Database, Vector, and Analytics MCP Servers: Supabase, PostgreSQL, MongoDB, Redis, Neo4j, and More

A database MCP server connects an AI client to a data system through named tools and resources. Choose the server that matches the database and job, then restrict it to the smallest project, feature set, role, and network path possible. Supabase MCP is a strong managed Postgres option; PostgreSQL, MySQL, SQLite, MongoDB, Redis, Neo4j, Qdrant, Firebase, Elasticsearch, and dbt require different query and safety models.

Do not choose by database popularity alone. A read-only schema explorer, a migration tool, a vector-memory service, and an analytics assistant expose very different consequences when an agent calls the wrong operation.

Original Graphify editorial visual. The categories are abstracted from current database MCP use cases and do not reproduce vendor interfaces or artwork.

Which database MCP server should you choose?

Choose by data model, required action, and authority boundary. Start with read-only metadata and queries. Add writes, DDL, account administration, or deployment tools only after the workflow proves that it needs them.

Need	Good starting category	Examples from this guide	Main risk to control
Managed Postgres development	Platform-specific MCP	Supabase MCP	Account-wide access and mutating project tools
SQL inspection and tuning	Relational database MCP	Postgres MCP, MySQL MCP, SQLite MCP	Destructive SQL, locks, expensive scans, sensitive rows
Flexible document data	Document database MCP	MongoDB MCP, Firebase MCP	Broad collection access and writes with weak filters
Connected entities and paths	Graph database MCP	Neo4j MCP	Write-capable Cypher and large traversal cost
Semantic retrieval	Vector database MCP	Qdrant MCP, Chroma MCP, Pinecone MCP	Cross-tenant retrieval, untrusted stored text, embedding cost
Cache, streams, and agent memory	Key-value MCP	Redis MCP	Mutation, eviction, unbounded keys, production session exposure
Search and observability data	Search MCP	Elasticsearch MCP or its current successor	Large queries, cluster scope, and deprecated deployment paths
Analytics project context	Analytics MCP	dbt MCP	Running SQL in the wrong environment and exposing warehouse data

The term MCP database does not identify one canonical server. Several official vendor projects exist, while other repositories are community maintained. Verify the owner, release, license, transport, and permissions before copying a configuration.

What can a database MCP server expose?

A database MCP server normally converts model requests into a small set of database-specific operations. The exact tools vary, but they usually fall into five groups:

Metadata: list databases, schemas, tables, collections, indexes, graph labels, or vector collections.
Read: run SQL, aggregation pipelines, Cypher, search queries, or semantic retrieval.
Write: insert, update, delete, cache, publish, or create graph relationships.
Administration: create projects, branches, indexes, users, or storage resources.
Documentation and diagnostics: search product docs, inspect logs, explain plans, or report configuration.

Tool names are not security controls. The database credential, server-side allowlist, project scope, query policy, and client approval gate determine what an agent can actually do.

How should you secure a database MCP server?

Build the connection as if an untrusted prompt could reach every enabled tool. Database values, tickets, documents, and log records can contain instructions that try to redirect an agent. A model can also generate a harmful query without malicious input.

Original least-privilege pipeline for database MCP access, from isolated environment and scoped identity through approval and audit

Original Graphify editorial visual. The pipeline separates environment, identity, tool, query, approval, and audit controls.

Use this order:

Connect a development, branch, replica, or sanitized dataset—not production.
Create a dedicated database identity; never reuse an owner or administrator credential.
Limit the identity to the necessary schema, database, collection, graph, or index.
Start in read-only mode and disable mutating tool groups.
Constrain network egress and ingress to the MCP process and database endpoint.
Keep manual approval enabled for tool calls, especially generated queries.
Set timeouts, row limits, cost limits, and statement restrictions server-side.
Log tool name, sanitized parameters, identity, result size, decision, and error.
Test prompt-injection strings stored inside database rows and documents.
Rotate credentials and delete cached results or local logs according to policy.

Read-only does not make data safe. A read-only role can still expose personal data, secrets, proprietary embeddings, customer documents, or a large export.

What makes Supabase MCP different?

Supabase MCP is a hosted and local development interface for Supabase projects, not merely a generic Postgres query wrapper. Its official documentation lists database, docs, debugging, development, functions, branching, storage, and account-management tool groups.

The current remote URL supports three important restrictions:

https://mcp.supabase.com/mcp?project_ref=YOUR_PROJECT_REF&read_only=true&features=database,docs

project_ref limits access to one project and disables account-level tools.
read_only=true runs queries as a read-only Postgres user and disables mutating tools.
features enables only selected tool groups.

The Supabase MCP documentation recommends a development project, project scoping, read-only mode, feature restriction, branching, and manual review. Those are layered controls, not interchangeable switches.

