebuilt toolsets (--prebuilt=postgres/data loads 8 of 29 tools); custom tools.yaml with fixed, parameterized SQL; toolsets served at /mcp/", "Write safeguards": "readOnlyHint annotations for client approval, which the docs say are not a security boundary; optional screening of traffic with Google Cloud Model Armor; the docs recommend database permissions and parameterized tools", "Intended use": "Prebuilt configs are for build-time use with trusted developers; custom tools are the path for production agents", "License": "Apache-2.0" } }, { "entry": "mongodb-mcp-server", "name": "MongoDB MCP Server", "url": "https://indexagentica.com/entries/mongodb-mcp-server/", "values": { "Connects to": "MongoDB (any cluster by connection string) and the MongoDB Atlas admin API", "Where it runs": "Local: npx mongodb-mcp-server or Docker; stdio by default, HTTP bound to 127.0.0.1. For Atlas, MongoDB recommends its hosted Atlas MCP server over OAuth (the mongodb-atlas plugin)", "Auth": "Connection string; Atlas service-account client ID and secret for Atlas tools; OAuth on the Atlas-managed server", "Read-only mode": "--readOnly (MDB_MCP_READ_ONLY) keeps only read, connect and metadata tools; without Atlas credentials that took the tool count from 27 to 18 in our dry run", "Scoping and tool filters": "--disabledTools by name, operation type or category; result caps of 100 documents and 16 MiB per query by default; optional indexCheck rejects collection scans", "Write safeguards": "Confirmation through MCP elicitation for drop-database, drop-collection, delete-many, drop-index and some Atlas tools, and for $out or $merge pipelines; runs without confirmation if the client lacks elicitation. Results are wrapped with a prompt-injection warning by default", "Intended use": "Runs next to one agent or IDE by default; for shared servers MongoDB points to the Atlas-managed server or building on its library", "License": "Apache-2.0" } }, { "entry": "neon-mcp-server", "name": "Neon MCP Server", "url": "https://indexagentica.com/entries/neon-mcp-server/", "values": { "Connects to": "Neon serverless Postgres: SQL plus the Neon Management API (projects, branches, computes, roles, migrations, logs)", "Where it runs": "Hosted only, at https://mcp.neon.tech/mcp (Streamable HTTP; SSE at /sse is deprecated). The repository is the remote server's source", "Auth": "OAuth with read and write scopes, or a Neon API key as a Bearer header; neon init can set it up", "Read-only mode": "readonly=true on the URL, or untick Allow writes on the OAuth consent page; run_sql then runs each query in a READ ONLY transaction and connection strings are withheld (119 tools published unfiltered, 51 read-only)", "Scoping and tool filters": "projectId, category and roleName URL parameters (roleName pins the Postgres login role for SQL); with OAuth they are fixed at consent. /api/list-tools previews the tool set without auth", "Write safeguards": "Branch-based migrations (prepare, then complete); README asks you to review every action before it runs", "Intended use": "Local development and IDE integrations only; Neon does not recommend it in production", "License": "MIT" } }, { "entry": "supabase-mcp", "name": "Supabase MCP Server", "url": "https://indexagentica.com/entries/supabase-mcp/", "values": { "Connects to": "Supabase projects: Postgres SQL and migrations, logs and advisors, Edge Functions, branching, storage config, docs search and account tools", "Where it runs": "Hosted at https://mcp.supabase.com/mcp; also built into the Supabase CLI (localhost:54321/mcp) and self-hosted Supabase, each with a subset of tools and no OAuth 2.1; npm package can serve your own endpoint", "Auth": "OAuth 2.1 with dynamic client registration; a scoped personal access token in the Authorization header for CI; or a manual OAuth app", "Read-only mode": "read_only=true runs all queries as a read-only Postgres user and drops mutating tools", "Scoping and tool filters": "project_ref scopes to one project and hides account tools; features= picks tool groups (storage is off by default)", "Write safeguards": "Elicitation forms confirm destructive SQL and paid project or branch creation when the client supports them; SQL results are wrapped with anti-injection instructions", "Intended use": "A developer tool; Supabase says not to give it to your customers or end users", "License": "Apache-2.0" } } ], "verdict": "For a coding agent on a Neon or Supabase project, the vendor's hosted server with read-only mode and one-project scoping is the least setup. For MongoDB, run the MongoDB server with --readOnly. For other engines, or for agents that run unattended in production, use MCP Toolbox with custom parameterized tools and a least-privilege database user, because a read-only flag on raw SQL is only as strong as what the database itself enforces." }, "entries_detail": [ { "id": "mcp-toolbox-databases", "name": "MCP Toolbox for Databases", "summary": "Google's open-source MCP server for databases: prebuilt tools for MCP clients plus a framework for defining secure custom database tools for agents.", "url": "https://indexagentica.com/entries/mcp-toolbox-databases/", "json": "https://indexagentica.com/api/entries/mcp-toolbox-databases.json" }, { "id": "mongodb-mcp-server", "name": "MongoDB MCP Server", "summary": "Official MCP server for querying and managing MongoDB databases and MongoDB Atlas clusters, with a read-only mode.", "url": "https://indexagentica.com/entries/mongodb-mcp-server/", "json": "https://indexagentica.com/api/entries/mongodb-mcp-server.json" }, { "id": "neon-mcp-server", "name": "Neon MCP Server", "summary": "Lets AI assistants manage Neon serverless Postgres projects and databases through the Neon Management API.", "url": "https://indexagentica.com/entries/neon-mcp-server/", "json": "https://indexagentica.com/api/entries/neon-mcp-server.json" }, { "id": "supabase-mcp", "name": "Supabase MCP Server", "summary": "Connects AI assistants to your Supabase projects over MCP (hosted with OAuth 2.1, or locally via the Supabase CLI).", "url": "https://indexagentica.com/entries/supabase-mcp/", "json": "https://indexagentica.com/api/entries/supabase-mcp.json" }, { "id": "postgres-mcp-pro", "name": "Postgres MCP Pro", "summary": "Open-source Postgres MCP server with database health checks, index tuning, EXPLAIN plans with hypothetical indexes, schema intelligence and safe, configurable SQL execution.", "url": "https://indexagentica.com/entries/postgres-mcp-pro/", "json": "https://indexagentica.com/api/entries/postgres-mcp-pro.json" }, { "id": "neon-agent-skills", "name": "Neon