Agentic Data Plane
Preview

SQL Managed MCP Server

The SQL managed MCP server gives agents read and write access to a PostgreSQL database through MCP. Redpanda runs the server in-process, and you provide a connection string. Guardrails can turn off the write tool, and a database user with read-only privileges keeps every query read-only.

After reading this page, you will be able to:

  • Configure the SQL managed MCP server for your database

  • Run a canonical SELECT query through the Inspector

  • Set the PostgreSQL driver and connection string for your database

What this MCP server does

The SQL managed type connects to PostgreSQL databases. Set the driver to postgres or pgx.

It exposes the following tools:

  • query: Run a statement and return rows, typically a SELECT. Accepts positional parameters and an optional max-rows cap.

  • execute: Run a write statement (INSERT, UPDATE, DELETE, or DDL) and return the affected row count.

Guardrails on the server config can limit it. Set readonly to disable execute, cap returned rows, block statement patterns, and set a per-query timeout.

The readonly guardrail disables the execute tool, but the query tool doesn’t parse statements. A write that returns rows, such as DELETE …​ RETURNING, still runs through query. To guarantee read-only access, connect with a database user that has only read privileges.

Prerequisites

  • A PostgreSQL database reachable from the Agentic Data Plane.

  • A connection string (DSN) for the database, including the credentials, stored as a secret in the secret store. Give the secret an UPPER_SNAKE_CASE name, for example ORDERS_DB_DSN. The DSN field selects a stored secret rather than accepting the string directly.

Configure

  1. Open MCP servers in the sidebar.

  2. Click Add MCP server.

  3. Click the SQL card in the marketplace picker.

  4. Replace the suggested Name, and optionally add a Description.

  5. Leave Enable code mode off. It’s off by default for database types.

  6. In the SQL configuration form, provide:

    • Driver: postgres or pgx. The dropdown lists other drivers, but they can’t connect.

    • DSN: Select the secret that holds the driver-specific connection string.

    • Connection Pool (optional): Maximum open and idle connections, and connection lifetimes.

    • Guardrails (optional): readonly (disables execute), default and maximum row caps, a per-query timeout, and blocked statement patterns. The form also shows an allowed schemas setting, which the server doesn’t enforce. To limit schemas, grant the database user access to only those schemas.

    • Row Format (optional): How the query tool encodes result rows. Leave it unset (or select Positional) for the default, or select Object to key each row by column name. See Choose a row format.

  7. Click Create server.

Test

After create, exercise the server through the Inspector tab. See Test an MCP Server’s Tools with the Inspector.

A canonical first call:

  1. Open the Inspector tab.

  2. In Tools, click the query tool.

  3. Run SELECT 1 (or your driver’s equivalent). Confirm a single-row response.

  4. To list tables, run query against the catalog, for example SELECT table_name FROM information_schema.tables.

Choose a row format

The query tool can encode result rows in two ways, controlled by the server’s Row Format setting:

  • Positional (the default): Each row is an array of values addressed by column position. This is the denser encoding.

  • Object (ROW_FORMAT_OBJECT): Each row is a JSON object keyed by column name.

Choose the Object format when you want an data policy to mask, redact, or filter individual columns. A data policy selects fields by name, so with named objects it can target a single named column, for example a salary column, and leave the rest readable. With positional rows a policy can act only on the whole row, because there are no column names to select. The two encodings are mutually exclusive: the server returns one or the other, never both.

Authentication

The SQL managed type has no MCP-level authentication modes. Credentials are carried inside the DSN (connection string), which you store as a secret. Supply them in the PostgreSQL connection-string format, for example postgres://user:password@host:5432/dbname.

User-delegated OAuth and service-account OAuth are not supported for SQL, because there’s no per-user identity model that maps to a database connection.

Use with agents

After the SQL server is created, point an agent at the Server URL on the server’s Connection tab. The agent sees the SQL tools alongside any other MCP servers it has access to.

To attach the server to a managed agent, add it in the agent’s Tools section. See Tools.

Troubleshooting

Symptom What to check

connection refused from create

Database isn’t reachable from Agentic Data Plane. Confirm host, port, and any egress / firewall rules.

authentication failed for user

The DSN field points at the wrong secret, or the connection string in the secret is wrong. Re-create the secret with an UPPER_SNAKE_CASE name and verify it.

does not yet support driver error from create

The selected driver can’t connect from Agentic Data Plane. Set the driver to postgres or pgx.

Query timeout

Long-running queries exceed the configured timeout. Either tighten the query or raise the timeout on the server config.

Limitations

  • Write access: The execute tool runs writes and DDL unless readonly is set in the guardrails. The query tool can still run statements that write and return rows, so scope the database user’s permissions to what the agent needs.

  • Schema restriction: The allowed schemas guardrail isn’t enforced. Restrict schemas through the database user’s grants.

  • Per-user database identities: See Authentication.