Graphify already has an exact-product Supabase MCP profile. This hub owns the broader selection and security intent; it does not replace that setup page.

Which PostgreSQL MCP server should you use?

“Postgres MCP” describes several implementations, so identify the repository before installing anything. Graphify’s current exact-product Postgres MCP profile covers crystaldba/postgres-mcp, a server focused on database analysis and performance work with restricted and unrestricted access modes.

Common search variants—including postgres mcp, postgres-mcp, PostgreSQL MCP server, MCP server Postgres, and Postgres MCP Pro—may lead to different packages or old reference implementations. Confirm:

repository owner and package publisher;
whether the server can write or run only read queries;
whether it exposes plans, index advice, health checks, or arbitrary SQL;
which PostgreSQL versions and extensions it supports;
whether credentials appear in process arguments, environment variables, or config files;
how it enforces statement timeouts and result limits.

For a first trial, use a dedicated read-only role on a non-production database. Query plans can still consume resources, so apply database-side timeouts even when writes are blocked.

How do MySQL MCP and SQLite MCP differ from Postgres MCP?

MySQL MCP servers connect to a networked relational database; SQLite MCP servers operate on a database file. Both can expose schema and SQL tools, but their containment problems differ.

What should you check in a MySQL MCP server?

Search results for MySQL MCP, MCP MySQL, and MySQL MCP server include community projects such as benborla29/mcp-server-mysql. Treat the repository name as part of the entity. Check its current maintenance, package provenance, TLS options, allowed statements, and database role before use.

A read-only MySQL user should receive only the necessary schema privileges. Avoid connecting an agent through an application account that can write every production table.

What should you check in a SQLite MCP server?

Search variants such as SQLite MCP, MCP SQLite, and MCP server SQLite may describe a local file tool or a broader database server. Restrict the process to an explicit database path. Prevent arbitrary path selection, symlink escapes, attachment of unrelated databases, unsafe extension loading, and writes outside the workspace.

SQLite is convenient for a disposable local test because a copied file is easy to isolate. That convenience disappears if the MCP process can browse the whole filesystem.

What does the official MongoDB MCP server provide?

The official MongoDB MCP Server connects agents to MongoDB databases and Atlas clusters. MongoDB’s product page and mongodb-js/mongodb-mcp-server repository document database and Atlas access for compatible clients.

MongoDB tasks differ from SQL tasks. An agent may inspect collections and indexes, run aggregation pipelines, sample documents, or manage Atlas resources depending on enabled tools. Restrict the connection string to the intended database, use a dedicated role, and review filters before a query scans or returns large collections.

Searches for MongoDB MCP, MongoDB MCP server, mongodb-mcp-server, MCP MongoDB, and MongoDB Atlas MCP server also surface community servers. Use the canonical vendor project when vendor support matters, and state clearly when a guide describes another implementation.

What can Firebase MCP access?

Firebase MCP can give AI development tools access to Firebase projects, app code, documentation resources, and services such as Cloud Firestore and Firebase Data Connect. The official Firebase MCP documentation is the source of truth for current tools and installation.

The phrases Firebase MCP and Firebase MCP server are broad because Firebase combines database, hosting, authentication, functions, and project configuration. Enable only the product areas needed for the task. A tool that reads Firestore data does not need permission to deploy a function or change hosting configuration.

Firebase Studio warns that an added MCP server can run code and potentially modify an app. Apply the same approval and environment isolation rules used for SQL servers.

When should you choose Neo4j MCP?

Choose Neo4j MCP when the agent must inspect or query nodes, relationships, labels, properties, and paths in a Neo4j graph. The current official neo4j/mcp server supports schema exploration and Cypher queries and provides a NEO4J_READ_ONLY option.

The older neo4j-contrib/mcp-neo4j Labs collection includes components such as mcp-neo4j-cypher. Its README now directs users who want the official product server to neo4j/mcp. That lifecycle distinction matters for searches such as neo4j mcp server, neo4j-mcp, mcp neo4j, mcp server neo4j, and mcp-neo4j-cypher.

Graph queries can traverse far more data than expected. Limit database scope, set query timeouts, cap returned paths, and keep write-capable Cypher disabled until the use case requires it.

Which vector database MCP server should you choose?

A vector database MCP server stores and retrieves items by semantic similarity; it is not a general replacement for a source database. Choose based on the existing vector platform, metadata-filter requirements, embedding pipeline, tenancy model, and delete/update semantics.

Server family	Typical MCP job	Verification question
Qdrant MCP	Store and retrieve snippets or documents with metadata	Are collection, tenant filter, embedding model, and score threshold fixed?
Chroma MCP	Local or application-level semantic memory	Where is persistence stored, and can the process reach other collections?
Pinecone MCP	Managed vector retrieval	Which index and namespace are allowed, and who can upsert or delete?

