B
B0yko/pgwarden
Per-person read-only Postgres access, with PII masking
在 GitHub 查看 ↗链接已于 2026-11-12 核查 · HTTP 200 · 打开的是厂商自己的官网
安装与配置
客户端配置（取自该仓库的安装命令）
{
"mcpServers": {
"b0yko-pgwarden": {
"command": "npx",
"args": ["@modelcontextprotocol/inspector@2.8.0"]
}
}
}解析自我们于 2026-11-04 抓取的该仓库 README；我们未执行过。
command/args 来自仓库写明的安装命令；不确定时请以该项目 README 为准。
VS Code（.vscode/mcp.json —— 键名是 servers）
{
"servers": {
"b0yko-pgwarden": {
"command": "npx",
"args": ["@modelcontextprotocol/inspector@2.8.0"]
}
}
}VS Code 顶层键是 <code>servers</code>，其余与上面那份相同。
Claude Code（命令行）
claude mcp add --transport stdio b0yko-pgwarden -- npx @modelcontextprotocol/inspector@2.8.0
Claude Code 不收 JSON 文件，用这条命令直接加。
配置项的键名以你的客户端为准：客户端与 CLI
- 来源明细
- 收录自 abordage/awesome-mcp 榜单（我们从中收集的条目之一） · 条目类型：MCP 服务
- 收录与活跃
- 收录于 2026-11-05 · 最近见到 2026-11-14 · 共见到 10 次 · 被 10 个来源列出
- 评分构成
- 综合分 1,003 · 10 个来源 · mcp
- 安装
npx @modelcontextprotocol/inspector@2.8.0
常见问题（答案都来自我们的记录）
怎么安装？
该仓库给出的安装命令是
npx @modelcontextprotocol/inspector@2.8.0。我们的记录里它是仓库自己提供的；不保证在你的客户端上直接可用。它适合谁 / 用来做什么？
我们把它归在这些标签下: MCP 服务。标签来自条目自身，不是我们强加的分类。
谁维护它、还在更新吗？
我们收录于 2026-11-05；最近见到 2026-11-14。这里没有"官方认证"或"质量评级"——我们只记录来源与时间。
Quickstart ·
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
How it works ·
Results ·
Limitations ·
Docs
pgwarden is an MCP gateway that lets Claude, ChatGPT, Cursor or any MCP client query
Postgres as the person asking. People sign in through your OIDC provider; the gateway
connects as their own Postgres role, and the database decides what they see through your
grants, row-level security and masking views. Reads are read-only by construction, writes
wait for a named approver, and every tool call, sign-in, approval and admin change lands in
an append-only, hash-chained audit log.
> Why let Postgres decide. With one shared credential every user gets the union of
> everyone's access, and a prompt injection in a support ticket can make an assistant that
> holds it read a private table
> (General Analysis, 2025). Guards
> bolted on outside the database get bypassed: a reference read-only Postgres MCP server was
> escaped with COMMIT;
> (Datadog Security Labs, 2025).
| 133 / 133 | 0 | 1.98 ms | 565 req/s |
| attacks blocked, oracle-verified | leaked rows or unapproved writes, 60 LLM episodes | gateway overhead per key lookup, p50 | 20 identities, p95 94.8 ms |
MacBook Air M5, 24 GB, Docker via colima with 4 CPUs / 6 GB · the commands and caveats are under Results
## What changes
| | One shared credential | pgwarden | |
| Who the database sees | one role for every user | the person's own login role, mapped from your IdP | ADR‑0002 |
| What a person can read | the union of everyone's access | their grants, RLS keyed on sessionuser, masking views | ADR‑0005 |
| Read-only | as strong as the wrapper around the SQL | a read-only transaction and one statement per call; no SQL parsing | ADR‑0001 |
| Writes | whatever the role may do | proposed, checked by EXPLAIN, approved by a named person, run once | ADR‑0006 |
| Record | whatever the server logs | append-only, hash-chained, verified independently of the code that wrote it | ADR‑0007 |
## Quickstart
Docker with Compose v2 is all the demo needs.
bash
git clone https://github.com/B0yko/pgwarden && cd pgwarden
docker compose up -d --wait # Postgres, a mock IdP, Mailpit and the gateway
Every port binds to 127.0.0.1. If 5432, 8080, 9400, 1025 or 8025 is taken,
cp .env.example .env, change the ports there, and devtools/check-ports.sh confirms they
are free.
