// INTEGRATION_GUIDE

Secure PostgreSQL MCP Server — RBAC & Query Filtering

Secure your PostgreSQL MCP server with fine-grained RBAC, read-only table filtering, SQL injection blocking, and immutable compliance audit logs.

VNet-integrated Isolation Mode ActiveProduction databases integrated using private network subnet scopes block all public DNS lookup routes automatically. All tool requests pass securely via the virtual network proxy gateway.

1Initialize standard PostgreSQL MCP Server

Ensure your standard Postgres database connector is running locally or as a cloud process. Standard startup config looks like:

docker run -d --name mcp-postgres-connector \ -e POSTGRES_URL="postgresql://user:pass@host:5432/db" \ modelcontextprotocol/server-postgres

2Register Server inside MakeYourMCP Console

Log in to the MakeYourMCP Dashboard, navigate to the MCP Servers panel, and register a new server:

  • Server Name: postgres-production-db
  • Server URL: Point to your internal container FQDN address.

3Define Policy Rules

Navigate to Policies and create an access control rule set. Policies allow or deny MCP tool calls by tool name using glob patterns (fnmatch). Below is an example policy restricting access for the finance_agent:

{ "name": "finance-agent-policy", "default_action": "deny", "rules": { "allow": [ "read_*", "query_*", "list_transactions" ], "deny": [ "delete_*", "drop_*", "write_*" ] } }

This policy blocks destructive operations (delete_*, write_*) while allowing read-only queries. Deny rules always take precedence over allow rules.

4Invoke Tools Through the Gateway

When your agent needs to call a PostgreSQL tool, send a JSON-RPC request to the gateway endpoint with the X-API-Key header. All tool calls are validated against your policy before execution:

curl -X POST https://gateway.makeyourmcp.com/v1/gateway/{agent-uuid}/mcp \ -H "X-API-Key: mcpg_prod_xxxxxxxxxxxxx" \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "read_transactions", "arguments": {"account_id": "ACC-09"} } }'

Replace https://gateway.makeyourmcp.com with your gateway URL. The gateway applies your policy, validates the tool call, and returns the result.

Secured Capabilities

  • Auto-intercepts destructive database writes.
  • Discards SQL commands embedded in query arguments.
  • Emits immutable compliance logs to the audit server database.
Get Early Access
Get Early Access