The official Qdrant MCP repository presents an example that can become a specialized code-search tool. Its tool descriptions are examples and may need customization. Searches for Qdrant MCP and Qdrant MCP server should resolve to that canonical owner when official provenance is required.

For Chroma MCP, Pinecone MCP server, MCP vector database, and MCP server vector database, verify the individual implementation rather than assuming the database vendor maintains it. Vector records may contain untrusted text, so treat retrieved content as data, not instructions.

When do Redis MCP and Elasticsearch MCP fit?

Redis MCP fits state, cache, streams, search, and fast agent-memory patterns; Elasticsearch MCP fits search and analysis over indexed documents. Neither should inherit a production administrator credential just because the server is convenient to configure.

The official Redis MCP repository exposes tools for Redis data structures, streams, JSON, search, and vector operations. Configure ACLs, TLS, key prefixes, expiry rules, and a dedicated logical database or instance. Write access can alter sessions, queues, rate limits, or cache behavior immediately.

Elastic’s elastic/mcp-server-elasticsearch repository now marks that server as deprecated and says it has been superseded by the Elastic Agent Builder MCP endpoint for Elastic 9.2.0+ and Elasticsearch Serverless. Articles targeting Elasticsearch MCP or Elasticsearch MCP server must surface that status instead of recommending a stale deployment as the default.

What is dbt MCP used for?

dbt MCP gives an agent context and tools for dbt Core, dbt Fusion, dbt Platform, product documentation, and supported SQL workflows. It belongs in this hub because analytics context includes models, metrics, lineage, tests, documentation, and warehouse execution—not only a raw database connection.

The official dbt MCP repository documents tools for dbt project and product context. The search variants dbt mcp and dbt-mcp refer to the same core entity, but current capabilities depend on authentication and configured toolsets.

Keep development and production targets explicit. A natural-language request that sounds like analysis can still run expensive SQL or reach sensitive warehouse tables.

How should you evaluate a database MCP server before adoption?

Run a permission-first pilot before measuring answer quality. Use a disposable environment and test both legitimate and adversarial requests.

Record these facts:

Area	Required evidence
Identity	Canonical owner, release, package, license, and signed/container provenance
Transport	stdio or Streamable HTTP endpoint, bind address, TLS, and authentication
Database scope	Account, project, database, schema, collection, graph, index, or namespace
Tool scope	Metadata, read, write, DDL, admin, docs, diagnostics, and shell execution
Query controls	Allowlist, timeout, row/result limit, cost cap, and transaction behavior
Data handling	Prompt path, model/service path, logs, caches, retention, and deletion
Human control	Approval prompts, change preview, rollback, and escalation owner
Operations	Health check, audit log, rate limit, backup, and credential rotation

Test at least one denied write, one overbroad read, one prompt-injection string stored in a row, one expensive query, one secret-like value, and one tool call with an ambiguous target. A safe server should fail clearly and leave a usable audit trail.

Final recommendation

Use a platform-specific official MCP server when it exists and fits the task, but rely on database permissions—not branding—for safety. Supabase, MongoDB, Firebase, Neo4j, Qdrant, Redis, dbt, and Elastic publish current first-party material. PostgreSQL, MySQL, SQLite, Chroma, and Pinecone searches may require more implementation-level provenance checks.

Begin with one development data source, a dedicated read-only identity, a narrow tool set, manual approvals, and hard query limits. Expand authority only after the team can explain why each additional tool is necessary and how to reverse its effects.

Frequently asked questions

What is an MCP database server?

An MCP database server is a program that exposes database context or operations to an MCP-compatible AI client through declared tools and resources. It translates model requests into controlled database-specific actions.

Is Supabase MCP the same as Postgres MCP?

No. Supabase MCP includes Supabase platform and project tools in addition to database operations. A generic Postgres MCP server connects directly to PostgreSQL and exposes the operations implemented by that specific project.

Can a database MCP server be read-only?

Yes, if both the MCP tool set and the database identity enforce read-only access. Use both layers. A prompt or client setting alone is not sufficient.

Is a vector database MCP server safe from prompt injection?

No. Retrieved vector records can contain adversarial or irrelevant instructions. Treat retrieved text as untrusted data, constrain follow-up actions, and require confirmation for sensitive tools.

Which database MCP server is best for local testing?

A SQLite MCP server connected to a copied database file can be simple to isolate. A local Supabase development stack or disposable Postgres container is better when the application depends on Postgres behavior.

Should I connect an MCP server to production?

Avoid production for exploration and setup. If a production read is unavoidable, use a dedicated role, narrow database scope, manual approvals, hard limits, monitoring, and an incident owner.

Primary sources

Research checked July 14, 2026. Database MCP projects change quickly; verify the current official source, release, and permission model before installation.