@yawlabs/postgres-mcp 0.5.4 → 0.6.1

package/CHANGELOG.md

@@ -7,6 +7,65 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- `pg_advisor` `tables_without_primary_key` now includes partitioned-table
+  parents (`relkind='p'`) alongside plain heap tables. A partitioned table
+  with no PK is a real design-drift signal -- and the neighboring
+  `public_tables_without_rls` check already covered both relkinds, so the
+  inconsistency was an oversight. Partition children still inherit the
+  parent's PK as an `indisprimary` index, so they remain filtered out by
+  the existing `NOT EXISTS` clause.
+- `pg_replication_status` now surfaces partial failures via a top-level
+  `_warnings` array instead of short-circuiting on the first sub-query
+  failure. Matches the convention already used by `pg_health`,
+  `pg_describe_table`, and `pg_advisor`. When the WAL position lookup
+  fails, `is_replica` is now `null` rather than `false` so a permission
+  error can't be mistaken for "this is a primary."
+- `identSchema` (shared schema/table/column-name validator) now enforces
+  postgres's 63-byte `NAMEDATALEN` limit on byte length, not JS char
+  length. A multi-byte identifier like 32x `é` (64 UTF-8 bytes) used to
+  pass validation but postgres would silently truncate it; now it fails
+  at the call boundary with a clear message. Centralized in `params.ts`
+  so `schemas.ts`, `stats.ts`, `admin.ts`, and `explain.ts` share one
+  definition. `pg_explain.hypothetical_indexes` validates the same byte
+  limit per-piece on the `schema.table` form and per-column inside
+  `validateHypoIndex`, so direct handler calls that bypass Zod still
+  get the protection.
+- `getSslConfig` now logs a one-shot stderr warning when
+  `POSTGRES_SSL_REJECT_UNAUTHORIZED` is set to an unrecognized value
+  (typo, empty string, ...). Previously the typo silently fell through
+  to pg's default, indistinguishable from "env var unset" -- a connection
+  with unintended TLS posture could land without any signal.
+
+### Changed
+- `pg_top_queries` extension-presence and version probes consolidated
+  into a single catalog round-trip (was two). The actual stats query
+  remains a second round-trip since the column names are version-dynamic.
+
+## [0.6.0] - 2026-05-14
+
+### Added
+- New `pg_readonly` tool. Always runs inside `BEGIN READ ONLY` regardless of
+  `ALLOW_WRITES`, so postgres itself rejects any write attempt. The point is
+  to give hosts that gate tools individually (Claude Code permissions,
+  mcp.hosting per-tool toggles) a stable always-safe target to auto-allow,
+  independent of how the server is configured. Same input shape as `pg_query`
+  (`sql` + `params`).
+- New "Configuring access" README section walking through the recommended
+  least-privileged-role posture: `CREATE ROLE mcp_reader ... GRANT
+  pg_read_all_data` for read-only agents, and a `mcp_writer` example with
+  table-level grants for scoped writes. The role is the primary access
+  control; `ALLOW_WRITES` is positioned as secondary belt-and-braces.
+
+### Changed
+- `pg_query` description leads with role-based access control. `ALLOW_WRITES`
+  is now framed as a secondary gate, with the role in `DATABASE_URL` as the
+  authoritative one. No behavior change.
+- README "Why this one?" read-only bullet expanded: `pg_query` continues to
+  default to read-only via `BEGIN READ ONLY`, and `pg_readonly` is the new
+  unconditional read tool. Configuration table and troubleshooting entry
+  for `ALLOW_WRITES` updated to point at the Configuring access section.
+
 ## [0.5.3] - 2026-05-14
 
 ### Security

package/README.md

@@ -7,6 +7,10 @@
 
 Built and maintained by [Yaw Labs](https://yaw.sh).
 
