@yawlabs/postgres-mcp 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -7,6 +7,129 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- The `postgres-mcp` command is now a runtime launcher (`bin/postgres-mcp.mjs`)
+  that prefers the [oam](https://oamjs.org) runtime and falls back to Node.
+  Selection is via `POSTGRES_MCP_RUNTIME` (`auto` | `oam` | `node`, default
+  `auto`) and `OAM_BIN`.
+
+  The fallback costs nothing: npm already started Node to run the launcher, so
+  falling back is an `import()` into that same process -- no second spawn, no
+  extra startup, behavior identical to running `dist/index.js` directly. Users
+  without oam see no change and no stderr noise.
+
+  Equivalence on the oam path is verified end to end, not assumed: all 21 tools
+  register, a live query returns identical rows and `dataTypeName` values, and
+  the error paths match. oam provides every `node:` builtin the pg driver needs
+  (`net`, `tls`, `crypto`, `dns`), so SCRAM auth and the extended query protocol
+  both work.
+
+  **Latency, stated plainly:** taking the oam path means Node has booted first,
+  so both startups are paid. On windows-arm64 against the 1.4 MB bundle, Node
+  alone is ~650-900ms, oam alone ~980-1290ms, and launcher-to-oam ~1.8s. That is
+  a one-time cost per MCP session rather than per tool call, but it is a real
+  regression against plain Node -- `POSTGRES_MCP_RUNTIME=node` opts out.
+
+> **Version note:** the "Changed (breaking)" entries below alter the shape of
+> tool output and the CLI's exit behavior. Under SemVer-for-0.x that makes the
+> next release a MINOR bump -- `0.8.0`, not `0.7.1`. `release.sh` performs the
+> actual bump (`npm version`) and syncs `server.json`, so nothing is pre-bumped
+> here; pass `0.8.0` when cutting the release.
+
+### Changed (breaking)
+
+- `QueryResult.command` is now OPTIONAL, and is omitted entirely for statements
+  that run on the cursor path (every SELECT and other row-returning statement).
+  Previously it reported `"FETCH"` for all of them -- the command tag of the
+  internal `FETCH`, not of the user's statement. Postgres does not surface the
+  inner tag through a cursor and there is no source of truth to substitute, so
+  the field is absent rather than wrong. It is still present and correct on the
+  direct-exec path (DDL and DML without `RETURNING`), where node-pg reports the
+  first word of the real tag: `CREATE`, `INSERT`, etc.
+- `rowCount` no longer exceeds `rows.length` on a truncated cursor-path result.
+  The bounded fetch deliberately reads `POSTGRES_MAX_ROWS + 1` rows to detect
+  truncation, and that extra probe row was leaking into `rowCount` -- callers
+  saw `rowCount: 1001` next to 1000 rows. The direct-exec path is unchanged and
+  still reports the AFFECTED-row count, which is independent of how many rows
+  come back: a truncated `INSERT ... RETURNING` of 10 rows correctly reports
+  `rowCount: 10`, `rows.length: 3`, `truncated: true`.
+- `pg_top_queries` is now scoped to the database in `DATABASE_URL`.
+  `pg_stat_statements` is cluster-wide, so on a shared cluster the tool
+  previously returned normalized query text from unrelated databases. Results
+  are filtered by `dbid`, matching every other tool in this server. Callers who
+  relied on the cluster-wide view will see fewer rows.
+- The CLI now exits 1 with a usage message on an unrecognized bare argument
+  instead of silently starting the stdio server. `postgres-mcp doctor` used to
+  print nothing and appear to hang while the server waited for MCP framing on
+  stdin. Arguments beginning with `-` are still passed through untouched so
+  host-supplied flags keep working, and a positionally-passed connection string
+  gets a targeted message pointing at the `DATABASE_URL` env block.
+
+### Fixed
+
+- `pg_describe_table` no longer reports `INCLUDE` (covering) columns as part of