Agent Skills", "summary": "Agent Skills for Neon serverless Postgres.", "url": "https://indexagentica.com/entries/neon-agent-skills/", "json": "https://indexagentica.com/api/entries/neon-agent-skills.json" }, { "id": "supabase-agent-skills", "name": "Supabase Agent Skills", "summary": "Agent Skills that help AI agents build with Supabase, including Postgres best practices.", "url": "https://indexagentica.com/entries/supabase-agent-skills/", "json": "https://indexagentica.com/api/entries/supabase-agent-skills.json" }, { "id": "mcp-inspector", "name": "MCP Inspector", "summary": "Official interactive developer tool for testing and debugging MCP servers in the browser, on the command line or in the terminal.", "url": "https://indexagentica.com/entries/mcp-inspector/", "json": "https://indexagentica.com/api/entries/mcp-inspector.json" }, { "id": "mcp-authorization", "name": "MCP Authorization (OAuth 2.1 for MCP)", "summary": "The MCP specification's transport-level authorization flow for HTTP-based MCP servers, based on a subset of OAuth 2.1 and related RFCs.", "url": "https://indexagentica.com/entries/mcp-authorization/", "json": "https://indexagentica.com/api/entries/mcp-authorization.json" }, { "id": "gemini-cli", "name": "Gemini CLI", "summary": "Open-source AI agent from Google that brings Gemini models directly into your terminal.", "url": "https://indexagentica.com/entries/gemini-cli/", "json": "https://indexagentica.com/api/entries/gemini-cli.json" }, { "id": "google-antigravity", "name": "Google Antigravity", "summary": "Google's agentic coding platform (app, IDE, CLI, IDE extensions and Python SDK) for orchestrating autonomous subagents, scheduled tasks and code verification.", "url": "https://indexagentica.com/entries/google-antigravity/", "json": "https://indexagentica.com/api/entries/google-antigravity.json" }, { "id": "pgvector", "name": "pgvector", "summary": "Open-source vector similarity search extension for Postgres.", "url": "https://indexagentica.com/entries/pgvector/", "json": "https://indexagentica.com/api/entries/pgvector.json" } ], "related": [ { "type": "guide", "id": "connect-an-agent-to-a-remote-mcp-server", "title": "Connect an agent to a remote MCP server", "url": "https://indexagentica.com/guides/connect-an-agent-to-a-remote-mcp-server/", "json": "https://indexagentica.com/api/longform/guides/connect-an-agent-to-a-remote-mcp-server.json" }, { "type": "guide", "id": "agent-auth-and-delegated-access", "title": "Agent auth and delegated access, step by step", "url": "https://indexagentica.com/guides/agent-auth-and-delegated-access/", "json": "https://indexagentica.com/api/longform/guides/agent-auth-and-delegated-access.json" }, { "type": "comparison", "id": "agent-identity-and-mcp-auth", "title": "Agent identity and MCP authorization platforms", "url": "https://indexagentica.com/compare/agent-identity-and-mcp-auth/", "json": "https://indexagentica.com/api/longform/compare/agent-identity-and-mcp-auth.json" }, { "type": "skill", "id": "pick-an-mcp-server", "title": "Pick an MCP server", "url": "https://indexagentica.com/skills/pick-an-mcp-server/", "json": "https://indexagentica.com/api/longform/skills/pick-an-mcp-server.json" }, { "type": "comparison", "id": "vector-databases-for-agents", "title": "Vector databases for agents compared", "url": "https://indexagentica.com/compare/vector-databases-for-agents/", "json": "https://indexagentica.com/api/longform/compare/vector-databases-for-agents.json" }, { "type": "guide", "id": "add-mcp-servers-to-claude-code", "title": "Add MCP servers to Claude Code", "url": "https://indexagentica.com/guides/add-mcp-servers-to-claude-code/", "json": "https://indexagentica.com/api/longform/guides/add-mcp-servers-to-claude-code.json" }, { "type": "stack", "id": "data-analysis-agent", "title": "Data analysis agent stack", "url": "https://indexagentica.com/stacks/data-analysis-agent/", "json": "https://indexagentica.com/api/longform/stacks/data-analysis-agent.json" }, { "type": "comparison", "id": "devops-mcp-servers", "title": "DevOps and observability MCP servers compared", "url": "https://indexagentica.com/compare/devops-mcp-servers/", "json": "https://indexagentica.com/api/longform/compare/devops-mcp-servers.json" } ], "sources": [ { "title": "MCP Toolbox for Databases README", "url": "https://github.com/googleapis/mcp-toolbox", "accessed": "2026-10-18" }, { "title": "MCP Toolbox, Introduction", "url": "https://mcp-toolbox.dev/documentation/introduction/", "accessed": "2026-10-18" }, { "title": "MCP Toolbox, Prebuilt configs", "url": "https://mcp-toolbox.dev/documentation/configuration/prebuilt-configs/", "accessed": "2026-10-18" }, { "title": "MCP Toolbox, Read-only tools", "url": "https://mcp-toolbox.dev/documentation/configuration/security/read-only/", "accessed": "2026-10-18" }, { "title": "MCP Toolbox, Authentication", "url": "https://mcp-toolbox.dev/documentation/configuration/authentication/", "accessed": "2026-10-18" }, { "title": "MCP Toolbox, Security", "url": "https://mcp-toolbox.dev/documentation/configuration/security/", "accessed": "2026-10-18" }, { "title": "MCP Toolbox, Toolbox with MCP Authorization", "url": "https://mcp-toolbox.dev/documentation/configuration/toolbox_mcp_auth/", "accessed": "2026-10-18" }, { "title": "MongoDB MCP Server README", "url": "https://github.com/mongodb-js/mongodb-mcp-server", "accessed": "2026-10-18" }, { "title": "MongoDB MCP Server docs", "url": "https://www.mongodb.com/docs/mcp-server/", "accessed": "2026-10-18" }, { "title": "Neon MCP Server README", "url": "https://github.com/neondatabase/mcp-server-neon", "accessed": "2026-10-18" }, { "title": "Neon MCP Server docs", "url": "https://neon.com/docs/ai/neon-mcp-server", "accessed": "2026-10-18" }, { "title": "Neon MCP tool list (read-only)", "url": "https://mcp.neon.tech/api/list-tools?readonly=true", "accessed": "2026-10-18" }, { "title": "Supabase MCP Server README", "url": "https://github.com/supabase/mcp", "accessed": "2026-10-18" }, { "title": "Supabase MCP Server docs", "url": "https://supabase.com/docs/guides/ai-tools/mcp", "accessed": "2026-10-21" }, { "title": "Postgres MCP Pro README", "url": "https://github.com/crystaldba/postgres-mcp", "accessed": "2026-10-18" }, { "title": "MCP specification, Elicitation", "url": "https://modelcontextprotocol.io/specification/draft/client/elicitation", "accessed": "2026-10-18" } ], "front_matter": { "id": "database-mcp-servers", "type": "comparison", "title": "Database MCP servers compared", "summary": "Google's MCP Toolbox for Databases and the MongoDB, Neon and Supabase MCP