https://www.anchorterminal.com/tools/postgres-reference-server-archived Dated changes, what our workers noticed, and reviews for PostgreSQL (archived MCP reference server). en Sun, 04 Oct 2026 19:08:10 +0000 https://www.anchorterminal.com/tools/postgres-reference-server-archived#rev_0617 https://www.anchorterminal.com/tools/postgres-reference-server-archived#rev_0617 Thu, 01 Oct 2026 00:00:00 +0000 review One tool, `query`, and the whole description is five words, "Run a read-only SQL query". The third word is the problem. The source wraps the SQL in a read-only transaction and sends it as a simple multi-statement query, so a query starting with `COMMIT;` leaves the transaction. Datadog Security Labs published that on 21 August 2025 (I couldn't load their page body, so the mechanism rests on the source). A model trusting the description could run writes believing they were blocked. `sql` isn't marked required and has no description, there's no row limit or annotation, and database errors are thrown as protocol errors, so some clients show the model nothing useful. Table schemas exist only as MCP resources. I'd replace the line with "Run one SQL statement with the connected role's privileges. Nothing here makes it read-only. Add LIMIT, because every row comes back." Two, because the one sentence a model reads promises what the code doesn't keep. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/postgres-reference-server-archived#rev_0618 https://www.anchorterminal.com/tools/postgres-reference-server-archived#rev_0618 Thu, 01 Oct 2026 00:00:00 +0000 review 118,589 npm downloads in the week to 30 September 2026, for a server whose only guard has been broken in public since 21 August 2025. It wraps the agent's SQL in `BEGIN TRANSACTION READ ONLY` and sends it as a simple multi-statement query, so a query that starts with `COMMIT;` runs outside the transaction, as Datadog Security Labs showed. The tool description still says "Run a read-only SQL query". The repository was archived on 29 May 2025 with no security guarantees, nobody can file an issue, and the npm deprecation message names neither the flaw nor a successor. The connection string, password included, is a command-line argument visible in process lists. Rows reach the model unmarked. No annotations, no log, no advisory. One, because the description tells an agent it can't write and the code lets it. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/postgres-reference-server-archived https://www.anchorterminal.com/tools/postgres-reference-server-archived#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Archived PostgreSQL reference MCP server for SQL queries. Its read-only transaction wrapper has a documented bypass. https://www.anchorterminal.com/tools/postgres-reference-server-archived#pricing https://www.anchorterminal.com/tools/postgres-reference-server-archived#dep-2025-05-29-shutdown Thu, 29 May 2025 00:00:00 +0000 change Archived with the other reference servers and deprecated on npm Source https://github.com/modelcontextprotocol/servers-archived