Mmcp.market

PostgreSQL CVE & Release Intelligence MCP server

by meob·io.github.meob/pg-cve-mcp·v1.0.4
No reviews yet

PostgreSQL security for AI agents: CVEs, yanked releases, exploits, and upgrade paths

A88/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A88/100

full report

Adoption
New

0 stars15 downloads/wk

Reviews

Write one

Nobody has reviewed PostgreSQL CVE & Release Intelligence yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

PostgreSQL CVE & Release Intelligence tools (5)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • compare_versions

    Compare the CVE profiles of two PostgreSQL versions side by side.

  • get_cves

    Get the complete security report for a PostgreSQL version.

  • get_exploits

    List all CVEs with known public exploits, sorted by CVSS score.

  • get_summary

    Get an overview of the tracked PostgreSQL CVE database.

  • get_upgrade_path

    Suggest the recommended upgrade target for a PostgreSQL version.

Public scan report

scanner v0.1.9 · 2026-09-23 · same rubric, same numbers if you re-run it

no findings
  • Code scan7 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 36 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 88/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

What the publisher says

From the PostgreSQL CVE & Release Intelligence repository's README, as published. We do not edit it. Read it on GitHub

pg-cve-mcp — PostgreSQL CVE & Release Intelligence for AI Agents

<!-- mcp-name: io.github.meob/pg-cve-mcp -->

Give your AI assistant direct access to PostgreSQL security intelligence: CVEs, yanked releases, known exploits, and upgrade paths for any version — queried, not browsed.

Why pg-cve-mcp?

Browsing a CVE dashboard is a human habit. Agents need answers, not pages.

pg-cve-mcp turns the curated dataset of the PGCVE** project — the same one powering the PostgreSQL CVE Dashboard — into MCP tools that any AI assistant (opencode, Claude Desktop, etc.) can call directly. What was a static page becomes a first-class, programmatic part of your AI workflow.

Unlike raw NVD feeds, the PGCVE dataset is manually curated** to carry the same judgment a careful DBA would apply:

  • Yanked releases flagged with the real reason (e.g. "Data corruption using CONCURRENTLY")
  • Known exploits confirmed to exist in the wild
  • EOL branches marked, with a synthetic CVE-EOL-WARNING (CVSS 10.0) prepended to unsupported reports
  • Verified CVEs — no false positives from automated scraping

What your agent can now do

Agent-first design

Every tool returns structured JSON, sorted by CVSS (highest first). Tools flag yanked and EOL state explicitly on the version metadata, and include release dates for every version. getupgradepath distinguishes a safe minor upgrade from a forced major one when a branch is at or near end-of-life — so the agent can give advice, not just data.

See real tool outputs in the live demo.

Quick Start

pip install pg-cve-mcp
pg-cve-mcp

Or with npx (no install):

npx -y pg-cve-mcp

MCP Tools

Transports

stdio (default)

Run locally over stdio for opencode, Claude Desktop, and other stdio MCP clients:

pip install -e .
pg-cve-mcp

Streamable HTTP (self-hosted)

For remote or enterprise deployments, serve the same tools over HTTP. Run python run_server.py (or build the Dockerfile); the server listens on $PORT (default 8000) at path /mcp:

python run_server.py
# MCP endpoint: http://127.0.0.1:8000/mcp

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Install directly

claude mcp add pg-cve-mcp -- uvx pg-cve-mcp
Add to Cursor

PostgreSQL CVE & Release Intelligence: common questions

Is PostgreSQL CVE & Release Intelligence MCP server safe?
Yes, by our scan: it is graded A (88/100). Read the PostgreSQL CVE & Release Intelligence safety report
How do I install PostgreSQL CVE & Release Intelligence?
It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does PostgreSQL CVE & Release Intelligence need an API key?
No secret keys are declared. It reads 2 settings from the environment.
Is PostgreSQL CVE & Release Intelligence maintained?
The last commit was 36 days ago (2026-08-17). The latest release is v1.0.4.
What can I use instead of PostgreSQL CVE & Release Intelligence?
Servers from other publishers that do the same job: 4da MCP server, VulnCheck MCP server and npm Registry MCP Server. Compare all PostgreSQL CVE & Release Intelligence alternatives.

Alternatives to PostgreSQL CVE & Release Intelligence

Same job from other publishers: the closest match first, then the best rated.

All PostgreSQL CVE & Release Intelligence alternatives →
  • 4da
    Dependency intelligence for AI agents. CVE scanning, health checks, upgrade planning.
    A
  • VulnCheck
    VulnCheck exploit intelligence — CVE research, exploit data, advisories, and threat analysis.
    A
  • npm Registry MCP Server
    npm registry MCP server — package intelligence, security audits, dependency analysis
    More from YawLabs →
    B
  • Feedmyagent
    Technology intelligence feed for AI agents: tech stack, compliance, security.
    A
  • Presend MCP Server
    Free MCP server: 36 security & dev API tools -- WHOIS, DNS, CVE, IP reputation, Cosmos SDK.
    B
PostgreSQL CVE & Release Intelligence vs 4daPostgreSQL CVE & Release Intelligence vs VulnCheckPostgreSQL CVE & Release Intelligence vs npm Registry MCP Server

More from meob →