PgBeam vs a DIY Postgres MCP server

a DIY Postgres MCP server: A DIY Postgres MCP server is a self-hosted MCP process (often the reference server) that you point at a Postgres connection string so an agent can run SQL through MCP tools.

Running the reference Postgres MCP server is the fastest way to give an agent SQL tools, and for a local toy database it is fine. In production the problem is the connection string: the server can do whatever that string grants, which is usually everything, and any limit beyond that is code you write and then maintain forever. PgBeam is the same MCP surface, hosted, with the policy already enforced on the wire.

PgBeam vs a DIY Postgres MCP server, side by side

Move from a self-hosted server to a policy-enforced endpoint

The MCP client config is the last step, not the first. What changes is which credential is in play and what decides on the SQL inside a tool call, so do the credential first.

1. 1

   Rotate the credential the old server held

   Swapping servers does not invalidate the connection string the old one used, and that string has been readable by every process the agent ran. If the server you are leaving is the archived reference one, read the advisory first: its read-only transaction can be escaped with a semicolon, so treat the credential as having been fully privileged whatever you configured.

   psql, as an adminCopy

   ALTER ROLE old_agent_role WITH PASSWORD 'a-value-you-will-not-reuse';

2. 2

   Write the policy as rules rather than as server code

   This is the substitution. Every line here is a guardrail you would otherwise implement, test, and keep current against the schema in a server process you now own.

   TerminalCopy

   pgbeam policies create \
     --name agent-mcp \
     --mode read_only \
     --allow public.orders --allow public.order_items \
     --mask customers.email=redact \
     --max-rows 500 \
     --budget-queries-per-hour 300 \
     --statement-timeout-ms 8000

3. 3

   Point the MCP client at the hosted endpoint

   One credential, two front doors. The same bearer token addresses the MCP endpoint, and the same policy applies to a connection string when the agent stops speaking MCP and opens psql or an ORM.

   .mcp.jsonCopy

   {
     "mcpServers": {
       "pgbeam": {
         "type": "http",
         "url": "https://<project>.proxy.pgbeam.app/mcp",
         "headers": { "Authorization": "Bearer pba_..." }
       }
     }
   }

4. 4

   Verify with the statements you were afraid of

   Run them through the policy engine before an agent does, then watch the refusals arrive as the agent works.

   TerminalCopy

   pgbeam policies dry-eval --policy pol_xxx --sql "DROP TABLE public.orders"
   pgbeam policies dry-eval --policy pol_xxx --sql "SELECT email FROM public.customers"
   pgbeam audit list --event blocked --limit 10

You can run both for a while. Leave the self-hosted server pointed at a staging database while the hosted endpoint carries production, and compare the audit trail against what your own server logged.

The same tool call, on each side

A self-hosted server exposes a query tool. What the model puts in the sql argument is a string, and whether that string is examined is the entire difference. These verdicts and rule names are what the policy engine emits.

1  SELECT id, total FROM public.orders LIMIT 10
2  SELECT email FROM public.customers WHERE id = 42
3  DROP TABLE public.orders
4  SELECT o.id FROM public.orders o JOIN internal.payouts p ON p.order_id = o.id
5  COPY public.orders TO '/tmp/orders.csv'

1  runs      Verdict: allow    Rule: ok
2  runs      Verdict: mask     Rule: masked_column   Masked: customers.email (redact)
3  refused   Verdict: block    Rule: destructive_ddl
4  runs      Verdict: block    Rule: table_not_allowed
   Reason:   table "internal.payouts" is not in this credential's allowlist
5  refused   Verdict: block    Rule: copy_blocked

What you are signing up to maintain

Self-hosting is a real option and these are its real ongoing costs, alongside where PgBeam does not help.

BEGIN TRANSACTION READ ONLY;
COMMIT; DROP SCHEMA public CASCADE;

pgbeam audit list --event blocked --limit 20
pgbeam audit verify

More comparisons

Questions