"Connect my agent to Postgres" has more than one answer in 2026, and the options genuinely differ. Some are open-source servers you run yourself; one is hosted by a specific platform; one is a hosted gateway. The choice that matters most isn't features — it's how seriously each enforces read-only, and whether it leaves a record.
| Tool | Deployment | Read-only | Audit | Best for | License |
|---|---|---|---|---|---|
| Official Postgres MCP (archived) | Local (stdio) | Read-only transaction only* | None | Developers, scratch DBs | MIT (archived) |
| Postgres MCP Pro (crystaldba) | Local / self-host SSE | Statement parse + read-only txn + timeout | Not a built-in feature | Developers, DBAs | MIT |
| DBHub (Bytebase) | Self-host (stdio/http) | READONLY flag + row limit + timeout | Not a built-in feature | Developers, multi-DB | MIT |
| Supabase MCP | Hosted (Supabase) + CLI | read_only flag (read-only PG user) | Not positioned as audit | Supabase projects | OSS |
| AI2SQL Gateway | Hosted | Statement classification + read-only txn + row limit + timeout | Query log by default | Teams wanting zero-ops + audit | Commercial |
* The archived official Postgres MCP server enforces read-only via a READ ONLY transaction only — a method with a documented SQL-injection bypass (per Datadog Security Labs). It was archived in 2025.
The open-source, self-host options
Postgres MCP Pro (crystaldba) is the most technically serious. Its restricted mode parses SQL with a real parser and rejects transaction-escape statements on top of a read-only transaction and a timeout — meaningfully stronger than the reference server. It also does index tuning and database-health analysis, which nothing else here matches. It's MIT-licensed and you run it (local stdio or a self-hosted SSE server).
DBHub (Bytebase's free OSS server) is the universal option — Postgres, MySQL, SQL
Server, MariaDB and SQLite through one interface, with a READONLY flag, row limiting and
query timeout. Also MIT, also self-host. No managed hosting, metering or built-in audit dashboard.
Supabase MCP is the right pick if your database is a Supabase project — its
read_only flag runs queries as a read-only Postgres user and it's hosted for you. It's
scoped to Supabase, not a generic "point at any Postgres" server, and read-only is per-tool rather
than a hardened statement classifier.
Where the hosted gateway fits
The open-source servers are excellent and free — the cost is that you operate and secure the process, and none of them ships audit logging as a default. The AI2SQL Gateway occupies the hosted, DB-statement-aware middle: it classifies statements and uses a read-only transaction, adds row limits and timeouts, issues revocable per-agent keys, and logs every query by default — with no server to run. The honest trade-offs: it's PostgreSQL-first today (not multi-engine), it's hosted (queries transit a third party, unlike self-host), and it doesn't do index tuning. If zero-ops and a built-in audit trail are what you want, it's the shortest path; if data-never-leaves-your-network or performance tooling is the priority, a self-hosted server fits better.
For a direct head-to-head, see AI2SQL Gateway vs a raw Postgres MCP server.