+  `primary_key`. PostgreSQL 11+ allows `PRIMARY KEY (id) INCLUDE (label)`, and
+  the covering column sits in `pg_index.indkey` next to the key column; the
+  query matched the whole vector. An agent reading that would build an invalid
+  `ON CONFLICT (id, label)` target. The key columns are now bounded by
+  `indnkeyatts`.
+- `resolveTypeNames` no longer throws when `shutdown()` lands mid-flight. The
+  module-scoped type cache is nulled by `shutdown()`, and dereferencing it after
+  an await (SIGTERM during a tool call, or a test calling `shutdown()` between
+  calls) raised on null -- silently costing the response its `dataTypeName`
+  fields. The cache is now bound to a local before the first await.
+- Zod schema defaults are re-applied consistently by every tool handler for
+  direct (non-MCP) callers, which bypass schema parsing. Previously only
+  `pg_explain` and `pg_table_bloat` did this; `pg_advisor` in particular bound
+  `undefined` into `n.nspname = ANY($1)` and errored at bind time. `pg_kill`
+  defaults to the safer `cancel` mode, so an omitted `mode` can never escalate
+  to `terminate`.
+
+### Documentation
+
+- `pg_readonly`'s description and the README now state the actual scope of
+  `BEGIN READ ONLY`: it bounds writes to the DATABASE, not every side effect.
+  Functions whose effect lands outside the table data -- `pg_terminate_backend`,
+  `pg_cancel_backend`, `pg_read_file`, `lo_export`, `COPY ... TO PROGRAM` -- are
+  not blocked by it and are not behind the `ALLOW_WRITES` gate that `pg_kill`
+  sits behind. All of them still require privileges the `DATABASE_URL` role must
+  hold, so the ROLE is what actually bounds this tool. Auto-allow `pg_readonly`
+  with a least-privileged role.
+- `release.sh` no longer suggests `npm login --auth-type=web` on an E401/E404.
+  That command overwrites the automation token in `~/.npmrc` with a
+  WebAuthn-bound session, and the next publish then fails on a challenge no
+  script can answer. It now points at restoring the automation token.
+- Removed stale references to a CI pipeline this repo does not have: there is no
+  `.github/`, the binary build and the lint gate are both local.
+
+### Testing
+
+- `src/index.test.ts`: the CLI entrypoint had no automated coverage at all (it
+  cannot be imported -- it calls `server.connect` at the top level), including
+  the argv handling that runs before server startup. Now driven as a child
+  process: both version flags, the argv guard's three branches, and a full MCP
+  `initialize` + `tools/list` handshake that covers the tool-registration wiring.
+- Coverage for the `DECLARE`-succeeded / `FETCH`-failed branch of
+  `runUserQueryBounded`, which prevents re-executing a statement whose side
+  effects already landed. Engineered with a short `statement_timeout`; a
+  sequence acts as the double-execution detector, since `nextval` is
+  non-transactional and survives the rollback.
+- Coverage for `dbid` scoping (with a positive control proving the assertion is
+  not vacuous), the truncated `INSERT ... RETURNING` row count, `command`
+  presence on both paths, `PRIMARY KEY ... INCLUDE`, composite-PK ordering,
+  `shutdown()` mid-bootstrap, and `getPool()` without `DATABASE_URL` including
+  the win32-only hint branch.
+- `scripts/wsl-pg-setup.sh` now provisions PostgreSQL 15 alongside 17 and 18,
+  adds `pg_stat_statements` to `shared_preload_libraries`, and creates
+  `pg_stat_statements` + `pgstattuple`. Without those extensions present, every
+  `pg_top_queries` test and both `pg_table_bloat` `approx`/`exact` tests took
+  their "extension not installed" early return and proved nothing about the
+  tool's SQL. PG15 is there for column coverage, not recency:
+  `pg_stat_statements` renamed `blk_read_time` to `shared_blk_read_time` in 1.11
+  (PG17), and with only 17/18 in the matrix the pre-1.11 branch was never
+  selected.
+
 ## [0.6.20] - 2026-06-04
 