+[![Add to mcp.hosting](https://mcp.hosting/install-button.svg)](https://mcp.hosting/install?name=Postgres&command=npx&args=-y%2C%40yawlabs%2Fpostgres-mcp&description=Query%20PostgreSQL%20-%20schema%20introspection%2C%20EXPLAIN%20plans%2C%20health%20diagnostics%2C%20read-only%20by%20default&source=https%3A%2F%2Fgithub.com%2FYawLabs%2Fpostgres-mcp)
+
+One click adds this to your [mcp.hosting](https://mcp.hosting) account so it syncs to every MCP client you use. Or install manually below.
+
 ## Backstory
 
 Anthropic's reference Postgres MCP server, `@modelcontextprotocol/server-postgres`, was [archived in May 2025](https://github.com/modelcontextprotocol/servers-archived/tree/main/src/postgres) and [marked deprecated on npm](https://www.npmjs.com/package/@modelcontextprotocol/server-postgres) in July 2025. Anthropic has not shipped a replacement. Despite the deprecation, the last published version (v0.6.2) is still pulled ~20,000 times per week - a lot of agents are pointed at an unmaintained package.
@@ -23,7 +27,8 @@ None of them position themselves as a general-purpose daily driver you'd hand to
 
 ## Why this one?
 
-- **Read-only by default** - user SQL runs in a `BEGIN READ ONLY` transaction, so postgres itself (not string parsing) blocks writes. Opt in with `ALLOW_WRITES=1`.
+- **Read-only by default, with an unconditional read-only tool too** - `pg_query` runs user SQL in a `BEGIN READ ONLY` transaction, so postgres itself (not string parsing) blocks writes; opt in to writes with `ALLOW_WRITES=1`. `pg_readonly` is a separate tool that stays read-only regardless of `ALLOW_WRITES`, so hosts that gate tools individually (Claude Code permissions, mcp.hosting) can safely auto-allow it.
+- **Role-based access as the primary control** - the recommended posture is to use a least-privileged postgres role in `DATABASE_URL` (e.g. one with `GRANT pg_read_all_data`); postgres itself then enforces the boundary, no env var needed. See [Configuring access](#configuring-access).
 - **Extended query protocol for all user SQL** - `pg_query` sends user input with `queryMode: 'extended'`, which restricts each request to a single statement. This closes the [stacked-query injection class](https://securitylabs.datadoghq.com/articles/mcp-vulnerability-case-study-SQL-injection-in-the-postgresql-mcp-server/) (`COMMIT; DROP SCHEMA x CASCADE;`) that defeated the reference server's `BEGIN READ ONLY` wrapper. Integration test asserts the rejection.
 - **Parameterized queries** - `pg_query` takes a `params` array for `$1`, `$2`, etc. No string-interpolated SQL in our code path.
 - **Written from scratch, actively maintained** - not a fork of the deprecated code. Unit + integration tests (`npm test`, `npm run test:integration`) run against a real Postgres; releases cut via `release.sh`.
@@ -90,6 +95,51 @@ Read-only is the default. If you want the agent to be able to `INSERT`, `UPDATE`
 
 Prefer scoping this to dev/test databases - for production, leave writes off and use migration tools out-of-band.
 
