← Back to search

@zlash65/postgresql-ssh-mcp

zlash65 Scanned 6d ago

PostgreSQL MCP Server with built-in SSH tunneling for secure database access through bastion hosts

npm ↗
D
40 / 100

Versions

1.2.1latest
Dec 28, 2025
1.2.0
Dec 26, 2025
1.1.0
Dec 25, 2025
1.0.0
Dec 25, 2025
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 12

list_schemas
annotations: none low

List schemas (excludes system schemas by default).

list_tables
annotations: none low

List tables in a schema with estimated row counts and sizes.

describe_table
annotations: none low

Describe a table (columns, constraints, indexes).

table string
list_databases
annotations: none low

List databases with owner, encoding, and size.

get_connection_status
annotations: none low

Get connection status, pool stats, and tunnel state.

list_active_connections
annotations: none low

List active connections from pg_stat_activity.

list_long_running_queries
annotations: none low

List queries running longer than a threshold.

get_database_version
annotations: none low

Get PostgreSQL server version.

get_database_size
annotations: none low

Get database size and largest tables.

get_table_stats
annotations: none low

Get table statistics (rows, vacuum/analyze, scan counts).

table string
execute_query
annotations: none low

Execute SQL with optional parameters. Results are capped by MAX_ROWS and include a truncated flag.

sql string
explain_query
annotations: none low

Return an EXPLAIN plan for a query. ANALYZE executes the query.

sql string

Permissions 2

filesystem low
Server uses filesystem capabilities via: fs sync ops, fs.promises
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 45

low
Tool 'list_schemas' has no annotations annotation_checker · 100%
low
Tool 'list_tables' has no annotations annotation_checker · 100%
low
Tool 'describe_table' has no annotations annotation_checker · 100%
low
Tool 'list_databases' has no annotations annotation_checker · 100%
low
Tool 'get_connection_status' has no annotations annotation_checker · 100%
low
Tool 'list_active_connections' has no annotations annotation_checker · 100%
low
Tool 'list_long_running_queries' has no annotations annotation_checker · 100%
low
Tool 'get_database_version' has no annotations annotation_checker · 100%
low
Tool 'get_database_size' has no annotations annotation_checker · 100%
low
Tool 'get_table_stats' has no annotations annotation_checker · 100%
low
Tool 'execute_query' has no annotations annotation_checker · 100%
low
Tool 'explain_query' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.25.1 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.25.1 (GHSA-6qxp-vccf-f47h) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.25.1 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@2.1.8 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@2.1.8 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@2.1.8 (GHSA-9crc-q9x8-hgqq) dependency_analyzer · 95%
medium
Buffer.from base64 in Zlash65-postgresql-ssh-mcp-2a350d4/src/connection/host-key-verifier.ts:92 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: list_schemas manifest_parser · 85%
info
Tool: list_tables manifest_parser · 85%
info
Tool: describe_table manifest_parser · 85%
info
Tool: list_databases manifest_parser · 85%
info
Tool: get_connection_status manifest_parser · 85%
info
Tool: list_active_connections manifest_parser · 85%
info
Tool: list_long_running_queries manifest_parser · 85%
info
Tool: get_database_version manifest_parser · 85%
info
Tool: get_database_size manifest_parser · 85%
info
Tool: get_table_stats manifest_parser · 85%
info
Tool: execute_query manifest_parser · 85%
info
Tool: explain_query manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (38) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
low
Permission: filesystem access detected permission_analyzer · 90%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 789 components sbom_generator · 100%
critical
Database URL with Password found in Zlash65-postgresql-ssh-mcp-2a350d4/README.md secret_scanner · 85%
critical
Database URL with Password found in Zlash65-postgresql-ssh-mcp-2a350d4/docs/server-setup.md secret_scanner · 85%
critical
Database URL with Password found in Zlash65-postgresql-ssh-mcp-2a350d4/docs/streamable-http.md secret_scanner · 85%
critical
Database URL with Password found in Zlash65-postgresql-ssh-mcp-2a350d4/docs/stdio-setup.md secret_scanner · 85%
critical
Database URL with Password found in Zlash65-postgresql-ssh-mcp-2a350d4/.github/workflows/pr-checks.yml secret_scanner · 85%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%