 ### Fixed

package/README.md

@@ -27,7 +27,7 @@ None of them position themselves as a general-purpose daily driver you'd hand to
 
 ## Why this one?
 
-- **Read-only by default, with an unconditional read-only tool too** - `pg_query` runs user SQL in a `BEGIN READ ONLY` transaction, so postgres itself (not string parsing) blocks writes; opt in to writes with `ALLOW_WRITES=1`. `pg_readonly` is a separate tool that stays read-only regardless of `ALLOW_WRITES`, so hosts that gate tools individually (Claude Code permissions, mcp.hosting) can safely auto-allow it.
+- **Read-only by default, with an unconditional read-only tool too** - `pg_query` runs user SQL in a `BEGIN READ ONLY` transaction, so postgres itself (not string parsing) blocks writes; opt in to writes with `ALLOW_WRITES=1`. `pg_readonly` is a separate tool that stays read-only regardless of `ALLOW_WRITES`, so hosts that gate tools individually (Claude Code permissions, mcp.hosting) can auto-allow it -- paired with a least-privileged role, since `READ ONLY` bounds writes to the database rather than every side effect ([details](#per-tool-gating-in-the-host)).
 - **Role-based access as the primary control** - the recommended posture is to use a least-privileged postgres role in `DATABASE_URL` (e.g. one with `GRANT pg_read_all_data`); postgres itself then enforces the boundary, no env var needed. See [Configuring access](#configuring-access).
 - **Extended query protocol for all user SQL** - `pg_query` sends user input with `queryMode: 'extended'`, which restricts each request to a single statement. This closes the [stacked-query injection class](https://securitylabs.datadoghq.com/articles/mcp-vulnerability-case-study-SQL-injection-in-the-postgresql-mcp-server/) (`COMMIT; DROP SCHEMA x CASCADE;`) that defeated the reference server's `BEGIN READ ONLY` wrapper. Integration test asserts the rejection.
 - **Parameterized queries** - `pg_query` takes a `params` array for `$1`, `$2`, etc. No string-interpolated SQL in our code path.
@@ -132,6 +132,8 @@ Tools split cleanly across two authority classes:
 
 Claude Code's `permissions` block and mcp.hosting's per-tool toggle both honor this split.
 
+> **What `READ ONLY` does and does not cover.** A `BEGIN READ ONLY` transaction blocks writes to the *database* -- INSERT/UPDATE/DELETE, DDL, `nextval`/`setval`. It does not block functions whose effect lands outside the table data. `SELECT pg_terminate_backend(...)`, `pg_cancel_backend`, `pg_read_file`, `lo_export`, and `COPY ... TO PROGRAM` all run to completion inside `pg_readonly`, which means auto-allowing `pg_readonly` reaches the same capability that `pg_kill` puts behind `ALLOW_WRITES=1`. Every one of them still requires a privilege the `DATABASE_URL` role must actually hold (`pg_signal_backend`, `pg_read_server_files`, superuser), so **the role is the control that bounds this tool, not the transaction mode.** If you auto-allow `pg_readonly`, use a least-privileged role -- see [Configuring access](#configuring-access).
+
 **`ALLOW_WRITES` as defense-in-depth:**
 
 `ALLOW_WRITES` is a secondary belt-and-braces gate. Useful when:
@@ -161,7 +163,7 @@ The bigger leverage is multi-tool reasoning. A few real workflows:
 
 | Tool | Description |
 |------|-------------|
-| `pg_readonly` | Run a SQL statement guaranteed read-only - always inside `BEGIN READ ONLY`, regardless of `ALLOW_WRITES`. The recommended tool for read access; safe for hosts to auto-allow. |
+| `pg_readonly` | Run a SQL statement with no persistent data changes - always inside `BEGIN READ ONLY`, regardless of `ALLOW_WRITES`. The recommended tool for read access, and the one to auto-allow; pair it with a least-privileged role ([why](#per-tool-gating-in-the-host)). |
 | `pg_query` | Run a SQL query. Writes gated by the role in `DATABASE_URL` first, `ALLOW_WRITES` second. Supports parameterized queries via `params`. Result fields include `dataTypeName` (e.g. `int4`, `jsonb`) alongside `dataTypeID`. |
 | `pg_list_schemas` | List non-system schemas. |
 | `pg_list_tables` | List tables (and optionally views) in a schema with estimated row counts. Paginated via `limit`/`offset`. |
@@ -196,10 +198,37 @@ All env vars are read from the MCP server's environment:
 | `POSTGRES_MAX_ROWS` | `1000` | Cap on rows returned by `pg_query`. |
 | `POSTGRES_POOL_MAX` | `5` | Max pool connections. Set to `1` for single-threaded backends (pglite-socket, PgBouncer transaction mode). |
 | `POSTGRES_SSL_REJECT_UNAUTHORIZED` | unset | Set to `false` to skip TLS cert verification (for managed DBs using private-CA certs). Connection is still encrypted. |
+| `POSTGRES_MCP_RUNTIME` | `auto` | Which JS runtime executes the server: `auto` (prefer [oam](https://oamjs.org), fall back to Node), `oam` (require oam, fail if absent), `node` (never use oam). See [Runtime](#runtime). |
+| `OAM_BIN` | unset | Explicit path to an `oam` binary, checked before PATH and the default install locations. |
 