+## Configuring access
+
+The role in `DATABASE_URL` is the primary access control. Postgres has had a battle-tested permission system for 30 years; lean on it instead of relying on `ALLOW_WRITES` alone. A least-privileged role makes writes server-rejected no matter what tools or env vars are configured.
+
+**Read-only agent (recommended default):**
+
+```sql
+CREATE ROLE mcp_reader LOGIN PASSWORD 'change-me';
+GRANT CONNECT ON DATABASE your_db TO mcp_reader;
+GRANT USAGE ON SCHEMA public TO mcp_reader;
+GRANT pg_read_all_data TO mcp_reader;
+```
+
+Point `DATABASE_URL` at `mcp_reader`. Postgres rejects every write, every DDL, every privilege change - regardless of `ALLOW_WRITES`. No app-level guard to bypass; the database is the boundary.
+
+**Scoped write agent (dev/test or narrow production use):**
+
+```sql
+CREATE ROLE mcp_writer LOGIN PASSWORD 'change-me';
+GRANT CONNECT ON DATABASE your_db TO mcp_writer;
+GRANT USAGE ON SCHEMA public TO mcp_writer;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO mcp_writer;
+GRANT USAGE ON ALL SEQUENCES IN SCHEMA public TO mcp_writer;
+-- DDL not granted -- the agent can change data but not schema.
+```
+
+Set `ALLOW_WRITES=1` so `pg_query` will issue writes, and rely on the role to keep the agent away from DDL and other schemas.
+
+**Per-tool gating in the host:**
+
+Tools split cleanly across two authority classes:
+
+- **Auto-allow:** `pg_readonly` (server-side `BEGIN READ ONLY`, unconditional), plus the introspection tools (`pg_list_*`, `pg_describe_table`, `pg_search_columns`, `pg_explain` without ANALYZE-of-write, `pg_health`, `pg_inspect_locks`, `pg_table_bloat`, `pg_unused_indexes`, `pg_top_queries`, `pg_replication_status`, `pg_advisor`, `pg_table_privileges`, `pg_list_roles`).
+- **Always prompt:** `pg_query` (can write when the role allows it), `pg_kill` (changes session state).
+
+Claude Code's `permissions` block and mcp.hosting's per-tool toggle both honor this split.
+
+**`ALLOW_WRITES` as defense-in-depth:**
+
+`ALLOW_WRITES` is a secondary belt-and-braces gate. Useful when:
+- You're on a managed database where creating a second role is awkward (some Supabase/Neon plans).
+- You want a single role that can write, but want the MCP server to refuse writes anyway during normal operation.
+
+Otherwise, configure the role and stop relying on `ALLOW_WRITES`.
+
 ## What can an agent do with this?
 
 Once connected, the agent picks tools automatically based on what you ask. A few single-tool examples:
@@ -111,7 +161,8 @@ The bigger leverage is multi-tool reasoning. A few real workflows:
 
 | Tool | Description |
 |------|-------------|
-| `pg_query` | Run a SQL query. Read-only by default; writes require `ALLOW_WRITES=1`. Supports parameterized queries via `params`. Result fields include `dataTypeName` (e.g. `int4`, `jsonb`) alongside `dataTypeID`. |
+| `pg_readonly` | Run a SQL statement guaranteed read-only - always inside `BEGIN READ ONLY`, regardless of `ALLOW_WRITES`. The recommended tool for read access; safe for hosts to auto-allow. |
+| `pg_query` | Run a SQL query. Writes gated by the role in `DATABASE_URL` first, `ALLOW_WRITES` second. Supports parameterized queries via `params`. Result fields include `dataTypeName` (e.g. `int4`, `jsonb`) alongside `dataTypeID`. |
 | `pg_list_schemas` | List non-system schemas. |
 | `pg_list_tables` | List tables (and optionally views) in a schema with estimated row counts. Paginated via `limit`/`offset`. |
 | `pg_describe_table` | Kind, columns, PK, outgoing FKs, incoming FKs (`referenced_by`), CHECK / UNIQUE / EXCLUDE constraints, indexes, and partition parent/children for a relation. |
@@ -139,7 +190,7 @@ All env vars are read from the MCP server's environment:
 | Variable | Default | Purpose |
 |----------|---------|---------|
 | `DATABASE_URL` | (required) | PostgreSQL connection string. |
-| `ALLOW_WRITES` | unset | Set to `1` or `true` to allow DML/DDL via `pg_query` and `pg_explain` ANALYZE of writes. |
+| `ALLOW_WRITES` | unset | Secondary write gate for `pg_query` and `pg_explain` ANALYZE-of-writes. Set to `1` or `true` to lift the `BEGIN READ ONLY` wrapper. The role in `DATABASE_URL` is the primary control - see [Configuring access](#configuring-access). Does not affect `pg_readonly`, which is unconditional. |
 | `POSTGRES_STATEMENT_TIMEOUT_MS` | `30000` | Per-statement timeout. |
 | `POSTGRES_CONNECTION_TIMEOUT_MS` | `10000` | TCP connect timeout. Without this, a dead host hangs until the OS gives up (~2 minutes). |
 | `POSTGRES_MAX_ROWS` | `1000` | Cap on rows returned by `pg_query`. |
@@ -179,7 +230,7 @@ This disables certificate chain verification only -- the TCP connection is still
 
 **`canceling statement due to statement timeout`** - A single query exceeded `POSTGRES_STATEMENT_TIMEOUT_MS` (default 30s). Increase it, narrow the query with `WHERE`, or add an index. This is working as designed -- the timeout exists so a runaway query cannot hang the agent.
 
