Provides AI agents with direct access to PostgreSQL databases for querying, schema inspection, and data manipulation. High risk when connected to production databases.
Security Rating
79 / 100
Vendor Type
Official (Anthropic)
Risk Category
High Risk
Exposed Tools & Function Calls
- query
- get_schema
- describe_table
- execute_sql
Required Permission Scopes
- pg:read
- pg:write (if enabled)
- pg:schema:read
Vulnerability & Risk Analysis
SQL injection via LLM hallucination (Critical)
LLM-generated SQL queries may contain injection payloads if the prompt is influenced by untrusted user input, bypassing application-level sanitization.
Fix: Use read-only database users. Validate all LLM-generated SQL before execution. Never connect agents to production databases with write access.
Full database exposure (High)
A single connection string grants access to all tables the database user can see, far exceeding what most agent tasks require.
Fix: Create dedicated read-only database users with row-level security policies. Grant access only to specific schemas needed by the agent.
Credentials in context window (Medium)
Database connection strings containing credentials may be reflected into the LLM context window, risking exposure via prompt injection or logging.
Fix: Store credentials as environment variables. Never pass connection strings through user-visible prompts. Enable PII redaction on all logs.