 ### Supported Postgres versions
 
-Tested on **PostgreSQL 17 and 18** in CI. Should work on PG13+ -- a few tools (`pg_replication_status` reading `wal_status`, `pg_top_queries` reading `*_exec_time`) rely on columns that landed in PG13. PG12 and below are out of upstream support and not exercised here.
+Tested on **PostgreSQL 15, 17 and 18** in the integration matrix. Should work on PG13+ -- a few tools (`pg_replication_status` reading `wal_status`, `pg_top_queries` reading `*_exec_time`) rely on columns that landed in PG13. PG12 and below are out of upstream support and not exercised here.
+
+### Runtime
+
+The published `postgres-mcp` command is a small launcher that prefers the [oam](https://oamjs.org) runtime and falls back to Node.
+
+**If you do not have oam, nothing changes.** The fallback is not a re-exec: npm already started Node to run the launcher, so falling back is a plain `import()` of the server into that same process. It costs a few `existsSync` calls and no subprocess, and behaves identically to running `dist/index.js` under Node directly.
+
+**If you do have oam,** the server runs under it. Verified equivalent on both runtimes: all 21 tools register, queries return identical rows and `dataTypeName` values, and the error paths match. oam supplies every `node:` builtin the driver needs, including `net`, `tls`, `crypto`, and `dns` (SCRAM auth and the extended query protocol both work).
+
+**Cost, stated plainly.** Taking the oam path means Node has already booted, so you pay both startups. Measured on windows-arm64 against the 1.4 MB bundle: Node alone ~650-900ms, oam alone ~980-1290ms, launcher-to-oam ~1.8s. This is a **one-time cost per MCP session**, not per tool call -- hosts spawn the server once and hold it open -- but if you care about launch latency, set `POSTGRES_MCP_RUNTIME=node`.
+
+```jsonc
+{
+  "mcpServers": {
+    "postgres": {
+      "command": "npx",
+      "args": ["-y", "@yawlabs/postgres-mcp"],
+      "env": {
+        "DATABASE_URL": "postgres://...",
+        "POSTGRES_MCP_RUNTIME": "node"  // opt out of oam
+      }
+    }
+  }
+}
+```
 