-**`Write blocked: this server is in read-only mode`** - You asked the agent to write but `ALLOW_WRITES` is not set. Add `ALLOW_WRITES=1` to the `env` block of `.mcp.json` and restart your MCP client. Only do this for dev/test DBs.
+**`Write blocked: this server is in read-only mode`** - You asked the agent to write via `pg_query` but `ALLOW_WRITES` is not set. Either add `ALLOW_WRITES=1` to the `env` block of `.mcp.json` and restart your MCP client (dev/test DBs), or - cleaner for production - use a role with `INSERT/UPDATE/DELETE` grants in `DATABASE_URL` and keep `ALLOW_WRITES` unset. See [Configuring access](#configuring-access). Note that `pg_readonly` always rejects writes; if you want writes, the call has to go through `pg_query`.
 
 **Connection pool exhaustion with PgBouncer transaction mode or pglite-socket** - These backends don't support concurrent queries on a single connection. Set `POSTGRES_POOL_MAX=1` in the env block.
 

package/dist/index.js

@@ -36117,6 +36117,9 @@ function getSslConfig() {
   if (raw === void 0) return void 0;
   if (raw === "0" || raw === "false") return { rejectUnauthorized: false };
   if (raw === "1" || raw === "true") return { rejectUnauthorized: true };
+  console.error(
+    `[postgres-mcp] POSTGRES_SSL_REJECT_UNAUTHORIZED=${JSON.stringify(raw)} not recognized; expected "0", "false", "1", or "true". Deferring to the pg driver / connection-string default.`
+  );
   return void 0;
 }
 function getPool() {
@@ -36346,6 +36349,14 @@ async function shutdown() {
   }
 }
 