servers compared on what they connect to, where they run, how they authenticate, how read-only mode and scoping work, and what guards their write tools.", "description": "A primary-source comparison of four MCP servers that give an agent a database: MCP Toolbox for Databases (many engines, self-hosted, custom tools), the MongoDB MCP Server (MongoDB and Atlas), the Neon MCP Server (hosted, Neon Postgres) and the Supabase MCP Server (hosted, Supabase projects). It covers transports, auth, read-only modes and what they actually enforce, project and tool scoping, confirmation prompts, and each vendor's stated intended use. Tool lists were checked by running Toolbox 1.14.0 against a local Postgres and MongoDB MCP Server 3.1.0 in dry-run mode, and by querying Neon's public tool-list endpoint, on 2026-10-18.", "author": "Agentica Author", "tags": [ "mcp", "database", "postgres", "mongodb", "read-only", "security", "mcp-servers" ], "entries": [ "mcp-toolbox-databases", "mongodb-mcp-server", "neon-mcp-server", "supabase-mcp", "postgres-mcp-pro", "neon-agent-skills", "supabase-agent-skills", "mcp-inspector", "mcp-authorization", "gemini-cli", "google-antigravity", "pgvector" ], "related": [ "connect-an-agent-to-a-remote-mcp-server", "agent-auth-and-delegated-access", "agent-identity-and-mcp-auth", "pick-an-mcp-server", "vector-databases-for-agents", "add-mcp-servers-to-claude-code", "data-analysis-agent", "devops-mcp-servers" ], "subjects": [ "mcp-toolbox-databases", "mongodb-mcp-server", "neon-mcp-server", "supabase-mcp" ], "criteria": [ "Connects to", "Where it runs", "Auth", "Read-only mode", "Scoping and tool filters", "Write safeguards", "Intended use", "License" ], "rows": { "mcp-toolbox-databases": { "Connects to": "Many engines: AlloyDB, BigQuery, Cloud SQL (PostgreSQL, MySQL, SQL Server), Spanner, Firestore, PostgreSQL, MySQL, SQL Server, Oracle, MongoDB, Redis, Elasticsearch, ClickHouse, Neo4j, Snowflake and more", "Where it runs": "You run it: binary, container, Homebrew or npx @toolbox-sdk/server; stdio (--stdio) or HTTP at :5000/mcp; deployable to Cloud Run. Google also offers managed Google Cloud MCP servers", "Auth": "Database credentials in tools.yaml or env vars; optional auth services (Google Sign-In, generic OIDC) for authorized tool calls and parameters filled from token claims; OAuth 2.1 resource-server mode for the whole MCP endpoint", "Read-only mode": "Engine-level session lock, write-tool pruning and readOnlyHint for Cloud SQL PostgreSQL and MySQL, AlloyDB and BigQuery (env var or readOnly: true on a source). For other engines, use a SELECT-only database user", "Scoping and tool filters": "Prebuilt toolsets (--prebuilt=postgres/data loads 8 of 29 tools); custom tools.yaml with fixed, parameterized SQL; toolsets served at /mcp/", "Write safeguards": "readOnlyHint annotations for client approval, which the docs say are not a security boundary; optional screening of traffic with Google Cloud Model Armor; the docs recommend database permissions and parameterized tools", "Intended use": "Prebuilt configs are for build-time use with trusted developers; custom tools are the path for production agents", "License": "Apache-2.0" }, "mongodb-mcp-server": { "Connects to": "MongoDB (any cluster by connection string) and the MongoDB Atlas admin API", "Where it runs": "Local: npx mongodb-mcp-server or Docker; stdio by default, HTTP bound to 127.0.0.1. For Atlas, MongoDB recommends its hosted Atlas MCP server over OAuth (the mongodb-atlas plugin)", "Auth": "Connection string; Atlas service-account client ID and secret for Atlas tools; OAuth on the Atlas-managed server", "Read-only mode": "--readOnly (MDB_MCP_READ_ONLY) keeps only read, connect and metadata tools; without Atlas credentials that took the tool count from 27 to 18 in our dry run", "Scoping and tool filters": "--disabledTools by name, operation type or category; result caps of 100 documents and 16 MiB per query by default; optional indexCheck rejects collection scans", "Write safeguards": "Confirmation through MCP elicitation for drop-database, drop-collection, delete-many, drop-index and some Atlas tools, and for $out or $merge pipelines; runs without confirmation if the client lacks elicitation. Results are wrapped with a prompt-injection warning by default", "Intended use": "Runs next to one agent or IDE by default; for shared servers MongoDB points to the Atlas-managed server or building on its library", "License": "Apache-2.0" }, "neon-mcp-server": { "Connects to": "Neon serverless Postgres: SQL plus the Neon Management API (projects, branches, computes, roles, migrations, logs)", "Where it runs": "Hosted only, at https://mcp.neon.tech/mcp (Streamable HTTP; SSE at /sse is deprecated). The repository is the remote server's source", "Auth": "OAuth with read and write scopes, or a Neon API key as a Bearer header; neon init can set it up", "Read-only mode": "readonly=true on the URL, or untick Allow writes on the OAuth consent page; run_sql then runs each query in a READ ONLY transaction and connection strings are withheld (119 tools published unfiltered, 51 read-only)", "Scoping and tool filters": "projectId, category and roleName URL parameters (roleName pins the Postgres login role for SQL); with OAuth they are fixed at consent. /api/list-tools previews the tool set without auth", "Write safeguards": "Branch-based migrations (prepare, then complete); README asks you to review every action before it runs", "Intended use": "Local development and IDE integrations only; Neon does not recommend it in production", "License": "MIT" }, "supabase-mcp": { "Connects to": "Supabase projects: Postgres SQL and migrations, logs and advisors, Edge Functions, branching, storage config, docs search and account tools", "Where it runs": "Hosted at https://mcp.supabase.com/mcp; also built into the Supabase CLI (localhost:54321/mcp) and self-hosted Supabase, each with a subset of tools and no OAuth 2.1; npm package can serve your own endpoint", "Auth": "OAuth 2.1 with dynamic client registration; a scoped personal access token in the Authorization header for CI; or a manual OAuth app", "Read-only mode": "read_only=true runs all queries as a read-only Postgres user and drops mutating tools", "Scoping and tool filters": "project_ref scopes to one project and hides account tools; features= picks tool groups (storage is off by default)", "Write safeguards": "Elicitation forms confirm destructive SQL and paid project or branch creation when the client supports them; SQL results are wrapped with anti-injection instructions", "Intended use": "A developer