PostgreSQL

Setup

1. Create a dedicated role for the agent and grant it only what it needs:

   CREATE ROLE amcp_reader LOGIN PASSWORD 'change-me';
   GRANT CONNECT ON DATABASE sales TO amcp_reader;
   GRANT USAGE ON SCHEMA public TO amcp_reader;
   GRANT SELECT ON ALL TABLES IN SCHEMA public TO amcp_reader;
   ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO amcp_reader;
   

   The last line matters: without it, tables created tomorrow are invisible.
2. Set POSTGRES_HOST, POSTGRES_PORT (5432), POSTGRES_DATABASE, POSTGRES_USER and POSTGRES_PASSWORD.

search_path is not set for you. Unqualified table names resolve against the role's default search path, which on a fresh role is "$user", public. Schema-qualify (analytics.orders) when in doubt.

How a database connector behaves

• It installs read-only. The engine rejects anything that is not a read until you flip the switch in the connector's settings. That is a guard rail, not a security boundary: give the connection a database role that is itself read-only, and the guard rail never has to matter.
• Credentials live in the encrypted authConfig, not in the connection string. POSTGRES_USER and POSTGRES_PASSWORD are stored encrypted and spliced into the DSN at call time; the host and database name are stored in the plaintext baseUrl column.
• Results are capped at 1000 rows. A query that would return more comes back truncated with a flag. Aggregate in SQL rather than in the agent.
• A statement runs exactly as written. There is no query rewriting and no automatic LIMIT — an unbounded scan on a large table is a real unbounded scan on your production database. Say LIMIT.

Reachable from where?

• On AnythingMCP Cloud the server must accept connections from the public internet, which for a production database usually means it should not. Point the connector at a read replica, or self-host AnythingMCP inside the network.
• Self-hosted, add the host to SSRF_ALLOWED_HOSTS: the outbound guard blocks private address space by default, and 10.0.0.5 is exactly the shape it is there to block.

Supersedes the marketing site's postgres placeholder, which advertised a POSTGRES_URL connection string. This adapter takes host, port and database separately and keeps the password encrypted, which the single-URL form could not do.