 ### Connecting to managed Postgres (Supabase, Neon, RDS, etc.)
 

package/bin/postgres-mcp.mjs

@@ -0,0 +1,156 @@
+#!/usr/bin/env node
+/**
+ * Runtime launcher for @yawlabs/postgres-mcp.
+ *
+ * Prefers the oam runtime (https://oamjs.org) and falls back to the Node
+ * process already running this file. The server itself (`dist/index.js`) is
+ * runtime-agnostic -- it is a pre-bundled ESM file using only `node:` builtins
+ * that oam implements -- so neither path changes behavior.
+ *
+ * WHY THE FALLBACK COSTS NOTHING
+ * The fallback does NOT re-exec node. npm already started a node process to
+ * run this launcher, so falling back is a plain `import()` of the server into
+ * THIS process: zero extra spawn, zero extra startup, byte-identical behavior
+ * to invoking `dist/index.js` directly. Users without oam pay only the cost of
+ * resolving a few paths (a handful of `existsSync` calls, no subprocess).
+ *
+ * WHAT THE OAM PATH COSTS
+ * Taking the oam path means node has already booted, so the total is node's
+ * startup plus oam's. Measured on windows-arm64 against the 1.4 MB bundle:
+ * node alone ~650-900ms, oam alone ~980-1290ms, so the oam path lands near
+ * ~1.8s. This is a ONE-TIME cost per MCP session, not per tool call -- hosts
+ * spawn the server once and keep it -- but it is a real regression against
+ * plain node and the reason `POSTGRES_MCP_RUNTIME=node` exists.
+ *
+ * SELECTION
+ *   POSTGRES_MCP_RUNTIME=oam    require oam; fail loudly if it is missing
+ *   POSTGRES_MCP_RUNTIME=node   never use oam
+ *   POSTGRES_MCP_RUNTIME=auto   prefer oam, silently fall back (default)
+ *   OAM_BIN=/path/to/oam        explicit binary, checked before any discovery
+ */
+
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { constants, homedir } from "node:os";
+import { delimiter, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// Two forms, deliberately. `import()` on Windows REJECTS a bare `C:\...` path
+// with ERR_UNSUPPORTED_ESM_URL_SCHEME (it reads `c:` as a protocol), so the
+// in-process fallback must use the file:// URL. spawn(), conversely, needs a
+// real filesystem path. Keeping both avoids converting at each call site and
+// getting it backwards on one of them.
+const SERVER_URL = new URL("../dist/index.js", import.meta.url);
+const SERVER_ENTRY = fileURLToPath(SERVER_URL);
+const isWin = process.platform === "win32";
+const exe = isWin ? "oam.exe" : "oam";
+
+/**
+ * Locate an oam binary, or null. Ordered cheapest-and-most-explicit first;
+ * every branch is a stat, never a subprocess, so the miss case (the common one
+ * for users who have never heard of oam) stays sub-millisecond.
+ */
+function findOam() {
+  // 1. Explicit override wins and is never second-guessed.
+  const override = process.env.OAM_BIN;
+  if (override) return existsSync(override) ? override : null;
+
+  // 2. PATH. Resolved manually rather than by spawning `which`/`where`, which
+  //    would cost a subprocess on every launch just to decide whether to spawn.
+  const pathExt = isWin ? (process.env.PATHEXT ?? ".EXE").split(";").filter(Boolean) : [""];
+  for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+    if (!dir) continue;
+    for (const ext of isWin ? pathExt : [""]) {
+      const candidate = join(dir, isWin ? `oam${ext.toLowerCase()}` : "oam");
+      if (existsSync(candidate)) return candidate;