tool; Supabase says not to give it to your customers or end users", "License": "Apache-2.0" } }, "verdict": "For a coding agent on a Neon or Supabase project, the vendor's hosted server with read-only mode and one-project scoping is the least setup. For MongoDB, run the MongoDB server with --readOnly. For other engines, or for agents that run unattended in production, use MCP Toolbox with custom parameterized tools and a least-privilege database user, because a read-only flag on raw SQL is only as strong as what the database itself enforces.", "sources": [ { "title": "MCP Toolbox for Databases README", "url": "https://github.com/googleapis/mcp-toolbox", "accessed": "2026-10-18" }, { "title": "MCP Toolbox, Introduction", "url": "https://mcp-toolbox.dev/documentation/introduction/", "accessed": "2026-10-18" }, { "title": "MCP Toolbox, Prebuilt configs", "url": "https://mcp-toolbox.dev/documentation/configuration/prebuilt-configs/", "accessed": "2026-10-18" }, { "title": "MCP Toolbox, Read-only tools", "url": "https://mcp-toolbox.dev/documentation/configuration/security/read-only/", "accessed": "2026-10-18" }, { "title": "MCP Toolbox, Authentication", "url": "https://mcp-toolbox.dev/documentation/configuration/authentication/", "accessed": "2026-10-18" }, { "title": "MCP Toolbox, Security", "url": "https://mcp-toolbox.dev/documentation/configuration/security/", "accessed": "2026-10-18" }, { "title": "MCP Toolbox, Toolbox with MCP Authorization", "url": "https://mcp-toolbox.dev/documentation/configuration/toolbox_mcp_auth/", "accessed": "2026-10-18" }, { "title": "MongoDB MCP Server README", "url": "https://github.com/mongodb-js/mongodb-mcp-server", "accessed": "2026-10-18" }, { "title": "MongoDB MCP Server docs", "url": "https://www.mongodb.com/docs/mcp-server/", "accessed": "2026-10-18" }, { "title": "Neon MCP Server README", "url": "https://github.com/neondatabase/mcp-server-neon", "accessed": "2026-10-18" }, { "title": "Neon MCP Server docs", "url": "https://neon.com/docs/ai/neon-mcp-server", "accessed": "2026-10-18" }, { "title": "Neon MCP tool list (read-only)", "url": "https://mcp.neon.tech/api/list-tools?readonly=true", "accessed": "2026-10-18" }, { "title": "Supabase MCP Server README", "url": "https://github.com/supabase/mcp", "accessed": "2026-10-18" }, { "title": "Supabase MCP Server docs", "url": "https://supabase.com/docs/guides/ai-tools/mcp", "accessed": "2026-10-21" }, { "title": "Postgres MCP Pro README", "url": "https://github.com/crystaldba/postgres-mcp", "accessed": "2026-10-18" }, { "title": "MCP specification, Elicitation", "url": "https://modelcontextprotocol.io/specification/draft/client/elicitation", "accessed": "2026-10-18" } ], "last_verified": "2026-10-18", "published": "2026-10-18" }, "markdown": "\n## What this covers\n\nA database MCP server lets an agent look at schemas, run queries and, if you allow it, change data. The four here are the ones most agents meet: Google's engine-agnostic [MCP Toolbox for Databases](https://indexagentica.com/entries/mcp-toolbox-databases/), and the vendor servers for [MongoDB](https://indexagentica.com/entries/mongodb-mcp-server/), [Neon](https://indexagentica.com/entries/neon-mcp-server/) and [Supabase](https://indexagentica.com/entries/supabase-mcp/).\n\nWhat was checked by running things on 2026-10-18:\n\n- **MCP Toolbox 1.14.0** with `--prebuilt=postgres` against a local PostgreSQL, listed and called through the [MCP Inspector](https://indexagentica.com/entries/mcp-inspector/) CLI. It published 29 tools, and `--prebuilt=postgres/data` cut that to 8. Connected as a role with only `SELECT` on a table, `execute_sql` returned rows for a `SELECT` and `permission denied for table notes (SQLSTATE 42501)` for an `INSERT`.\n- **MongoDB MCP Server 3.1.0** with `--dryRun`, which prints the configuration and enabled tools without starting the server. With no Atlas credentials it enabled 27 tools; adding `--readOnly` left 18.\n- **Neon's public endpoint** `https://mcp.neon.tech/api/list-tools`, which needs no auth. It listed 119 tools unfiltered, 51 with `readonly=true`, and 7 with `readonly=true&category=querying`.\n- **Supabase** was not run, because its hosted server needs an account. Everything in its row comes from the docs.\n\n## What \"read-only\" actually enforces\n\nThe flag has the same name everywhere but works differently in each server:\n\n- **Enforced by the database.** Supabase runs queries \"as a read-only Postgres user\". Neon runs each `run_sql` call in a `READ ONLY` transaction and removes `run_sql_transaction`, because a `COMMIT` inside a multi-statement call could end the read-only transaction. Toolbox locks the session in the connection string for Cloud SQL and AlloyDB, uses a read-only connection for Cloud SQL MySQL, and uses BigQuery dry runs. Its docs explain why this matters: a check that a query starts with `SELECT` misses `WITH d AS (DELETE ...) SELECT ...` and functions that write.\n- **Enforced by hiding tools.** MongoDB's `--readOnly` keeps only tools whose operation type is read, connect or metadata. Every server above also prunes its write tools, which saves context tokens.\n- **Not covered.** Toolbox's read-only matrix lists only the Google Cloud engines and BigQuery. For self-managed Postgres, MySQL and the rest, its prebuilt-config docs tell you to connect as a dedicated user with only the privileges the agent needs. That is what our `SELECT`-only test did. Neon's `roleName` URL parameter does the same for Neon: SQL runs as the Postgres role you pin. It does not limit the Management API tools.\n\nWhichever server you use, the strongest control is the database role the server connects as.\n\n## Confirmation prompts depend on the client\n\nMongoDB and Supabase can pause a risky tool call and ask the human through MCP [elicitation](https://modelcontextprotocol.io/specification/draft/client/elicitation). MongoDB asks before `drop-database`, `drop-collection`, `delete-many`, `drop-index`, some Atlas tools, and aggregation pipelines with `$out` or `$merge`. Supabase asks before destructive SQL and before creating paid projects or branches. Both docs add caveats. If the client does not support elicitation, MongoDB runs the tool without asking, and Supabase calls its prompts \"a guardrail, not a guarantee\", since some clients can answer them automatically. Supabase's `skip_elicitations` URL parameter turns specific prompts off. Treat these prompts as a convenience on top of read-only mode and scoping, not as a replacement.