Open : the landing page prints the connect commands for MCP
Inspector, Claude Code and Cursor. With MCP Inspector (needs Node):
bash
npx @modelcontextprotocol/inspector@2.8.0 --server-url http://localhost:8080/mcp --transport http
Connecting walks you through consent, a mock sign-in and a confirmation that names the
Postgres role you will use. Then call whoami, listtables, describetable and query
as any of the demo identities:
| Sign in as | Postgres role | What the database lets you do |
| alice | pwualice | read every region, with PII masked |
| bob | pwubob | read EU rows only, with raw PII; propose writes |
| dana | pwudana | read US rows only, with raw PII; propose writes |
| carol | none | approve writes (the email arrives in Mailpit, ) and open /admin |
| mallory | none | sign in, then be refused: the identity is not mapped to a role |
Results ·
Limitations ·
Docs
pgwarden is an MCP gateway that lets Claude, ChatGPT, Cursor or any MCP client query
Postgres as the person asking. People sign in through your OIDC provider; the gateway
connects as their own Postgres role, and the database decides what they see through your
grants, row-level security and masking views. Reads are read-only by construction, writes
wait for a named approver, and every tool call, sign-in, approval and admin change lands in
an append-only, hash-chained audit log.
> Why let Postgres decide. With one shared credential every user gets the union of
> everyone's access, and a prompt injection in a support ticket can make an assistant that
> holds it read a private table
> (General Analysis, 2025). Guards
> bolted on outside the database get bypassed: a reference read-only Postgres MCP server was
> escaped with COMMIT;
> (Datadog Security Labs, 2025).
| 133 / 133 | 0 | 1.98 ms | 565 req/s |
| attacks blocked, oracle-verified | leaked rows or unapproved writes, 60 LLM episodes | gateway overhead per key lookup, p50 | 20 identities, p95 94.8 ms |
MacBook Air M5, 24 GB, Docker via colima with 4 CPUs / 6 GB · the commands and caveats are under Results
## What changes
| | One shared credential | pgwarden | |
| Who the database sees | one role for every user | the person's own login role, mapped from your IdP | ADR‑0002 |
| What a person can read | the union of everyone's access | their grants, RLS keyed on sessionuser, masking views | ADR‑0005 |
| Read-only | as strong as the wrapper around the SQL | a read-only transaction and one statement per call; no SQL parsing | ADR‑0001 |
| Writes | whatever the role may do | proposed, checked by EXPLAIN, approved by a named person, run once | ADR‑0006 |
| Record | whatever the server logs | append-only, hash-chained, verified independently of the code that wrote it | ADR‑0007 |
## Quickstart
Docker with Compose v2 is all the demo needs.
bash
git clone https://github.com/B0yko/pgwarden && cd pgwarden
docker compose up -d --wait # Postgres, a mock IdP, Mailpit and the gateway
Every port binds to 127.0.0.1. If 5432, 8080, 9400, 1025 or 8025 is taken,
cp .env.example .env, change the ports there, and devtools/check-ports.sh confirms they
are free.
Open : the landing page prints the connect commands for MCP
Inspector, Claude Code and Cursor. With MCP Inspector (needs Node):
bash
npx @modelcontextprotocol/inspector@2.8.0 --server-url http://localhost:8080/mcp --transport http
Connecting walks you through consent, a mock sign-in and a confirmation that names the
Postgres role you will use. Then call whoami, listtables, describetable and query
as any of the demo identities:
| Sign in as | Postgres role | What the database lets you do |
| alice | pwualice | read every region, with PII masked |
| bob | pwubob | read EU rows only, with raw PII; propose writes |
| dana | pwudana | read US rows only, with raw PII; propose writes |
| carol | none | approve writes (the email arrives in Mailpit, ) and open /admin |
| mallory | none | sign in, then be refused: the identity is not mapped to a role |
收录徽章（可选）
想把收录标记放进 README 就复制这行，可选，不影响收录。
[](https://anclum.com/zh/s/b0yko-pgwarden/)
- 来源
- awesome · https://github.com/B0yko/pgwarden
- 按领域浏览
- MCP 服务
- 收录来源
- 10 个独立来源
- 收录于
- 今天
同类推荐
所属领域与标签
每个标签都能点进去看同类的全部条目。数字是当前库里的真实条数。