🗄️Host your own database MCP server

Why host it yourself#

• Runs on this platform reach remote MCP servers only, so a database server has to be reachable over https.
• Your database login stays on your server: the platform keeps only the URL and a token to reach it.
• You decide what agents may do: read-only is the sensible start.

PostgreSQL (Postgres MCP Pro)#

The open-source crystaldba/postgres-mcp server speaks MCP over SSE. With Docker:

docker run -p 8000:8000 \
  -e DATABASE_URI=postgresql://readonly_user:password@db-host:5432/dbname \
  crystaldba/postgres-mcp --access-mode=restricted --transport=sse

• --access-mode=restricted is the project's recommendation for production (read-only queries).
• Clients connect to the /sse path, for example https://mcp.example.com/sse once it's behind your proxy.
• Use a database user that can only read.

MongoDB (MongoDB MCP Server)#

MongoDB's official mongodb-mcp-server has an HTTP transport:

MDB_MCP_CONNECTION_STRING="mongodb+srv://readonly_user:password@cluster.example.net/db" \
npx -y mongodb-mcp-server@latest --transport http --httpHost 127.0.0.1 --httpPort 3000 --readOnly

• --readOnly blocks writes; the connection string can also come from MDB_MCP_CONNECTION_STRING.
• Use the endpoint address the server prints when it starts, behind your proxy.
• MongoDB's documentation warns that exposing it to a network with no authentication opens an unauthenticated endpoint: always put it behind the proxy below.

Expose it safely#

1. 1

   Keep it private

   Bind the server to localhost (or a private network), as above.

2. 2

   Add a proxy

   Put a reverse proxy in front with HTTPS that accepts only requests carrying Authorization: Bearer <your token>.

3. 3

   Choose a long random token

   It's the only key to the server: generate it randomly and keep it in a secret manager.

Connect it to the Vault#

1. 1

   Add a Custom MCP server

   In Connections, open Custom MCP server, enter the public https URL and the proxy's token, and save: the token goes into the Vault.

2. 2

   Test

   Test connection runs an MCP handshake with the token. In production, private and loopback addresses are refused.

3. 3

   Use it on the Canvas

   Add a Custom MCP server Connector under the Skill that queries the database.

Using a local server only with Claude Code? The PostgreSQL and MongoDB Connectors export it in .mcp.json, started on your computer with the database URL from an environment variable.