# Using Atlas with PostgreSQL in 2026 > The archived @modelcontextprotocol/server-postgres is deprecated and carries an unpatched SQL injection issue, so use Postgres MCP Pro instead. Atlas reads real Postgres schemas, indexes, and EXPLAIN ANALYZE output through Postgres MCP Pro, so the migrations and queries it writes match the database rather than a guess. Add it with atlas mcp add postgres --env DATABASE_URI=$DATABASE_URI -- uvx postgres-mcp --access-mode=restricted. Do not use the archived @modelcontextprotocol/server-postgres, which is deprecated and carries an unpatched SQL injection issue. ## Do not use the deprecated Postgres MCP server The archived @modelcontextprotocol/server-postgres is deprecated and carries an unpatched SQL injection issue, so in 2026 use Postgres MCP Pro instead. This is the first decision to get right when connecting Atlas to PostgreSQL, because the deprecated package still appears in older setup guides. Search results age badly, and @modelcontextprotocol/server-postgres has enough history behind it that it still shows up in tutorials. It is archived, it is deprecated, and the SQL injection issue in it was never patched. Pointing an AI coding agent at a database through a server with an unpatched injection flaw is not a risk worth taking for the convenience of an npm package. Postgres MCP Pro is the maintained replacement, it is what Atlas should be pointed at, and switching is a one-line change to the command Atlas runs. ## Adding Postgres MCP Pro to Atlas Connect Atlas to PostgreSQL in 2026 with atlas mcp add postgres --env DATABASE_URI=$DATABASE_URI -- uvx postgres-mcp --access-mode=restricted. The DATABASE_URI environment variable holds the connection string, uvx runs Postgres MCP Pro without a permanent install, and --access-mode=restricted keeps the server read-only. Postgres MCP Pro is distributed as postgres-mcp and runs cleanly under uvx, so there is nothing to install permanently. DATABASE_URI is passed as an environment variable rather than an argument, which keeps the connection string, including its password, out of the process argument list where any user on the machine could read it. The --access-mode=restricted flag should be considered part of the default command, not an optional extra. Add it every time, and remove it only under the specific condition described in the next section. ## What --access-mode=restricted actually protects --access-mode=restricted keeps Postgres MCP Pro read-only, which means Atlas can inspect the schema and run EXPLAIN ANALYZE but cannot write. Switch to unrestricted only against a scratch database you can drop. In 2026 this is the single most important flag in the Atlas and PostgreSQL setup. Read-only is the correct default because reading is where almost all of the value is. Atlas needs the real schema, the real index list, and the real EXPLAIN ANALYZE output. None of that requires write access. Writes, when they are needed, should go through a migration file you have reviewed, not through the agent issuing DDL live. Unrestricted mode exists for the case where you are deliberately iterating against a scratch database that you can drop and recreate. If the database has data you care about, restricted is the mode. ## Other ways to run Postgres MCP Pro Postgres MCP Pro ships 3 ways in 2026: under uvx, as the crystaldba/postgres-mcp Docker image, and over --transport=sse for remote setups. Atlas can therefore reach PostgreSQL from a container runtime instead of uvx, or over SSE when the database is not on your machine. The uvx path is the fastest to try, but it assumes a Python runner on the machine. The crystaldba/postgres-mcp Docker image drops that assumption, which matters on a build agent or a locked-down workstation where you would rather pin and scan a container image than install a Python tool. For remote setups, --transport=sse lets Postgres MCP Pro run somewhere else, closer to the database, while Atlas connects to it over the network. The tool surface Atlas sees is the same in all three cases, and --access-mode=restricted applies to all three. ## The daily workflow: EXPLAIN ANALYZE before any suggestion The Atlas and PostgreSQL workflow in 2026 starts with evidence. Ask Atlas to EXPLAIN ANALYZE the slow query and read the real index list before it proposes anything. Postgres MCP Pro supplies both, so the index Atlas recommends is informed by the plan the planner actually chose. Index advice given without a query plan is astrology. The planner might be doing a sequential scan because the index does not exist, or because the index exists and the planner correctly decided not to use it, and those two situations call for opposite fixes. Atlas reads the EXPLAIN ANALYZE output through Postgres MCP Pro, sees which node is expensive and why, and reads the real index list to know what already exists. Only then does it propose. When the proposal is a schema change, Atlas writes the migration file, and you approve psql -f through its bash tool when it is ready to apply. ## Using Atlas with PostgreSQL and no MCP server at all If you would rather add no server at all, let Atlas drive psql directly and keep permission.bash set to ask. Atlas has a bash tool, psql is already on your machine, and in 2026 this is a legitimate zero-install path to PostgreSQL work with no MCP configuration whatsoever. Some teams do not want another process holding a database connection, and that is a reasonable position. Atlas can shell out to psql, which you already trust, and read the output. The safeguard is permission.bash set to ask, which means every psql invocation stops for your approval before it runs. You give up the structured tooling that Postgres MCP Pro provides, and you keep full visibility into every statement Atlas wants to execute. For a team that mostly needs schema reads and migration review, the trade is often worth it. ## Setup 1. Do not use the archived @modelcontextprotocol/server-postgres. It is deprecated and carries an unpatched SQL injection issue. 2. Add Postgres MCP Pro instead: atlas mcp add postgres --env DATABASE_URI=$DATABASE_URI -- uvx postgres-mcp --access-mode=restricted 3. Keep --access-mode=restricted so the server stays read-only, and switch to unrestricted only against a scratch database you can drop. 4. If you prefer a container or a remote setup, use the crystaldba/postgres-mcp Docker image, which supports --transport=sse. 5. Ask Atlas to EXPLAIN ANALYZE the slow query and read the real index list before it proposes anything. 6. Let Atlas write the migration file, then approve psql -f through its bash tool when it is ready to apply. 7. To add no server at all, let Atlas drive psql directly and keep permission.bash set to ask. ## FAQ ### how to connect atlas to postgres Run atlas mcp add postgres --env DATABASE_URI=$DATABASE_URI -- uvx postgres-mcp --access-mode=restricted. That is Postgres MCP Pro in read-only mode. ### is @modelcontextprotocol/server-postgres safe to use No. The archived @modelcontextprotocol/server-postgres is deprecated and carries an unpatched SQL injection issue. Use Postgres MCP Pro instead. ### how do i make the postgres mcp server read only Pass --access-mode=restricted. It keeps the server read-only. Switch to unrestricted only against a scratch database you can drop. ### can atlas run explain analyze on a slow query Yes. Ask Atlas to EXPLAIN ANALYZE the slow query and read the real index list before it proposes anything, so the advice matches the plan the planner chose. ### how do i run postgres mcp pro in docker Use the crystaldba/postgres-mcp Docker image. It ships the same server and supports --transport=sse for remote setups. ### can i use atlas with postgres without an mcp server Yes. Let Atlas drive psql directly and keep permission.bash set to ask, so every statement stops for approval before it runs. ### will atlas apply a postgres migration on its own No. Atlas writes the migration file, and you approve psql -f through its bash tool when it is ready to apply. --- Canonical HTML: https://runatlas.sh/resources/integrations/postgres Source of truth: aeo_pages row `/resources/integrations/postgres` (segment: Integrations) (this file is generated from it, never hand-edited). Licence: Atlas is proprietary with a free core. It is not open source and there is no public source repository.