AWS Labs postgres MCP Server

AWS Labs' postgres MCP Server converts natural-language questions into structured SQL and runs them against a configured Amazon Aurora Postgres or RDS Postgres database. It ships as pypi:awslabs.postgres-mcp-server from the awslabs/mcp monorepo, at src/postgres-mcp-server, and launches over stdio via uvx awslabs.postgres-mcp-server@latest (a Docker build path is also documented). The server enforces a semantic read-only policy by default; the --allow_write_query flag disables that enforcement, and the README's own security section describes the mechanism as "a best-effort, defense-in-depth mechanism, not a security boundary" rather than a hard guarantee. Authentication runs through two separate layers: AWS credentials via the AWS_PROFILE/AWS_REGION chain, with an RDS Data API resource ARN requiring rds-data:ExecuteStatement permission, and a Postgres-layer credential (IAM or username/password) stored in AWS Secrets Manager and passed as --secretManagerARN. Neither the README nor the docs site lists the server's tools; the seven tools recorded here, including run_query, get_table_schema and create_cluster, were read directly from the source at server.py.

Authority is first-party. GitHub reports the awslabs organization as verified, under the name "Amazon Web Services - Labs," and the monorepo's own README describes the collection as "Open source MCP servers for AWS... A suite of specialized MCP servers that help you get the most out of AWS, wherever you use MCP." The repository carries an Apache-2.0 license and was last pushed 2026-09-14.

Two published security advisories affect this server, both fixed in version 1.1.7: GHSA-fph8-pg5w-78fv (CVE-2026-87911), a critical command-injection weakness in the read-only enforcement's SQL validation that could let an unauthenticated actor run OS commands via a crafted COPY ... TO PROGRAM statement, published 2026-09-09; and GHSA-pwr4-hmph-gqgc (CVE-2026-85787), a medium-severity gap from an incomplete list of disallowed inputs in the same validation component, published 2026-09-04. Both are covered, alongside three sibling awslabs servers hit by the same batch, in the published story.