+    }
+  }
+
+  // 3. The per-user locations oamjs.org's installers write to. Checked because
+  //    an MCP host launched from a GUI often has a PATH that does not include
+  //    them, so PATH-only discovery would miss an oam the user really has.
+  const installed = isWin
+    ? [join(process.env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local"), "oam", "bin", exe)]
+    : [join(homedir(), ".oam", "bin", exe)];
+  for (const candidate of installed) {
+    if (existsSync(candidate)) return candidate;
+  }
+
+  return null;
+}
+
+/** Run the server in THIS process. The zero-overhead fallback. */
+async function runInProcess() {
+  await import(SERVER_URL.href);
+}
+
+const mode = (process.env.POSTGRES_MCP_RUNTIME ?? "auto").toLowerCase();
+
+if (mode === "node") {
+  await runInProcess();
+} else {
+  const oam = findOam();
+
+  if (!oam) {
+    if (mode === "oam") {
+      // Explicitly demanded, so this is a real misconfiguration -- do not
+      // silently do something else. writeSync because stderr is async for
+      // TTYs/pipes on Windows and process.exit truncates pending writes.
+      const { writeSync } = await import("node:fs");
+      writeSync(
+        2,
+        "postgres-mcp: POSTGRES_MCP_RUNTIME=oam but no oam binary was found.\n" +
+          "Install from https://oamjs.org, set OAM_BIN=/path/to/oam, or use POSTGRES_MCP_RUNTIME=node.\n",
+      );
+      process.exit(1);
+    }
+    await runInProcess();
+  } else {
+    // `--` separates oam's own flags from the script's argv. Everything after
+    // it lands in process.argv for the server, so `postgres-mcp version` and
+    // any host-supplied flags survive the hop unchanged.
+    const child = spawn(oam, ["run", SERVER_ENTRY, "--", ...process.argv.slice(2)], {
+      // inherit keeps the SAME fds, so MCP's newline-delimited JSON framing on
+      // stdin/stdout is untouched and the host's stdin-close still reaches the
+      // server's shutdown path.
+      stdio: "inherit",
+      env: process.env,
+      windowsHide: true,
+    });
+
+    // If oam cannot be executed at all (deleted between the stat and the
+    // spawn, wrong arch, permission), fall back rather than failing the whole
+    // server. `spawned` guards against falling back AFTER the child has begun
+    // running, which would double-start the server.
+    let spawned = false;
+    child.on("spawn", () => {
+      spawned = true;
+    });
+    child.on("error", (err) => {
+      if (spawned) return;
+      if (mode === "oam") {
+        process.stderr.write(`postgres-mcp: failed to launch oam (${err.message})\n`);
+        process.exit(1);
+      }
+      void runInProcess();
+    });
+
+    // Forward termination so the server's own SIGINT/SIGTERM cleanup (pool
+    // drain) runs in the child instead of the child being orphaned. Signals
+    // are a no-op on Windows but harmless to register.
+    for (const sig of ["SIGINT", "SIGTERM"]) {
+      process.on(sig, () => {
+        if (!child.killed) child.kill(sig);
+      });
+    }
+
+    child.on("exit", (code, signal) => {
+      // Mirror the child's fate: a signal death becomes 128+n so callers see a
+      // conventional shell exit status rather than a bare 0.
+      if (signal) {
+        process.exit(128 + (constants.signals[signal] ?? 15));
+      }
+      process.exit(code ?? 0);
+    });
+  }
+}