\n\n## Scoping an agent to one project\n\n- **Neon:** `?readonly=true&projectId=&category=querying&category=schema&roleName=app_reader` on the MCP URL. With OAuth, the grant is fixed when you authorize and changing the URL later does not widen it. With an API key, the URL is read on every request. Neon's README warns that anyone who can edit that URL can remove the limits, so keep it in configuration the agent cannot change.\n- **Supabase:** `?project_ref=&read_only=true&features=database,docs`. Project scoping hides the account-level tools.\n- **MongoDB:** connect with a connection string for one database user, and add `--readOnly` and `--disabledTools`. Atlas tools only appear when you supply service-account credentials, and MongoDB asks you to give that account the minimum permissions.\n- **Toolbox:** load one toolset (`--prebuilt=postgres/data`, or `/mcp/` over HTTP), or write `tools.yaml` tools that each run one fixed, parameterized statement. Toolbox can also require a signed-in user per tool and fill parameters such as a user id from the token's claims, so the model never supplies them.\n\n## Untrusted data in results\n\nRows can contain text written by your users, and a prompt-injection payload in a support ticket is Supabase's own example of the risk. Supabase wraps SQL results with instructions telling the model not to follow commands in the data. MongoDB wraps results in delimiters with a warning unless you set `disableUntrustedDataWarning`. Neither is foolproof, so combine them with read-only access and human review of writes. [Agent auth and delegated access](https://indexagentica.com/guides/agent-auth-and-delegated-access/) covers giving an agent narrower credentials than your own.\n\n## Other things to know\n\n- **Telemetry:** the MongoDB server's configuration has telemetry `enabled` by default. Turn it off with `MDB_MCP_TELEMETRY=disabled` or `DO_NOT_TRACK=1`.\n- **Skills:** Neon and Supabase also publish agent skills ([Neon](https://indexagentica.com/entries/neon-agent-skills/), [Supabase](https://indexagentica.com/entries/supabase-agent-skills/)), and `neon init` installs Neon's skills next to the MCP server. Toolbox can turn a toolset into an Agent Skill with `toolbox skills-generate`.\n- **Clients:** Toolbox prebuilt configs can be installed with one click from the [Google Antigravity](https://indexagentica.com/entries/google-antigravity/) MCP Store and as [Gemini CLI](https://indexagentica.com/entries/gemini-cli/) extensions. All four work with any MCP client. See [Add MCP servers to Claude Code](https://indexagentica.com/guides/add-mcp-servers-to-claude-code/) for one example.\n- **Plain Postgres, one server:** [Postgres MCP Pro](https://indexagentica.com/entries/postgres-mcp-pro/) (MIT, not compared above) is a single-database alternative to Toolbox for self-managed Postgres. Its README describes an `--access-mode=restricted` setting that limits the server to read-only transactions and caps execution time, plus index tuning and health-check tools.\n- **Vectors:** if the agent needs similarity search too, the [vector database comparison](https://indexagentica.com/compare/vector-databases-for-agents/) covers [pgvector](https://indexagentica.com/entries/pgvector/) on the Postgres-based options, and MongoDB's server can create Atlas Local deployments with automatic embedding through a Voyage AI key.\n", "raw": "---\nid: database-mcp-servers\ntype: comparison\ntitle: Database MCP servers compared\nsummary: \"Google's MCP Toolbox for Databases and the MongoDB, Neon and Supabase MCP servers compared on what they connect to, where they run, how they authenticate, how read-only mode and scoping work, and what guards their write tools.\"\ndescription: \"A primary-source comparison of four MCP servers that give an agent a database: MCP Toolbox for Databases (many engines, self-hosted, custom tools), the MongoDB MCP Server (MongoDB and Atlas), the Neon MCP Server (hosted, Neon Postgres) and the Supabase MCP Server (hosted, Supabase projects). It covers transports, auth, read-only modes and what they actually enforce, project and tool scoping, confirmation prompts, and each vendor's stated intended use. Tool lists were checked by running Toolbox 1.14.0 against a local Postgres and MongoDB MCP Server 3.1.0 in dry-run mode, and by querying Neon's public tool-list endpoint, on 2026-10-18.\"\nauthor: Agentica Author\ntags: [mcp, database, postgres, mongodb, read-only, security, mcp-servers]\nentries: [mcp-toolbox-databases, mongodb-mcp-server, neon-mcp-server, supabase-mcp, postgres-mcp-pro, neon-agent-skills, supabase-agent-skills, mcp-inspector, mcp-authorization, gemini-cli, google-antigravity, pgvector]\nrelated: [connect-an-agent-to-a-remote-mcp-server, agent-auth-and-delegated-access, agent-identity-and-mcp-auth, pick-an-mcp-server, vector-databases-for-agents, add-mcp-servers-to-claude-code, data-analysis-agent, devops-mcp-servers]\nsubjects: [mcp-toolbox-databases, mongodb-mcp-server, neon-mcp-server, supabase-mcp]\ncriteria:\n - Connects to\n - Where it runs\n - Auth\n - Read-only mode\n - Scoping and tool filters\n - Write safeguards\n - Intended use\n - License\nrows:\n mcp-toolbox-databases:\n Connects to: \"Many engines: AlloyDB, BigQuery, Cloud SQL (PostgreSQL, MySQL, SQL Server), Spanner, Firestore, PostgreSQL, MySQL, SQL Server, Oracle, MongoDB, Redis, Elasticsearch, ClickHouse, Neo4j, Snowflake and more\"\n Where it runs: \"You run it: binary, container, Homebrew or npx @toolbox-sdk/server; stdio (--stdio) or HTTP at :5000/mcp; deployable to Cloud Run. Google also offers managed Google Cloud MCP servers\"\n Auth: \"Database credentials in tools.yaml or env vars; optional auth services (Google Sign-In, generic OIDC) for authorized tool calls and parameters filled from token claims; OAuth 2.1 resource-server mode for the whole MCP endpoint\"\n Read-only mode: \"Engine-level session lock, write-tool pruning and readOnlyHint for Cloud SQL PostgreSQL and MySQL, AlloyDB and BigQuery (env var or readOnly: true on a source). For other engines, use a SELECT-only database user\"\n Scoping and tool filters: \"Prebuilt toolsets (--prebuilt=postgres/data loads 8 of 29 tools); custom tools.yaml with fixed, parameterized SQL; toolsets served at /mcp/\"\n Write safeguards: \"readOnlyHint annotations for client approval, which the docs say are not a security boundary; optional screening of traffic with Google Cloud Model Armor; the docs recommend database permissions and parameterized tools\"\n Intended use: \"Prebuilt configs are for build-time use with trusted developers; custom tools are the path for production agents\"\n License: \"Apache-2.0\"\n mongodb-mcp-server:\n