+// src/tools/params.ts
+var paramValue = external_exports.lazy(
+  () => external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null(), external_exports.array(paramValue), external_exports.record(external_exports.string(), paramValue)])
+);
+var identSchema = external_exports.string().min(1).max(63).refine((v) => Buffer.byteLength(v, "utf8") <= 63, {
+  message: "Identifier exceeds PostgreSQL's 63-byte NAMEDATALEN limit (multi-byte characters count as multiple bytes)."
+});
+
 // src/tools/admin.ts
 var adminTools = [
   {
@@ -36445,8 +36456,8 @@ var adminTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      schema: external_exports.string().min(1).max(63).default("public").describe("Schema name (defaults to 'public')."),
-      table: external_exports.string().min(1).max(63).optional().describe("Table name. Omit to list privileges for all tables in the schema.")
+      schema: identSchema.default("public").describe("Schema name (defaults to 'public')."),
+      table: identSchema.optional().describe("Table name. Omit to list privileges for all tables in the schema.")
     }),
     handler: async (input) => {
       const { schema, table } = input;
@@ -36548,16 +36559,18 @@ var adminTools = [
                END AS wal_position`
           )
         ]);
-        if (!slotsRes.ok) return slotsRes;
-        if (!replicasRes.ok) return replicasRes;
-        if (!walRes.ok) return walRes;
+        const warnings = [];
+        if (!slotsRes.ok) warnings.push(`slots fetch failed: ${slotsRes.error}`);
+        if (!replicasRes.ok) warnings.push(`replicas fetch failed: ${replicasRes.error}`);
+        if (!walRes.ok) warnings.push(`wal_position fetch failed: ${walRes.error}`);
         return {
           ok: true,
           data: {
-            is_replica: walRes.data?.[0]?.is_in_recovery ?? false,
-            wal_position: walRes.data?.[0]?.wal_position ?? null,
-            slots: slotsRes.data ?? [],
-            replicas: replicasRes.data ?? []
+            is_replica: walRes.ok ? walRes.data?.[0]?.is_in_recovery ?? false : null,
+            wal_position: walRes.ok ? walRes.data?.[0]?.wal_position ?? null : null,
+            slots: slotsRes.ok ? slotsRes.data ?? [] : [],
+            replicas: replicasRes.ok ? replicasRes.data ?? [] : [],
+            ...warnings.length > 0 ? { _warnings: warnings } : {}
           }
         };
       });
@@ -36575,7 +36588,7 @@ var adminTools = [
     },
     inputSchema: external_exports.object({
       seqExhaustionThreshold: external_exports.number().min(0).max(1).default(0.5).describe("Minimum used-fraction (last_value / max_value) to flag a sequence (default 0.5 = 50%)."),
-      rlsSchemas: external_exports.array(external_exports.string().min(1).max(63)).default(["public"]).describe("Schemas where RLS-missing should be flagged. Defaults to ['public']."),
+      rlsSchemas: external_exports.array(identSchema).default(["public"]).describe("Schemas where RLS-missing should be flagged. Defaults to ['public']."),
       limit: external_exports.number().int().min(1).max(500).default(50).describe("Max rows per category (default 50).")
     }),
     handler: async (input) => {
@@ -36603,15 +36616,22 @@ var adminTools = [
             [seqExhaustionThreshold, limit]
           ),
           run(
-            // Declarative-partition children inherit the parent's primary key
-            // as an indisprimary index, so the NOT EXISTS clause already
-            // excludes them. Nothing extra needed for partitioned schemas.
+            // Includes partitioned parents (relkind='p') alongside plain heap
+            // tables ('r'). A partitioned table with no PK is a real design-
+            // drift signal -- if a PK exists on a partitioned table it must
+            // include the partition key columns, but having no PK at all is
+            // legal and usually unintended. Matches the relkind filter used
+            // by public_tables_without_rls below.
+            //
+            // Partition children (relkind='r') inherit the parent's PK as an
+            // indisprimary index on the child, so the NOT EXISTS clause keeps
+            // already filtering them out.
             `SELECT
                n.nspname AS schema,
                c.relname AS "table"
              FROM pg_catalog.pg_class c
              JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
-             WHERE c.relkind = 'r'
+             WHERE c.relkind IN ('r', 'p')
                AND n.nspname NOT IN ('pg_catalog', 'information_schema')
                AND n.nspname NOT LIKE 'pg_%'
                AND NOT EXISTS (
@@ -36663,7 +36683,7 @@ var adminTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      schema: external_exports.string().min(1).max(63).optional().describe("Limit to one schema. If omitted, all user schemas are included."),
+      schema: identSchema.optional().describe("Limit to one schema. If omitted, all user schemas are included."),
       minDeadRatio: external_exports.number().min(0).max(1).default(0.1).describe("Minimum dead-tuple fraction to include - dead / (live + dead). Default 0.1 = 10%."),
       limit: external_exports.number().int().min(1).max(200).default(50).describe("Max rows to return (default 50).")
     }),
@@ -36699,16 +36719,15 @@ var adminTools = [
   }
 ];
 
