DBHub vs Postgres MCP Pro

DBHub 95

v1.5.1 on 3 November 2026, 3 days before this check (30). Eleven tags from v1.2.0 (1 August) to v1.5.1 in the 90 days (20). Issues and pull requests are closed quickly, most within days, and only 7 are open (22). Listed in the official MCP registry as io.github.bytebase/dbhub at the current version (15). CI on push and pull request, a Docker publish workflow and pinned pnpm (8). 30 + 20 + 22 + 15 + 8 = 95.

Postgres MCP Pro 8

Last release 0.3.0 on 16 May 2025 (0). No release in the last 90 days. Main has a batch of 11 merges from 19 to 22 January 2026 and one commit on 15 August 2026 (0). 37 open issues and 35 open pull requests, a request for a release (#162) open since March 2026 and no maintainer reply on the security report. A commenter on #187 says the project is unmaintained since Crystal DBA's acquisition by Temporal, which we couldn't confirm (5). Not in the official MCP registry. A lookup for io.github.crystaldba/postgres-mcp returns 404 (0). Dependencies were refreshed on main in January, but the published package has the unbounded mcp dependency that now breaks it (3).

DBHub 80

Scored as a local stdio and HTTP package. Official npm package @bytebase/dbhub with Node.js 22.5 or later stated (20). A run-tests workflow runs unit and container-based integration suites on push and pull request; the pass state wasn't read (15). Of the latest 25 issues, 22 are closed, most crash and regression reports fixed within days, such as the dropped-connection crash closed 21 October and duplicate column names closed 3 November (22). Semver tags for every release but no changelog file, and release notes weren't read (8). 1.0.0 since 28 July 2026 (15). 20 + 15 + 22 + 8 + 15 = 80.

Postgres MCP Pro 41

Scored as a local stdio package. postgres-mcp on PyPI and the crystaldba/postgres-mcp Docker image, Python 3.12 or later stated. But PyPI's only current release, 0.3.0 from May 2025, asks for mcp[cli]>=1.5.0 with no ceiling, and since MCP Python SDK 2.0.0 shipped on 28 July 2026 a fresh uvx postgres-mcp pulls it and fails with "No module named 'mcp.server.fastmcp'" (#187). The <2.0 pin landed on main on 15 August and hasn't been released (10). CI runs ruff, pyright and pytest with a Postgres container on every push and pull request, with 25 unit test files. We couldn't see whether main passes (20). 37 open issues, among them the broken install, failures on custom schemas (#181) and two unmerged pull requests for connection-pool leaks (#177, #195) (6). Semver tags with no changelog (5). Pre-1.0 (0).

DBHub 85

Two tools by default, about 1.4k tokens by the README's count, with opt-in extras (25). max_rows caps results and flags truncation, search_objects has names, summary and full detail levels and a limit (18). Errors return as tool errors with the database's message (12). readOnlyHint and destructiveHint follow the access policy, though idempotentHint is always false (18). Few required settings, one DSN, and no SDK is needed for a local server (12). 25 + 18 + 12 + 18 + 12 = 85.

Postgres MCP Pro 57

Nine tools with about 2,500 characters of descriptions, roughly 1,300 tokens of definitions by our estimate (23). get_top_queries takes a limit, but execute_sql returns every row and the index tools append a _langfuse_trace block by default unless POSTGRES_MCP_INCLUDE_LANGFUSE_TRACE=false (6). Restricted mode explains its refusals (Only SELECT, ANALYZE, VACUUM, EXPLAIN, SHOW and other read-only statements are allowed) and its 30-second timeout suggests simplifying the query. Errors arrive as ordinary text rather than flagged tool errors (13). Annotations exist on main since January 2026 but not in the released 0.3.0, and on main explain_query claims readOnlyHint though analyze: true executes the statement in unrestricted mode (5). Sensible defaults, at most one required parameter per tool. Python only, plus Docker (10).

DBHub 73

Both default tools take zod schemas, so inputs are typed JSON Schema (25). dbhub.ai serves llms.txt (10). Descriptions are short and generated per source ("Execute SQL queries on the postgres database [READ-ONLY MODE]"), with the row cap stated, and say little about when not to use a tool (10). search_objects has enums for object type and detail level and a result limit; SQL is free text by nature (12). Docs pages per tool with examples; error formats aren't documented (9). Semver tags without a changelog (7). 25 + 10 + 10 + 12 + 9 + 7 = 73.

Postgres MCP Pro 56

FastMCP builds typed JSON Schema for all nine tools from Python type hints (25 less 5, since hypothetical_indexes is a list of free-form dicts) (20). No llms.txt. The README is Markdown on GitHub with a tool table (5). explain_query warns that analyze runs the query and analyze_db_health lists its checks, but most descriptions are one line ("List objects in a schema") and none says when not to use a tool (10). method is an enum. object_type, health_type and sort_by are free strings with valid values only in the prose, limit has no bounds and execute_sql gives sql a default of "all" (7). explain_query carries two worked examples. Errors come back as "Error: <Postgres message>" text (9). Semver tags, no changelog (5).

DBHub 43

The server holds database credentials, and the MCP side has no credential over stdio. Over HTTP a bearer token is optional and off by default while the default bind is 0.0.0.0, so an exposed port answers anyone the host allow-list admits (12). Read-only mode classifies statements and adds engine-level read-only transactions on PostgreSQL, with row limits and timeouts; there is no confirmation step for writes when read-only is off (16). Rows reach the model unmarked, and no guidance on treating results as untrusted was found beyond a blog post on the lethal trifecta (4). The workbench shows request traces (8). No SECURITY.md, disclosure policy or security.txt found (3). 12 + 16 + 4 + 8 + 3 = 43.

Postgres MCP Pro 26

One database URI from DATABASE_URI or the command line, with whatever privileges its role has. The SSE and HTTP transports have no authentication and bind to localhost by default (10). Restricted mode parses every statement with pglast against an allowlist of statement types and functions, runs it in a read-only transaction and stops it after 30 seconds. But unrestricted is the default, every config example in the README uses it, and #178 (opened 6 June 2026) shows restricted mode reading server files through a function in the FROM clause. The fix (#200) is unmerged (10). The README discusses LLM-generated damage at length but says nothing about instructions hidden in table data, and rows reach the model unmarked (3). Restricted-mode queries are tagged /* crystaldba */, so they can be picked out in Postgres logs and pg_stat_statements (3). No SECURITY.md, and the #178 reporter says private advisories aren't enabled (0).