Connects to: \"MongoDB (any cluster by connection string) and the MongoDB Atlas admin API\"\n Where it runs: \"Local: npx mongodb-mcp-server or Docker; stdio by default, HTTP bound to 127.0.0.1. For Atlas, MongoDB recommends its hosted Atlas MCP server over OAuth (the mongodb-atlas plugin)\"\n Auth: \"Connection string; Atlas service-account client ID and secret for Atlas tools; OAuth on the Atlas-managed server\"\n Read-only mode: \"--readOnly (MDB_MCP_READ_ONLY) keeps only read, connect and metadata tools; without Atlas credentials that took the tool count from 27 to 18 in our dry run\"\n Scoping and tool filters: \"--disabledTools by name, operation type or category; result caps of 100 documents and 16 MiB per query by default; optional indexCheck rejects collection scans\"\n Write safeguards: \"Confirmation through MCP elicitation for drop-database, drop-collection, delete-many, drop-index and some Atlas tools, and for $out or $merge pipelines; runs without confirmation if the client lacks elicitation. Results are wrapped with a prompt-injection warning by default\"\n Intended use: \"Runs next to one agent or IDE by default; for shared servers MongoDB points to the Atlas-managed server or building on its library\"\n License: \"Apache-2.0\"\n neon-mcp-server:\n Connects to: \"Neon serverless Postgres: SQL plus the Neon Management API (projects, branches, computes, roles, migrations, logs)\"\n Where it runs: \"Hosted only, at https://mcp.neon.tech/mcp (Streamable HTTP; SSE at /sse is deprecated). The repository is the remote server's source\"\n Auth: \"OAuth with read and write scopes, or a Neon API key as a Bearer header; neon init can set it up\"\n Read-only mode: \"readonly=true on the URL, or untick Allow writes on the OAuth consent page; run_sql then runs each query in a READ ONLY transaction and connection strings are withheld (119 tools published unfiltered, 51 read-only)\"\n Scoping and tool filters: \"projectId, category and roleName URL parameters (roleName pins the Postgres login role for SQL); with OAuth they are fixed at consent. /api/list-tools previews the tool set without auth\"\n Write safeguards: \"Branch-based migrations (prepare, then complete); README asks you to review every action before it runs\"\n Intended use: \"Local development and IDE integrations only; Neon does not recommend it in production\"\n License: \"MIT\"\n supabase-mcp:\n Connects to: \"Supabase projects: Postgres SQL and migrations, logs and advisors, Edge Functions, branching, storage config, docs search and account tools\"\n Where it runs: \"Hosted at https://mcp.supabase.com/mcp; also built into the Supabase CLI (localhost:54321/mcp) and self-hosted Supabase, each with a subset of tools and no OAuth 2.1; npm package can serve your own endpoint\"\n Auth: \"OAuth 2.1 with dynamic client registration; a scoped personal access token in the Authorization header for CI; or a manual OAuth app\"\n Read-only mode: \"read_only=true runs all queries as a read-only Postgres user and drops mutating tools\"\n Scoping and tool filters: \"project_ref scopes to one project and hides account tools; features= picks tool groups (storage is off by default)\"\n Write safeguards: \"Elicitation forms confirm destructive SQL and paid project or branch creation when the client supports them; SQL results are wrapped with anti-injection instructions\"\n Intended use: \"A developer tool; Supabase says not to give it to your customers or end users\"\n License: \"Apache-2.0\"\nverdict: \"For a coding agent on a Neon or Supabase project, the vendor's hosted server with read-only mode and one-project scoping is the least setup. For MongoDB, run the MongoDB server with --readOnly. For other engines, or for agents that run unattended in production, use MCP Toolbox with custom parameterized tools and a least-privilege database user, because a read-only flag on raw SQL is only as strong as what the database itself enforces.\"\nsources:\n - {title: MCP Toolbox for Databases README, url: \"https://github.com/googleapis/mcp-toolbox\", accessed: 2026-10-18}\n - {title: \"MCP Toolbox, Introduction\", url: \"https://mcp-toolbox.dev/documentation/introduction/\", accessed: 2026-10-18}\n - {title: \"MCP Toolbox, Prebuilt configs\", url: \"https://mcp-toolbox.dev/documentation/configuration/prebuilt-configs/\", accessed: 2026-10-18}\n - {title: \"MCP Toolbox, Read-only tools\", url: \"https://mcp-toolbox.dev/documentation/configuration/security/read-only/\", accessed: 2026-10-18}\n - {title: \"MCP Toolbox, Authentication\", url: \"https://mcp-toolbox.dev/documentation/configuration/authentication/\", accessed: 2026-10-18}\n - {title: \"MCP Toolbox, Security\", url: \"https://mcp-toolbox.dev/documentation/configuration/security/\", accessed: 2026-10-18}\n - {title: \"MCP Toolbox, Toolbox with MCP Authorization\", url: \"https://mcp-toolbox.dev/documentation/configuration/toolbox_mcp_auth/\", accessed: 2026-10-18}\n - {title: MongoDB MCP Server README, url: \"https://github.com/mongodb-js/mongodb-mcp-server\", accessed: 2026-10-18}\n - {title: MongoDB MCP Server docs, url: \"https://www.mongodb.com/docs/mcp-server/\", accessed: 2026-10-18}\n - {title: Neon MCP Server README, url: \"https://github.com/neondatabase/mcp-server-neon\", accessed: 2026-10-18}\n - {title: Neon MCP Server docs, url: \"https://neon.com/docs/ai/neon-mcp-server\", accessed: 2026-10-18}\n - {title: \"Neon MCP tool list (read-only)\", url: \"https://mcp.neon.tech/api/list-tools?readonly=true\", accessed: 2026-10-18}\n - {title: Supabase MCP Server README, url: \"https://github.com/supabase/mcp\", accessed: 2026-10-18}\n - {title: Supabase MCP Server docs, url: \"https://supabase.com/docs/guides/ai-tools/mcp\", accessed: 2026-10-21}\n - {title: Postgres MCP Pro README, url: \"https://github.com/crystaldba/postgres-mcp\", accessed: 2026-10-18}\n - {title: \"MCP specification, Elicitation\", url: \"https://modelcontextprotocol.io/specification/draft/client/elicitation\", accessed: 2026-10-18}\nlast_verified: 2026-10-18\npublished: 2026-10-18\n---\n\n## What this covers\n\nA database MCP server lets an agent look at schemas, run queries and, if you allow it, change data. The four here are the ones most agents meet: Google's engine-agnostic [MCP Toolbox for Databases](https://indexagentica.com/entries/mcp-toolbox-databases/), and the vendor servers for [MongoDB](https://indexagentica.com/entries/mongodb-mcp-server/), [Neon](https://indexagentica.com/entries/neon-mcp-server/) and [Supabase](https://indexagentica.com/entries/supabase-mcp/).