-// src/tools/params.ts
-var paramValue = external_exports.lazy(
-  () => external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null(), external_exports.array(paramValue), external_exports.record(external_exports.string(), paramValue)])
-);
-
 // src/tools/explain.ts
 var indexAccessMethod = external_exports.enum(["btree", "hash", "gin", "gist", "brin", "spgist"]);
 var hypotheticalIndex = external_exports.object({
+  // `table` is `schema.table` or `table`. The 127-char ceiling is a generous
+  // upper bound on the combined form -- the actual NAMEDATALEN (63-byte)
+  // limit on each piece after the split is enforced in validateHypoIndex,
+  // since splitting and per-piece byte-checking is awkward in Zod.
   table: external_exports.string().min(1).max(127).describe("Target table. Use `schema.table` (e.g. `public.users`) or just `table` for the search_path."),
-  columns: external_exports.array(external_exports.string().min(1).max(63)).min(1).describe("Column names in index order. Quoted identifiers are not supported here -- pass plain names."),
+  columns: external_exports.array(identSchema).min(1).describe("Column names in index order. Quoted identifiers are not supported here -- pass plain names."),
   using: indexAccessMethod.default("btree").describe("Index access method. btree is the right answer for almost every query.")
 });
 function quoteIdent(name) {
@@ -36722,11 +36741,17 @@ function validateHypoIndex(idx) {
     if (piece.includes('"')) {
       return `Hypothetical index table ${JSON.stringify(idx.table)} contains a double-quote; pass plain identifier names without pre-quoting.`;
     }
+    if (Buffer.byteLength(piece, "utf8") > 63) {
+      return `Hypothetical index table piece ${JSON.stringify(piece)} exceeds PostgreSQL's 63-byte NAMEDATALEN limit (multi-byte characters count as multiple bytes).`;
+    }
   }
   for (const col of idx.columns) {
     if (col.includes('"')) {
       return `Hypothetical index column ${JSON.stringify(col)} contains a double-quote; pass plain identifier names without pre-quoting.`;
     }
+    if (Buffer.byteLength(col, "utf8") > 63) {
+      return `Hypothetical index column ${JSON.stringify(col)} exceeds PostgreSQL's 63-byte NAMEDATALEN limit (multi-byte characters count as multiple bytes).`;
+    }
   }
   return null;
 }
@@ -36904,13 +36929,32 @@ var healthTools = [
 
 // src/tools/query.ts
 var queryTools = [
+  {
+    name: "pg_readonly",
+    description: "Run a SQL statement guaranteed read-only. Always executes inside a `BEGIN READ ONLY` transaction regardless of `ALLOW_WRITES`, so postgres itself rejects any write attempt. Use this whenever the goal is to read - SELECT, EXPLAIN, SHOW, VALUES, WITH ... SELECT, etc. Hosts that gate tools individually (Claude Code permissions, mcp.hosting) can safely auto-allow this one. Use `params` for parameterized queries to avoid SQL injection. Params can be strings, numbers, booleans, null, arrays (for postgres arrays / ANY), or objects (for json/jsonb columns). Large result sets are truncated to POSTGRES_MAX_ROWS (default 1000) with a `truncated: true` flag.",
+    annotations: {
+      title: "Run read-only SQL",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    inputSchema: external_exports.object({
+      sql: external_exports.string().min(1).max(1e6).describe("The SQL statement to execute. Hard cap of 1 MB."),
+      params: external_exports.array(paramValue).optional().describe("Positional parameters referenced as $1, $2, ... in the SQL.")
+    }),
+    handler: async (input) => {
+      const { sql, params } = input;
+      return runReadOnly(sql, params ?? []);
+    }
+  },
   {
     name: "pg_query",
-    description: "Run a SQL query against the configured PostgreSQL database. Read-only by default (query runs in a READ ONLY transaction). Set ALLOW_WRITES=1 in the MCP server env to enable DML/DDL. Use `params` for parameterized queries to avoid SQL injection. Params can be strings, numbers, booleans, null, arrays (for postgres arrays / ANY), or objects (for json/jsonb columns). Dates and UUIDs can be passed as ISO strings. Large result sets are truncated to POSTGRES_MAX_ROWS (default 1000) with a `truncated: true` flag.",
+    description: "Run a SQL query against the configured PostgreSQL database. Writes are gated by the role in `DATABASE_URL` first and `ALLOW_WRITES` second: a role created with `GRANT pg_read_all_data` makes writes server-rejected regardless of `ALLOW_WRITES`, and is the recommended way to scope agent access. `ALLOW_WRITES=1` is a secondary belt-and-braces gate - useful for managed databases where creating a second role is awkward. For read-only access where you want the guarantee in the tool name, prefer `pg_readonly`. Use `params` for parameterized queries to avoid SQL injection. Params can be strings, numbers, booleans, null, arrays (for postgres arrays / ANY), or objects (for json/jsonb columns). Dates and UUIDs can be passed as ISO strings. Large result sets are truncated to POSTGRES_MAX_ROWS (default 1000) with a `truncated: true` flag.",
     annotations: {
       title: "Run SQL query",
       readOnlyHint: false,
-      // conditionally destructive based on ALLOW_WRITES
+      // conditionally destructive based on role + ALLOW_WRITES
       destructiveHint: true,
       idempotentHint: false,
       openWorldHint: true
@@ -36930,7 +36974,6 @@ var queryTools = [
 ];
 
