Neon MCP Server: Tools, Setup and Security

The Neon MCP server lets an AI app manage your Neon Postgres projects in plain language. It can create projects and branches, run SQL, and run schema migrations on a temporary branch first. Neon publishes it as open source and hosts it at mcp.neon.tech.

Checked against: Neon MCP Server README on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

The README groups tools by category. Highlights:

• Projects: list_projects, describe_project, create_project, delete_project, list_organizations.
• Branches: list_branches, create_branch, delete_branch, describe_branch, reset_from_parent.
• SQL: get_connection_string, run_sql, run_sql_transaction, get_database_tables, describe_table_schema.
• Migrations: prepare_database_migration creates a temporary branch to test a change. complete_database_migration then applies it to the main branch.
• Performance: list_slow_queries, explain_sql_statement, inspect_database, prepare_query_tuning, complete_query_tuning.
• Other categories: compute endpoints, snapshots, Neon Auth, Data API, observability, docs, functions, storage and realtime.

You can preview which tools a given URL exposes without signing in:

curl "https://mcp.neon.tech/api/list-tools?readonly=true&category=querying"

How to connect it

Neon's MCP overview now leads with a quick setup command that installs the server into your coding agents and asks where to write the config:

npx neon@latest mcp

Neon's setup guides also use npx neon@latest init, which signs you in, creates an API key and configures Cursor, VS Code or Claude Code along with other agent tooling.

For OAuth with no local install, Neon gives this command:

npx add-mcp "https://mcp.neon.tech/mcp?category=projects&category=branches&category=endpoints&category=querying&category=schema"

Or add the server to your client's config file:

{
  "mcpServers": {
    "Neon": {
      "type": "http",
      "url": "https://mcp.neon.tech/mcp?category=projects&category=branches&category=endpoints&category=querying&category=schema"
    }
  }
}

A browser window then asks you to authorize the client. With OAuth, the server works on your personal account by default. Neon's sources differ on organizations. The README says to include the org_id or project_id in your prompt, while Neon's Claude Code guide says you "must authenticate with an API key" to connect to an organization's account.

For remote agents without OAuth, add "headers": {"Authorization": "Bearer <$NEON_API_KEY>"}. Neon suggests an organization API key to limit access to that organization. If you use IP Allow, Neon lists two static IPs to allow.

Security notes

Neon puts a warning at the top of its README. It says to "always review and authorize actions requested by the LLM before execution." It also says the server "can execute powerful operations that may lead to accidental or unauthorized changes." Neon's MCP server guide is blunter. It recommends MCP "for development and testing only" and says: "Never connect MCP agents to production databases."

Neon gives you more access controls than most database servers:

Some details matter. In read-only mode run_sql_transaction and get_connection_string are withheld. Neon withholds the connection string because it carries a privileged role password.

With OAuth, these URL options become a fixed grant at sign-in. Changing the URL later does not widen the token; you must authorize again. With an API key, the options apply on every request. Neon warns that anyone who can edit that URL and holds the key can change the role, so keep it out of the agent's reach.

roleName limits SQL only. Management tools still act with your key or token. Neon suggests combining it with readonly=true and category. For a read-only agent, grant the role SELECT on the tables it needs and nothing more. That is least privilege in practice. See also excessive permissions in MCP and the MCP security hub.

Alternatives

• Supabase MCP Server: hosted Postgres plus Edge Functions, with read_only and project scoping.
• PlanetScale MCP Server: Postgres and Vitess, with separate read and write query tools.
• Prisma MCP Server: manages Prisma Postgres databases.

More profiles live in the MCP server directory.

Next step

If you want an AI agent to query Neon in production despite Neon's warning, set up a read-only role and a project-scoped URL first. Our MCP development team can design that setup, or start with the MCP readiness audit.

Frequently asked questions