What is a database MCP server?

The Model Context Protocol (MCP) is an open standard for connecting AI agents to external tools and data. Instead of an agent guessing at your systems, an MCP server exposes a set of named tools the agent can call. A database MCP server is one of these — it exposes your database so an agent like Claude, Cursor or ChatGPT can work with real data.

What tools a database MCP server exposes

Most database MCP servers offer some version of:

• describe_schema — the tables, columns and relationships, so the agent's SQL matches your actual data model
• run_query — execute a query and return the results
• list_connections — enumerate the databases the agent is allowed to reach

With these, an agent can answer a plain-English question — "how many active users signed up last month?" — by inspecting your schema, writing the SQL, running it, and reading back the result.

Read-only vs unrestricted

Not all database MCP servers are equal on safety. Some run whatever SQL the model produces. Some default to a read-only transaction. A few parse and classify each statement before running it. For a database that matters, the difference is significant: a read-only transaction alone has been bypassed in practice, so the safer servers classify statements and use a read-only transaction, then add row limits and timeouts on top.

Server vs gateway

A plain MCP server connects an agent to a database. A gateway puts a control plane in front of that connection:

• Read-only enforcement that blocks writes and DDL before they run
• Row limits and query timeouts so no single call can overwhelm the database
• Revocable, per-agent keys instead of a shared database password
• Per-key metering and a full audit log of every query

You can run an open-source database MCP server yourself — Postgres MCP Pro and DBHub are solid choices — or use a hosted gateway that handles all of the above for you. The AI2SQL Gateway is the hosted, read-only, audited option: connect a PostgreSQL database, get a key, and any MCP-capable agent can query it safely. For the exact tool definitions, see the MCP tool reference.