 // src/tools/schemas.ts
-var identSchema = external_exports.string().min(1).max(63);
 var schemaTools = [
   {
     name: "pg_list_schemas",
@@ -37346,7 +37389,6 @@ var schemaTools = [
 ];
 
 // src/tools/stats.ts
-var identSchema2 = external_exports.string().min(1).max(63);
 var statsTools = [
   {
     name: "pg_top_queries",
@@ -37364,22 +37406,17 @@ var statsTools = [
     }),
     handler: async (input) => {
       const { orderBy, limit } = input;
-      const check2 = await runInternal(
-        `SELECT EXISTS (
-           SELECT 1 FROM pg_catalog.pg_extension WHERE extname = 'pg_stat_statements'
-         ) AS installed`
+      const versionRes = await runInternal(
+        `SELECT extversion AS version FROM pg_catalog.pg_extension WHERE extname = 'pg_stat_statements'`
       );
-      if (!check2.ok) return check2;
-      if (!check2.data?.[0]?.installed) {
+      if (!versionRes.ok) return versionRes;
+      if (!versionRes.data || versionRes.data.length === 0) {
         return {
           ok: false,
           error: "pg_stat_statements extension is not installed. Install it with `CREATE EXTENSION pg_stat_statements;` (may require superuser) and add `pg_stat_statements` to `shared_preload_libraries` in postgresql.conf, then restart."
         };
       }
-      const versionRes = await runInternal(
-        `SELECT extversion AS version FROM pg_catalog.pg_extension WHERE extname = 'pg_stat_statements'`
-      );
-      const extVersion = versionRes.ok ? versionRes.data?.[0]?.version ?? "0" : "0";
+      const extVersion = versionRes.data[0]?.version ?? "0";
       const useExecSuffix = compareVersions(extVersion, "1.8") >= 0;
       const totalCol = useExecSuffix ? "total_exec_time" : "total_time";
       const meanCol = useExecSuffix ? "mean_exec_time" : "mean_time";
@@ -37422,7 +37459,7 @@ var statsTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      schema: identSchema2.optional().describe("Limit to one schema. If omitted, all user schemas are included."),
+      schema: identSchema.optional().describe("Limit to one schema. If omitted, all user schemas are included."),
       minSize: external_exports.number().int().min(0).default(1e3).describe("Minimum live tuple count to include (default 1000, filters out tiny/empty tables)."),
       limit: external_exports.number().int().min(1).max(100).default(20).describe("Max rows to return (default 20).")
     }),
@@ -37463,7 +37500,7 @@ var statsTools = [
       openWorldHint: true
     },
     inputSchema: external_exports.object({
-      schema: identSchema2.optional().describe("Limit to one schema. If omitted, all user schemas are included."),
+      schema: identSchema.optional().describe("Limit to one schema. If omitted, all user schemas are included."),
       maxScans: external_exports.number().int().min(0).default(10).describe("Include indexes with scan count <= this (default 10). Use 0 for 'never scanned'."),
       limit: external_exports.number().int().min(1).max(200).default(50).describe("Max rows to return (default 50).")
     }),
@@ -37510,7 +37547,7 @@ function compareVersions(a, b) {
 }
 
 // src/index.ts
-var version2 = true ? "0.5.4" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.6.1" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/postgres-mcp",
-  "version": "0.5.4",
+  "version": "0.6.1",
   "description": "PostgreSQL MCP server - query, schema introspection, explain, and health checks for AI assistants",
   "license": "MIT",
   "author": "YawLabs <contact@yaw.sh>",