Connect Claude to PostgreSQL — the safe way

Claude is great at writing SQL, but it can't answer questions about your data until it can reach your database. The usual way to wire it up — a raw PostgreSQL MCP server running on your laptop — has two problems: your database password sits in a plain config file, and most servers will run whatever SQL the model produces, including an UPDATE or DROP it hallucinated.

The AI2SQL Gateway fixes both. Claude connects to a hosted MCP endpoint that enforces read-only access, caps result size, times out long queries, and logs every call — and it authenticates with a revocable key instead of your credentials.

What you'll need

• A PostgreSQL database reachable from the internet (or a read-only replica of it)
• A free AI2SQL account
• Claude Code, Claude Desktop, or claude.ai

Set it up in 3 steps

1. Connect your database. In the AI2SQL Gateway, add your PostgreSQL connection. Credentials are encrypted and stay server-side.
2. Generate a gateway key. The setup wizard creates a key scoped to your account plus the connection id for that database.
3. Add the MCP server to Claude. Paste one line (or one JSON block for Claude Desktop) with your key and connection id:

$ claude mcp add --transport http ai2sql \
    https://builder.ai2sql.io/api/mcp \
    --header "x-ai2sql-key: $AI2SQL_KEY" \
    --header "x-ai2sql-connection: $CONNECTION_ID"

✓ ai2sql connected — 3 tools available
  run_query · describe_schema · list_connections

Get $AI2SQL_KEY and $CONNECTION_ID from the AI2SQL Gateway — connect a database and the setup wizard generates both for you.

That's it. Ask Claude something like "how many orders shipped last week, by status?" — it calls describe_schema to learn your tables, writes the SQL, runs it through run_query, and returns the answer. Every call is recorded on your gateway activity page.

What Claude can and can't do

Once connected, Claude can:

• Read your schema (tables, columns, relationships)
• Run SELECT queries and get results back, capped at 1,000 rows
• Explore and answer questions across the tables it can see

It cannot:

• Write, update or delete anything — writes are blocked at the gateway
• Run DDL, call dangerous functions, or open a long-running query past the timeout
• See your database password — it only ever holds a revocable key

Why not just use a raw Postgres MCP server?

You can — the open-source Postgres MCP servers are fine for a local scratch database. But for a database that matters, "the model writes SQL and we run it" is one hallucinated statement away from a bad day, your password lives in a config file on every laptop, and there's no record of what the agent touched. The gateway trades that for read-only enforcement, encrypted credentials, revocable keys and a full audit trail. See is it safe to connect AI to your production database?