\n\nWhat was checked by running things on 2026-10-18:\n\n- **MCP Toolbox 1.14.0** with `--prebuilt=postgres` against a local PostgreSQL, listed and called through the [MCP Inspector](https://indexagentica.com/entries/mcp-inspector/) CLI. It published 29 tools, and `--prebuilt=postgres/data` cut that to 8. Connected as a role with only `SELECT` on a table, `execute_sql` returned rows for a `SELECT` and `permission denied for table notes (SQLSTATE 42501)` for an `INSERT`.\n- **MongoDB MCP Server 3.1.0** with `--dryRun`, which prints the configuration and enabled tools without starting the server. With no Atlas credentials it enabled 27 tools; adding `--readOnly` left 18.\n- **Neon's public endpoint** `https://mcp.neon.tech/api/list-tools`, which needs no auth. It listed 119 tools unfiltered, 51 with `readonly=true`, and 7 with `readonly=true&category=querying`.\n- **Supabase** was not run, because its hosted server needs an account. Everything in its row comes from the docs.\n\n## What \"read-only\" actually enforces\n\nThe flag has the same name everywhere but works differently in each server:\n\n- **Enforced by the database.** Supabase runs queries \"as a read-only Postgres user\". Neon runs each `run_sql` call in a `READ ONLY` transaction and removes `run_sql_transaction`, because a `COMMIT` inside a multi-statement call could end the read-only transaction. Toolbox locks the session in the connection string for Cloud SQL and AlloyDB, uses a read-only connection for Cloud SQL MySQL, and uses BigQuery dry runs. Its docs explain why this matters: a check that a query starts with `SELECT` misses `WITH d AS (DELETE ...) SELECT ...` and functions that write.\n- **Enforced by hiding tools.** MongoDB's `--readOnly` keeps only tools whose operation type is read, connect or metadata. Every server above also prunes its write tools, which saves context tokens.\n- **Not covered.** Toolbox's read-only matrix lists only the Google Cloud engines and BigQuery. For self-managed Postgres, MySQL and the rest, its prebuilt-config docs tell you to connect as a dedicated user with only the privileges the agent needs. That is what our `SELECT`-only test did. Neon's `roleName` URL parameter does the same for Neon: SQL runs as the Postgres role you pin. It does not limit the Management API tools.\n\nWhichever server you use, the strongest control is the database role the server connects as.\n\n## Confirmation prompts depend on the client\n\nMongoDB and Supabase can pause a risky tool call and ask the human through MCP [elicitation](https://modelcontextprotocol.io/specification/draft/client/elicitation). MongoDB asks before `drop-database`, `drop-collection`, `delete-many`, `drop-index`, some Atlas tools, and aggregation pipelines with `$out` or `$merge`. Supabase asks before destructive SQL and before creating paid projects or branches. Both docs add caveats. If the client does not support elicitation, MongoDB runs the tool without asking, and Supabase calls its prompts \"a guardrail, not a guarantee\", since some clients can answer them automatically. Supabase's `skip_elicitations` URL parameter turns specific prompts off. Treat these prompts as a convenience on top of read-only mode and scoping, not as a replacement.\n\n## Scoping an agent to one project\n\n- **Neon:** `?readonly=true&projectId=&category=querying&category=schema&roleName=app_reader` on the MCP URL. With OAuth, the grant is fixed when you authorize and changing the URL later does not widen it. With an API key, the URL is read on every request. Neon's README warns that anyone who can edit that URL can remove the limits, so keep it in configuration the agent cannot change.\n- **Supabase:** `?project_ref=&read_only=true&features=database,docs`. Project scoping hides the account-level tools.\n- **MongoDB:** connect with a connection string for one database user, and add `--readOnly` and `--disabledTools`. Atlas tools only appear when you supply service-account credentials, and MongoDB asks you to give that account the minimum permissions.\n- **Toolbox:** load one toolset (`--prebuilt=postgres/data`, or `/mcp/` over HTTP), or write `tools.yaml` tools that each run one fixed, parameterized statement. Toolbox can also require a signed-in user per tool and fill parameters such as a user id from the token's claims, so the model never supplies them.\n\n## Untrusted data in results\n\nRows can contain text written by your users, and a prompt-injection payload in a support ticket is Supabase's own example of the risk. Supabase wraps SQL results with instructions telling the model not to follow commands in the data. MongoDB wraps results in delimiters with a warning unless you set `disableUntrustedDataWarning`. Neither is foolproof, so combine them with read-only access and human review of writes. [Agent auth and delegated access](https://indexagentica.com/guides/agent-auth-and-delegated-access/) covers giving an agent narrower credentials than your own.\n\n## Other things to know\n\n- **Telemetry:** the MongoDB server's configuration has telemetry `enabled` by default. Turn it off with `MDB_MCP_TELEMETRY=disabled` or `DO_NOT_TRACK=1`.\n- **Skills:** Neon and Supabase also publish agent skills ([Neon](https://indexagentica.com/entries/neon-agent-skills/), [Supabase](https://indexagentica.com/entries/supabase-agent-skills/)), and `neon init` installs Neon's skills next to the MCP server. Toolbox can turn a toolset into an Agent Skill with `toolbox skills-generate`.\n- **Clients:** Toolbox prebuilt configs can be installed with one click from the [Google Antigravity](https://indexagentica.com/entries/google-antigravity/) MCP Store and as [Gemini CLI](https://indexagentica.com/entries/gemini-cli/) extensions. All four work with any MCP client. See [Add MCP servers to Claude Code](https://indexagentica.com/guides/add-mcp-servers-to-claude-code/) for one example.\n- **Plain Postgres, one server:** [Postgres MCP Pro](https://indexagentica.com/entries/postgres-mcp-pro/) (MIT, not compared above) is a single-database alternative to Toolbox for self-managed Postgres. Its README describes an `--access-mode=restricted` setting that limits the server to read-only transactions and caps execution time, plus index tuning and health-check tools.\n- **Vectors:** if the agent needs similarity search too, the [vector database comparison](https://indexagentica.com/compare/vector-databases-for-agents/) covers [pgvector](https://indexagentica.com/entries/pgvector/) on the Postgres-based options, and MongoDB's server can create Atlas Local deployments with automatic embedding through a Voyage AI key.\n", "html": "

