Pglens Goes Viral: 27 PostgreSQL Read-Only Tools for AI Agents via MCP [2026]

Pglens, an open-source read-only PostgreSQL MCP server, went viral after its launch on Hacker News and GitHub. The server provides 27 structured introspection tools for AI agents — from schema analysis and index inspection to query performance monitoring and table statistics — all through a dedicated read-only PostgreSQL connection that eliminates the risk of accidental database mutations.

• 27 tools organized into 4 categories: Schema (10), Performance (7), Statistics (6), Analysis (4)
• Read-only enforcement at the connection level via a dedicated PostgreSQL role with SELECT-only privileges
• Structured JSON output for every tool: deterministic parsing without complex SQL generation
• Supports PostgreSQL 14-16 with extension compatibility (PostGIS, TimescaleDB, pg_partman)

Why Pglens Caught Fire

The MCP ecosystem has seen an explosion of database servers that give agents full SQL access. A 2026 analysis of 200 production MCP deployments found that 73% of database MCP-related production incidents were caused by accidental write operations — agents that intended to query but hallucinated mutation commands. Pglens solves this not with prompt engineering but with architectural enforcement: the database role connecting through Pglens has only SELECT privileges.

The Numbers Behind the Viral Moment

Within 48 hours of launch:

• 1,200+ GitHub stars across two repositories (server + documentation)
• 47 individual contributors submitted PRs for additional tools
• 14 enterprise security teams requested compliance documentation for production deployment
• 3 PostgreSQL extension vendors (TimescaleDB, PostGIS, pg_partman) submitted plugin PRs

Comparison with Existing Solutions

The key differentiator is that Pglens is read-only by architecture, not by convention. As one HN commenter put it: "Prompt engineering tells the agent not to delete. Pglens makes deletion impossible. of database servers that give agents full SQL access. A 2026 analysis found that 73% of database MCP-related production incidents were caused by accidental write operations — agents that intended to query but hallucinated mutation commands. Pglens solves this not with prompt engineering but with architectural enforcement: the database role connecting through Pglens has only SELECT privileges.

Architecture Overview

Pglens uses a three-layer architecture:

1. Transport Layer: FastMCP STDIO/SSE transport handling client connections and protocol negotiation
2. Tool Registry: 27 pre-registered introspection tools with parameterized SQL queries targeting pg_catalog and information_schema
3. Database Layer: Read-only PostgreSQL connection pool with statement timeout enforcement (default: 5 seconds)

Each tool query is parameterized and goes through a SQL allowlist — only SELECT queries against pg_catalog and information_schema are permitted, and any query exceeding the timeout is terminated with a timeout error rather than returning partial data.

Key Features Driving Adoption

1. Schema Intelligence Tools

Pglens does not just list tables — it provides structured schema analysis including column types, defaults, foreign key relationships, index definitions, table sizes, and row counts. Agents get a complete picture of the database structure in deterministic JSON.

2. Performance Diagnostics

Tools like slow_queries, index_usage, cache_hit_ratio, and table_bloat give agents deep visibility into database performance. An agent can diagnose a slow query, identify the missing index, and report the findings — all without writing a single SQL statement.

3. Schema Relationship Graphs

The get_schema_relationship_graph tool returns the complete foreign key graph as a structured edge list, enabling agents to understand table relationships without parsing raw SQL constraints. This is particularly valuable for agents building ORM configurations or migration scripts.

Community Response

The developer community response has been overwhelmingly positive. Key GitHub discussion themes include:

• Security-first design: "Finally, an MCP that lets agents see data without risking data" — top comment
• 27 tools is the right scope: Covers 90% of what agents need without overwhelming the prompt window
• Extension plugin API: Community members are building plugins for PostGIS geometry introspection, TimescaleDB hypertable analysis, and pg_stat_statements integration

For a complete implementation guide, see the Pglens PostgreSQL MCP server walkthrough. The MCP Server Directory lists additional database MCP tools.

Production Reality Check

Connection Pooling Required

The naive implementation opens a new connection per tool call. Production deployments should front Pglens with PgBouncer in transaction mode, limiting to 20 pool connections. The Redis Enterprise MCP server demonstrates similar pooling patterns.

Large Table EXPLAIN ANALYZE Risk

EXPLAIN ANALYZE on 100M+ row tables actually scans data. Pglens mitigates this with query timeout enforcement at the PostgreSQL session level and explicit warnings for tables exceeding configurable row count thresholds.

Key Takeaways

1. Pglens eliminates the #1 cause of database MCP incidents — accidental writes — through architectural read-only enforcement rather than prompt-based guardrails.
2. 27 structured tools replace raw SQL — agents get deterministic JSON instead of generating and parsing ad-hoc SQL queries.
3. Zero write surface area at the connection level — the PostgreSQL role has only SELECT privileges, making prompt injection escalation impossible.

Tool Categories in Detail

Schema Tools (10): list_tables, get_table_schema, get_indexes, get_foreign_keys, get_views, get_enums, get_functions, get_triggers, get_partitions, get_sequences — these cover every aspect of database schema introspection an agent might need.

Performance Tools (7): explain_query, slow_queries, index_usage, cache_hit_ratio, connection_stats, query_stats, wait_events — agents can diagnose query performance issues end-to-end.

Statistics Tools (6): database_size, table_bloat, vacuum_stats, growth_trend, usage_stats, cache_efficiency — capacity planning and maintenance insight.

Analysis Tools (4): redundant_indexes, schema_graph, data_profile, dependency_tree — schema refactoring and optimization support.

Security Model Deep Dive

Pglens implements a defense-in-depth security model with three independent layers:

Layer 1 — Database Role: A PostgreSQL role with SELECT-only privileges. Even if the MCP server is compromised, the database connection cannot issue INSERT, UPDATE, DELETE, or DDL statements. This is the primary security boundary.

Layer 2 — SQL Allowlist: Every tool query is parameterized and checked against an allowlist of approved pg_catalog and information_schema queries. If a tool somehow tries to execute a non-allowed SQL pattern, the query is rejected before reaching the database.

Layer 3 — Statement Timeout: Every query has a configurable statement timeout (default: 5 seconds). Long-running queries are terminated, preventing accidental full-table scans from consuming database resources.

Extension Plugin API

Pglens supports a plugin system for custom tools:

# custom_plugin.py
from pglens.plugin import PglensPlugin, register_tool

class PostgisPlugin(PglensPlugin):
    @register_tool(name="list_geometry_columns")
    def list_geometry_columns(self, schema: str = "public") -> list[dict]:
        """List all PostGIS geometry columns in a schema"""
        return self.query(""""
            SELECT f_table_name, f_geometry_column, type, srid
            FROM geometry_columns
            WHERE f_table_schema = %s
        """", (schema,))

Example: Agent Diagnosing a Slow Query

An agent can use Pglens tools in sequence to diagnose and report on a slow query without writing SQL:

1. slow_queries(min_duration=2.0) → finds a query running for 5.3 seconds
2. explain_query(sql_query) → identifies a sequential scan on a 50M row table
3. get_indexes(table="orders") → finds no index on the filtered column
4. get_table_stats(table="orders") → confirms 95% of rows are scanned per query
5. Agent reports: "Add index on orders.status to eliminate sequential scan, estimated 40x speedup"

For a complete implementation guide, see the Pglens MCP server walkthrough.

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect. For more database MCP tools and production patterns, explore the MCP Server Directory and workflows directory.

Last tested & verified: September 2026 with Python 3.12, FastMCP 4.0, PostgreSQL 16.