Atlas reads real Postgres schemas, indexes, and EXPLAIN ANALYZE output through Postgres MCP Pro, so the migrations and queries it writes match the database rather than a guess. Add it with atlas mcp add postgres --env DATABASE_URI=$DATABASE_URI -- uvx postgres-mcp --access-mode=restricted. Do not use the archived @modelcontextprotocol/server-postgres, which is deprecated and carries an unpatched SQL injection issue.
Do not use the deprecated Postgres MCP server
The archived @modelcontextprotocol/server-postgres is deprecated and carries an unpatched SQL injection issue, so in 2026 use Postgres MCP Pro instead. This is the first decision to get right when connecting Atlas to PostgreSQL, because the deprecated package still appears in older setup guides.
Search results age badly, and @modelcontextprotocol/server-postgres has enough history behind it that it still shows up in tutorials. It is archived, it is deprecated, and the SQL injection issue in it was never patched. Pointing an AI coding agent at a database through a server with an unpatched injection flaw is not a risk worth taking for the convenience of an npm package. Postgres MCP Pro is the maintained replacement, it is what Atlas should be pointed at, and switching is a one-line change to the command Atlas runs.
Adding Postgres MCP Pro to Atlas
Connect Atlas to PostgreSQL in 2026 with atlas mcp add postgres --env DATABASE_URI=$DATABASE_URI -- uvx postgres-mcp --access-mode=restricted. The DATABASE_URI environment variable holds the connection string, uvx runs Postgres MCP Pro without a permanent install, and --access-mode=restricted keeps the server read-only.
Postgres MCP Pro is distributed as postgres-mcp and runs cleanly under uvx, so there is nothing to install permanently. DATABASE_URI is passed as an environment variable rather than an argument, which keeps the connection string, including its password, out of the process argument list where any user on the machine could read it. The --access-mode=restricted flag should be considered part of the default command, not an optional extra. Add it every time, and remove it only under the specific condition described in the next section.
What --access-mode=restricted actually protects
--access-mode=restricted keeps Postgres MCP Pro read-only, which means Atlas can inspect the schema and run EXPLAIN ANALYZE but cannot write. Switch to unrestricted only against a scratch database you can drop. In 2026 this is the single most important flag in the Atlas and PostgreSQL setup.
Read-only is the correct default because reading is where almost all of the value is. Atlas needs the real schema, the real index list, and the real EXPLAIN ANALYZE output. None of that requires write access. Writes, when they are needed, should go through a migration file you have reviewed, not through the agent issuing DDL live. Unrestricted mode exists for the case where you are deliberately iterating against a scratch database that you can drop and recreate. If the database has data you care about, restricted is the mode.
Other ways to run Postgres MCP Pro
Postgres MCP Pro ships 3 ways in 2026: under uvx, as the crystaldba/postgres-mcp Docker image, and over --transport=sse for remote setups. Atlas can therefore reach PostgreSQL from a container runtime instead of uvx, or over SSE when the database is not on your machine.
The uvx path is the fastest to try, but it assumes a Python runner on the machine. The crystaldba/postgres-mcp Docker image drops that assumption, which matters on a build agent or a locked-down workstation where you would rather pin and scan a container image than install a Python tool. For remote setups, --transport=sse lets Postgres MCP Pro run somewhere else, closer to the database, while Atlas connects to it over the network. The tool surface Atlas sees is the same in all three cases, and --access-mode=restricted applies to all three.
The daily workflow: EXPLAIN ANALYZE before any suggestion
The Atlas and PostgreSQL workflow in 2026 starts with evidence. Ask Atlas to EXPLAIN ANALYZE the slow query and read the real index list before it proposes anything. Postgres MCP Pro supplies both, so the index Atlas recommends is informed by the plan the planner actually chose.
Index advice given without a query plan is astrology. The planner might be doing a sequential scan because the index does not exist, or because the index exists and the planner correctly decided not to use it, and those two situations call for opposite fixes. Atlas reads the EXPLAIN ANALYZE output through Postgres MCP Pro, sees which node is expensive and why, and reads the real index list to know what already exists. Only then does it propose. When the proposal is a schema change, Atlas writes the migration file, and you approve psql -f through its bash tool when it is ready to apply.
Using Atlas with PostgreSQL and no MCP server at all
If you would rather add no server at all, let Atlas drive psql directly and keep permission.bash set to ask. Atlas has a bash tool, psql is already on your machine, and in 2026 this is a legitimate zero-install path to PostgreSQL work with no MCP configuration whatsoever.
