Delv
Official (Vendor)Active· 6d★ 4.3by AWS

AWS Aurora PostgreSQL

AWS Labs' Postgres MCP. Aurora-aware: pgwire, pgwire-iam, RDS Data API. Natural-language SQL with AWS auth handled.

View repo Homepage
A
Safety & Trust

Delv Safety Grade: A

Score 84/100 · assessed 2026-04-28

Maintainer95
Permissions65
Supply chain85
Transparency90
Incidents100

AWS Labs' official Postgres MCP server is a high-trust tool for querying Aurora and RDS databases through Claude. The maintainer score is excellent given AWS's organisational backing and active development. Transparency is strong with full open source, clear documentation, and active issue tracking. Supply chain is solid via PyPI distribution with versioned releases, though not yet at the maturity of AWS's core SDKs. The permissions profile is the main consideration: this server executes arbitrary SQL queries against production databases, including writes, deletes, and schema changes. IAM authentication is a green flag for credential management, but the tool inherently grants broad database access. Safe for engineers who understand SQL blast radius, but requires careful scoping of which databases Claude can reach.

Lethal Trifecta (prompt-injection exposure)

ONE OF THREE
Private dataYes
Reads secrets, credentials, private files
Untrusted inputNo
Ingests web pages, PRs, issues, emails
External commsNo
Can send data outbound

Same.

Green flags

  • Official AWS Labs project with active maintenance
  • IAM authentication avoids storing database passwords
  • Supports read-only RDS Data API mode for serverless workloads
  • Aurora-specific optimisations and connection pooling
  • Open source with clear documentation and examples

Red flags

  • Executes arbitrary SQL including DELETE, DROP, and schema modifications
  • Natural-language SQL translation can misinterpret intent on complex queries
  • Requires AWS credentials with database access permissions
  • No built-in query approval workflow or dry-run mode mentioned

Permissions requested

DB readDB writeOutbound networkPrivate networkRead envIdentity read
Assessed by Delv Editorial using public metadata. Grades are advisory and update as the ecosystem changes. They do not replace your own review of permissions and code before granting an agent access to sensitive systems.

Install

uvx awslabs.postgres-mcp-server@latest
Env vars needed: AWS_REGIONAWS_PROFILE

Review

This is AWS's official Postgres MCP server, built specifically for Aurora and RDS workloads. It handles three connection modes: pgwire (standard Postgres protocol), pgwire-iam (IAM database authentication), and the RDS Data API for serverless setups. The big win here is that AWS auth is baked in. You point it at an Aurora cluster, configure your AWS profile, and Claude can query your database without you copying credentials into chat or writing throwaway scripts. I'd reach for this when I'm debugging a production schema or drafting migrations against a real Aurora instance. The natural-language SQL is surprisingly useful. You can ask "show me the five slowest queries this week" and it'll translate that into the right pg_stat_statements query, then format the results. It's faster than context-switching to a SQL client, especially when you're already in a Claude chat working through a problem. The IAM auth mode is the standout feature. If your Aurora cluster is configured for IAM database authentication, this server generates short-lived tokens automatically. No hardcoded passwords, no secrets in config files. For teams that enforce IAM everywhere, this is the only MCP Postgres server that respects that boundary. Quirks: the RDS Data API mode is slower because it's HTTP-based, not a persistent connection. Fine for ad-hoc queries, annoying if you're running a dozen queries in quick succession. The server also assumes you've already configured AWS CLI credentials. If your profile isn't set up or your region is wrong, the error messages are cryptic. And while it works with any Postgres database, the Aurora-specific features (like Data API support) are wasted if you're just pointing it at a local Postgres instance. Who shouldn't bother: if you're running Postgres locally or on a non-AWS host, use a simpler MCP Postgres server. This one's built for AWS primitives, and the extra config overhead isn't worth it unless you're actually using Aurora or RDS. Also, if your team doesn't use IAM database auth, you're not getting the main benefit.
Verdict

Install this if you're running Aurora or RDS Postgres and want Claude to query your database without credential juggling. The IAM auth support and RDS Data API modes are genuinely useful for AWS-native teams. Skip it if you're using Postgres anywhere else, the setup complexity isn't justified.

Good at

  • IAM database authentication is handled automatically, no hardcoded credentials in config files.
  • RDS Data API support means you can query Aurora Serverless without managing persistent connections.
  • Natural-language SQL translation is accurate for common Postgres introspection tasks like schema inspection and slow-query analysis.
  • Official AWS Labs project, so it's maintained alongside Aurora feature releases.
  • Works with any Postgres database, not just Aurora, if you use pgwire mode.

Watch out

  • RDS Data API mode is noticeably slower than pgwire because it's HTTP-based, not a persistent connection.
  • Error messages are cryptic if your AWS CLI profile or region is misconfigured.
  • Setup overhead isn't justified unless you're actually using Aurora or RDS, simpler MCP servers exist for local Postgres.
  • Requires Python 3.10+ and a working AWS CLI setup, which adds friction if your team isn't already AWS-native.

Use cases

  • Querying Aurora with IAM auth
  • Drafting migrations against a real schema
  • Pulling slow-query stats
  • Connecting via the RDS Data API for serverless access

Getting started

1. Install with `uvx awslabs.postgres-mcp-server@latest` (requires Python 3.10+). 2. Add it to your MCP host config (Claude Desktop, Cursor, etc.) with `AWS_REGION` and `AWS_PROFILE` environment variables set to match your Aurora cluster's region and your local AWS profile. 3. Configure the connection mode in the server args: `pgwire` for standard auth, `pgwire-iam` for IAM database authentication, or `data-api` for serverless RDS. 4. Test it by asking Claude to list tables in your database. If you get an auth error, check that your AWS CLI credentials are valid and your IAM role has `rds-db:connect` permissions. 5. Watch out for the RDS Data API's slower response times. It's convenient for serverless setups but noticeably slower than pgwire for interactive queries.

Works with

Claude DesktopClaude CodeCursorVS Code

Similar MCPs