What this covers

\n

A database MCP server lets an agent look at schemas, run queries and, if you allow it, change data. The four here are the ones most agents meet: Google's engine-agnostic MCP Toolbox for Databases, and the vendor servers for MongoDB, Neon and Supabase.

\n

What was checked by running things on 2026-10-18:

\n
  • MCP Toolbox 1.14.0 with --prebuilt=postgres against a local PostgreSQL, listed and called through the MCP Inspector CLI. It published 29 tools, and --prebuilt=postgres/data cut that to 8. Connected as a role with only SELECT on a table, execute_sql returned rows for a SELECT and permission denied for table notes (SQLSTATE 42501) for an INSERT.
  • MongoDB MCP Server 3.1.0 with --dryRun, which prints the configuration and enabled tools without starting the server. With no Atlas credentials it enabled 27 tools; adding --readOnly left 18.
  • Neon's public endpoint https://mcp.neon.tech/api/list-tools, which needs no auth. It listed 119 tools unfiltered, 51 with readonly=true, and 7 with readonly=true&category=querying.
  • Supabase was not run, because its hosted server needs an account. Everything in its row comes from the docs.
\n

What "read-only" actually enforces

\n

The flag has the same name everywhere but works differently in each server:

\n
  • Enforced by the database. Supabase runs queries "as a read-only Postgres user". Neon runs each run_sql call in a READ ONLY transaction and removes run_sql_transaction, because a COMMIT inside a multi-statement call could end the read-only transaction. Toolbox locks the session in the connection string for Cloud SQL and AlloyDB, uses a read-only connection for Cloud SQL MySQL, and uses BigQuery dry runs. Its docs explain why this matters: a check that a query starts with SELECT misses WITH d AS (DELETE ...) SELECT ... and functions that write.
  • Enforced by hiding tools. MongoDB's --readOnly keeps only tools whose operation type is read, connect or metadata. Every server above also prunes its write tools, which saves context tokens.
  • Not covered. Toolbox's read-only matrix lists only the Google Cloud engines and BigQuery. For self-managed Postgres, MySQL and the rest, its prebuilt-config docs tell you to connect as a dedicated user with only the privileges the agent needs. That is what our SELECT-only test did. Neon's roleName URL parameter does the same for Neon: SQL runs as the Postgres role you pin. It does not limit the Management API tools.
\n

Whichever server you use, the strongest control is the database role the server connects as.

\n

Confirmation prompts depend on the client

\n

MongoDB and Supabase can pause a risky tool call and ask the human through MCP elicitation. MongoDB asks before drop-database, drop-collection, delete-many, drop-index, some Atlas tools, and aggregation pipelines with $out or $merge. Supabase asks before destructive SQL and before creating paid projects or branches. Both docs add caveats. If the client does not support elicitation, MongoDB runs the tool without asking, and Supabase calls its prompts "a guardrail, not a guarantee", since some clients can answer them automatically. Supabase's skip_elicitations URL parameter turns specific prompts off. Treat these prompts as a convenience on top of read-only mode and scoping, not as a replacement.

\n

Scoping an agent to one project

\n
  • Neon: ?readonly=true&projectId=<id>&category=querying&category=schema&roleName=app_reader on the MCP URL. With OAuth, the grant is fixed when you authorize and changing the URL later does not widen it. With an API key, the URL is read on every request. Neon's README warns that anyone who can edit that URL can remove the limits, so keep it in configuration the agent cannot change.
  • Supabase: ?project_ref=<ref>&read_only=true&features=database,docs. Project scoping hides the account-level tools.
  • MongoDB: connect with a connection string for one database user, and add --readOnly and --disabledTools. Atlas tools only appear when you supply service-account credentials, and MongoDB asks you to give that account the minimum permissions.
  • Toolbox: load one toolset (--prebuilt=postgres/data, or /mcp/<toolset> over HTTP), or write tools.yaml tools that each run one fixed, parameterized statement. Toolbox can also require a signed-in user per tool and fill parameters such as a user id from the token's claims, so the model never supplies them.
\n

Untrusted data in results

\n

Rows can contain text written by your users, and a prompt-injection payload in a support ticket is Supabase's own example of the risk. Supabase wraps SQL results with instructions telling the model not to follow commands in the data. MongoDB wraps results in delimiters with a warning unless you set disableUntrustedDataWarning. Neither is foolproof, so combine them with read-only access and human review of writes. Agent auth and delegated access covers giving an agent narrower credentials than your own.

\n

Other things to know

\n
  • Telemetry: the MongoDB server's configuration has telemetry enabled by default. Turn it off with MDB_MCP_TELEMETRY=disabled or DO_NOT_TRACK=1.
  • Skills: Neon and Supabase also publish agent skills (Neon, Supabase), and neon init installs Neon's skills next to the MCP server. Toolbox can turn a toolset into an Agent Skill with toolbox skills-generate.
  • Clients: Toolbox prebuilt configs can be installed with one click from the Google Antigravity MCP Store and as Gemini CLI extensions. All four work with any MCP client. See Add MCP servers to Claude Code for one example.
  • Plain Postgres, one server: Postgres MCP Pro (MIT, not compared above) is a single-database alternative to Toolbox for self-managed Postgres. Its README describes an --access-mode=restricted setting that limits the server to read-only transactions and caps execution time, plus index tuning and health-check tools.
  • Vectors: if the agent needs similarity search too, the vector database comparison covers pgvector on the Postgres-based options, and MongoDB's server can create Atlas Local deployments with automatic embedding through a Voyage AI key.
" }