Some teams do not want another process holding a database connection, and that is a reasonable position. Atlas can shell out to psql, which you already trust, and read the output. The safeguard is permission.bash set to ask, which means every psql invocation stops for your approval before it runs. You give up the structured tooling that Postgres MCP Pro provides, and you keep full visibility into every statement Atlas wants to execute. For a team that mostly needs schema reads and migration review, the trade is often worth it.
Setup
- 01Do not use the archived @modelcontextprotocol/server-postgres. It is deprecated and carries an unpatched SQL injection issue.
- 02Add Postgres MCP Pro instead: atlas mcp add postgres --env DATABASE_URI=$DATABASE_URI -- uvx postgres-mcp --access-mode=restricted
- 03Keep --access-mode=restricted so the server stays read-only, and switch to unrestricted only against a scratch database you can drop.
- 04If you prefer a container or a remote setup, use the crystaldba/postgres-mcp Docker image, which supports --transport=sse.
- 05Ask Atlas to EXPLAIN ANALYZE the slow query and read the real index list before it proposes anything.
- 06Let Atlas write the migration file, then approve psql -f through its bash tool when it is ready to apply.
- 07To add no server at all, let Atlas drive psql directly and keep permission.bash set to ask.
Frequently asked questions
- how to connect atlas to postgres
- Run atlas mcp add postgres --env DATABASE_URI=$DATABASE_URI -- uvx postgres-mcp --access-mode=restricted. That is Postgres MCP Pro in read-only mode.
- is @modelcontextprotocol/server-postgres safe to use
- No. The archived @modelcontextprotocol/server-postgres is deprecated and carries an unpatched SQL injection issue. Use Postgres MCP Pro instead.
- how do i make the postgres mcp server read only
- Pass --access-mode=restricted. It keeps the server read-only. Switch to unrestricted only against a scratch database you can drop.
- can atlas run explain analyze on a slow query
- Yes. Ask Atlas to EXPLAIN ANALYZE the slow query and read the real index list before it proposes anything, so the advice matches the plan the planner chose.
- how do i run postgres mcp pro in docker
- Use the crystaldba/postgres-mcp Docker image. It ships the same server and supports --transport=sse for remote setups.
- can i use atlas with postgres without an mcp server
- Yes. Let Atlas drive psql directly and keep permission.bash set to ask, so every statement stops for approval before it runs.
- will atlas apply a postgres migration on its own
- No. Atlas writes the migration file, and you approve psql -f through its bash tool when it is ready to apply.
Try Atlas in your terminal
The terminal-native AI coding agent. Free core, single binary.
Install AtlasRelated guides
Atlas with Llama 4 Maverick: 1M Context on Open Weights in 2026
Llama 4 Maverick gives Atlas a 1M token context on open weights at $0.24 / $0.97 per Mtok on Bedrock or $0.20 / $0.80 on DeepInfra. Setup, tradeoffs, and fit.
Atlas with Devstral Small 2505: The Original Agent-First Model in 2026
Devstral Small 2505 started Mistral's Devstral line in May 2025: 128,000 tokens at $0.10 / 1M input tokens. Atlas setup, why it was superseded, and when to pin it.
Atlas for Assembly: Registers, Calling Conventions, and nasm in 2026
Atlas is a terminal-native AI coding agent for Assembly in 2026. It reads .asm and .S sources, tracks System V and AAPCS64 calling conventions, and assembles with nasm behind a prompt.
Atlas vs Base44: Terminal AI Coding Agents in 2026
Compare Atlas, the terminal-native AI coding agent, with Base44, the Wix-owned no-code app builder, for developers in 2026. Evaluate features, pricing, and workflow.
Atlas for Bash in 2026
Atlas is a terminal-native AI coding agent for Bash in 2026, with shellcheck-aware suggestions. Harden a script or fix shellcheck warnings and review every diff.
Atlas with GLM-4.5-Air: The 106B Self-Hostable Cheap Slot in 2026
GLM-4.5-Air drives Atlas at $0.20 per Mtok input and $1.10 per Mtok output on a 128K tokens (131,072) window. A 106B total / 12B active MIT-licensed MoE.
Atlas for Godot: Terminal-Native AI Coding for GDScript and the Node Tree in 2026
Atlas is a terminal-native AI coding agent for Godot in 2026, working across GDScript, the node tree, and signals, where scene structure is half the program.
Atlas vs Windsurf: Terminal AI Coding Agents in 2026
Atlas and Windsurf offer distinct AI coding experiences in 2026. Atlas provides a terminal-native TUI with permission-gated tools, while Windsurf features an in-editor live preview and a dedicated GUI.