MCP · Databases and backend · Neon
Neon MCP Server
Manage Neon Postgres projects and branches and run SQL from an AI host, with documented read-only and project-scoped modes.
Not meant for production databases. Neon's documentation says the MCP server is for development and testing and advises never connecting agents to production databases.
Understand the tool
What it does.
Neon's hosted MCP server exposes project, branch, schema, query and migration tools for Neon serverless Postgres. URL parameters can limit it to read-only operations, one project, selected tool categories or a specific Postgres role.
Why use it?
Use it to explore schemas, test queries on a branch or review a migration plan without leaving the conversation. Start with read-only mode, and keep production data out of the connection as Neon advises.
A useful fit for
- Schema exploration on a development branch
- Query drafting and explain plans
- Branch-based migration review
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Explore an unfamiliar schema
A developer joins a project and needs a map of its tables.
- Connect with ?readonly=true and a single projectId.
- List tables and columns for one branch.
- Summarize relationships and open questions.
Intended outputA schema summary produced without any write tools enabled.
Use case 02
Check why a branch is slow
A preview branch responds slowly.
- Connect read-only to the branch's project.
- Run the documented database inspection checks.
- List the largest tables, unused indexes and long-running queries.
Intended outputA dated list of likely causes to verify before changing anything.
A concrete starting point
Illustrative prompt: read-only schema map
Read-only mode and a project-scoped URL keep the request inside one project and disable write tools.
Using the Neon MCP server connected in read-only mode to one development project, list the tables and columns on the main development branch, describe the relationships you can see from foreign keys and note anything that looks unused. Do not run migrations or create branches.What this can change
Schema details and query results enter the AI host and its model provider. Queries consume compute on the branch.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- A Neon account and project.
- An MCP client that supports remote servers with OAuth, or a Neon API key sent as a bearer header for headless setups.
- Optional URL parameters (readonly, projectId, category, roleName) chosen before connecting.
- Authentication
- OAuth through Neon, or a Neon API key as a static bearer token.
- Can read
- Projects, branches, schemas and SQL query results the connection can see
- Can write or change
- Project and branch creation, migrations and SQL writes unless read-only mode is set
- Neon Auth and Data API configuration when those categories are enabled
- Network and data flow
- Neon services
- AI host/model provider
- Approval and control
- Neon documents read-only mode and project scoping as server-side limits; it also advises reviewing and authorizing every action an agent requests.
Check your environment
Compatibility, costs and license.
Compatibility notes
- Remote MCP clients with OAuth
- Clients that send a bearer header for API-key access
- Read-only mode can also be chosen during OAuth authorization
Costs and account requirements
Neon plan limits and compute usage apply to work done through the server.
Current pricing or plan information ↗Hosted service terms
No public source license for Neon's hosted implementation is asserted. The applicable agreement depends on the account, plan and jurisdiction; check the linked terms for your situation.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
Not meant for production databases
Neon's documentation says the MCP server is for development and testing and advises never connecting agents to production databases.
Default SQL role is the database owner
Without roleName, SQL tools connect as the database owner. Set a restricted Postgres role so its grants limit what the agent can change.
Where it may fall short
- The remote endpoint was checked only up to its authentication challenge.
- Write tools are on by default unless read-only mode or category limits are set.
Observed behavior · 2026-10-18
Runtime and security findings.
The hosted endpoint rejected credential-free initialization and pointed to public OAuth metadata, which listed no scopes and linked Neon's documentation.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Documented concern · medium severity under stated conditions
Read-only is a choice you make, not the default
All tools are available by default; read-only and category limits only apply when set in the URL or chosen during OAuth.
In practice: Add ?readonly=true and a projectId to the URL before your first connection.
Observed in this evaluation
Metadata advertises no scopes
The resource metadata listed no scopes and pointed to Neon's documentation instead.
In practice: Rely on the documented URL parameters and OAuth choices to limit access, and confirm the active tools after connecting.
Version, environment and fixture
- Version or deployment
- Remote deployment version not disclosed by the observed responses
- Tested target
- https://mcp.neon.tech/mcp
- Artifact identity
- HTTPS certificate verification enabled. Public resource-metadata body SHA-256: 725ab81ac417f0fd607952de27c4ebb7124e73eede45ef56ee26085c4660e4a3. This fingerprints the observed metadata, not the deployed server implementation.
- Environment and fixture
- Debian Linux x86_64 (kernel 6.12) evaluation box; Python 3.13.5 urllib; OpenSSL 3.5.7.
- No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.
- Observed 2026-10-19T05:52:11.793654+00:00 through 2026-10-19T05:52:12.107531+00:00 UTC.
- One request per listed check; 20-second timeout and 64-KiB response cap. Raw timestamps are UTC; review date October 18, 2026.
Checks and results
2 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Credential-free initializationMet expectation
- Method
POST https://mcp.neon.tech/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"IonBin-account-free-evaluation","version":"1.0.0"}}}- Expected
- Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.
- Observed
- HTTP 401 at 2026-10-19T05:52:11.793654+00:00. WWW-Authenticate: Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://mcp.neon.tech/.well-known/oauth-protected-resource/mcp". Body: {"error":"invalid_token","error_description":"No authorization provided"}
Public authentication discoveryMet expectation
- Method
GET https://mcp.neon.tech/.well-known/oauth-protected-resource/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.- Expected
- Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.
- Observed
- HTTP 200 at 2026-10-19T05:52:12.107531+00:00; Content-Type: application/json. Resource: https://mcp.neon.tech/mcp. No scopes listed. Authorization server: https://mcp.neon.tech. Bearer methods: header.
Practical caveats
- Neon's documentation describes the server for development and testing only.
- SQL tools connect as the database owner unless roleName is set.
What this evaluation does not establish
- OAuth consent, API-key access, read-only enforcement, project scoping and role pinning.
- Tool lists, SQL execution, migrations, branch creation and prompt-injection resistance.
- These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
First-party and unusually well-scoped: read-only, project, category and role limits are all documented. Neon's own advice to avoid production data narrows where it fits.
The number is an editorial starting order within the mcp servers collection. It does not measure popularity, speed, reliability or safety.
What we reviewed
- Remote endpoint and authentication discovery
- Documented scope controls
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Official Neon MCP server guide ↗neon.com
- Neon platform terms ↗neon.com
- Neon pricing ↗neon.com