package/dist/index.js

@@ -11996,6 +11996,9 @@ var require_lib2 = __commonJS({
   }
 });
 
+// src/index.ts
+import { writeSync } from "node:fs";
+
 // node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
@@ -36144,22 +36147,24 @@ function getPool() {
 var typeNameCache = null;
 async function resolveTypeNames(client, oids) {
   if (oids.length === 0) return {};
-  if (!typeNameCache) {
-    typeNameCache = /* @__PURE__ */ new Map();
+  let cache = typeNameCache;
+  if (!cache) {
+    cache = /* @__PURE__ */ new Map();
+    typeNameCache = cache;
     const res = await client.query("SELECT oid, typname FROM pg_catalog.pg_type");
-    for (const row of res.rows) typeNameCache.set(row.oid, row.typname);
+    for (const row of res.rows) cache.set(row.oid, row.typname);
   }
-  const missing = oids.filter((o) => !typeNameCache?.has(o));
+  const missing = oids.filter((o) => !cache.has(o));
   if (missing.length > 0) {
     const res = await client.query(
       "SELECT oid, typname FROM pg_catalog.pg_type WHERE oid = ANY($1)",
       [missing]
     );
-    for (const row of res.rows) typeNameCache.set(row.oid, row.typname);
+    for (const row of res.rows) cache.set(row.oid, row.typname);
   }
   const out = {};
   for (const oid of oids) {
-    const n = typeNameCache.get(oid);
+    const n = cache.get(oid);
     if (n !== void 0) out[oid] = n;
   }
   return out;
@@ -36192,18 +36197,19 @@ async function runUserQueryBounded(client, sql, params, maxRows) {
     } catch {
     }
     await client.query("RELEASE SAVEPOINT __pgmcp_sp");
-    return fetched;
+    return { result: fetched, viaCursor: true };
   } catch (err) {
     if (declareSucceeded) {
       throw err;
     }
     await client.query("ROLLBACK TO SAVEPOINT __pgmcp_sp");
     await client.query("RELEASE SAVEPOINT __pgmcp_sp");
-    return client.query({
+    const direct = await client.query({
       text: sql,
       values: params,
       queryMode: "extended"
     });
+    return { result: direct, viaCursor: false };
   }
 }
 async function safeResolveTypeNames(client, fields) {
@@ -36214,17 +36220,29 @@ async function safeResolveTypeNames(client, fields) {
     return {};
   }
 }
-function toQueryResult(result, maxRows, typeNames = {}) {
+function toQueryResult(result, maxRows, typeNames, viaCursor) {
   const truncated = result.rows.length > maxRows;
   const rows = truncated ? result.rows.slice(0, maxRows) : result.rows;
   return {
     rows,
-    rowCount: result.rowCount,
+    // Cursor path only: we deliberately FETCH maxRows + 1 to detect
+    // truncation, so `result.rowCount` is one MORE than what we return --
+    // consumers saw rowCount=1001 next to 1000 rows. Report what's in `rows`.
+    //
+    // The direct-exec path must NOT be rewritten. There `rowCount` is the
+    // affected-row count, which is independent of how many rows came back:
+    // `INSERT ... RETURNING` is non-cursorable (DECLARE rejects it with
+    // 42601), so a 10-row insert truncated to 3 must still report 10 rows
+    // affected. Collapsing it to rows.length told the caller 3 rows were
+    // written when 10 were committed.
+    rowCount: truncated && viaCursor ? rows.length : result.rowCount,
     fields: result.fields.map((f) => {
       const name = typeNames[f.dataTypeID];
       return name !== void 0 ? { name: f.name, dataTypeID: f.dataTypeID, dataTypeName: name } : { name: f.name, dataTypeID: f.dataTypeID };
     }),
-    command: result.command,
+    // See QueryResult.command -- omitted on the cursor path because the tag
+    // there describes the FETCH, not the user's statement.
+    ...viaCursor ? {} : { command: result.command },
     ...truncated ? { truncated: true } : {}
   };
 }
@@ -36234,10 +36252,10 @@ async function runReadOnly(sql, params = [], hooks = {}) {
   try {
     await client.query("BEGIN READ ONLY");
     if (hooks.setup) await hooks.setup(client);
-    const result = await runUserQueryBounded(client, sql, params, maxRows);
+    const { result, viaCursor } = await runUserQueryBounded(client, sql, params, maxRows);
     await client.query("ROLLBACK");
     const typeNames = await safeResolveTypeNames(client, result.fields);
-    return { ok: true, data: toQueryResult(result, maxRows, typeNames) };
+    return { ok: true, data: toQueryResult(result, maxRows, typeNames, viaCursor) };
   } catch (err) {
     try {
       await client.query("ROLLBACK");
@@ -36265,10 +36283,10 @@ async function runReadWrite(sql, params = []) {
   const maxRows = getMaxRows();
   try {
     await client.query("BEGIN");
-    const result = await runUserQueryBounded(client, sql, params, maxRows);
+    const { result, viaCursor } = await runUserQueryBounded(client, sql, params, maxRows);
     await client.query("COMMIT");
     const typeNames = await safeResolveTypeNames(client, result.fields);
-    return { ok: true, data: toQueryResult(result, maxRows, typeNames) };
+    return { ok: true, data: toQueryResult(result, maxRows, typeNames, viaCursor) };
   } catch (err) {
     try {
       await client.query("ROLLBACK");
@@ -36291,10 +36309,10 @@ async function runReadWriteRollback(sql, params = [], hooks = {}) {
   try {
     await client.query("BEGIN");
     if (hooks.setup) await hooks.setup(client);
-    const result = await runUserQueryBounded(client, sql, params, maxRows);
+    const { result, viaCursor } = await runUserQueryBounded(client, sql, params, maxRows);
     await client.query("ROLLBACK");
     const typeNames = await safeResolveTypeNames(client, result.fields);
-    return { ok: true, data: toQueryResult(result, maxRows, typeNames) };
+    return { ok: true, data: toQueryResult(result, maxRows, typeNames, viaCursor) };
   } catch (err) {
     try {
       await client.query("ROLLBACK");
@@ -36445,7 +36463,7 @@ var adminTools = [
       limit: external_exports.number().int().min(1).max(100).default(50).describe("Max blocked/blocker pairs (default 50).")
     }),
     handler: async (input) => {
-      const { limit } = input;
+      const { limit = 50 } = input;
       return runInternal(
         `SELECT
            blocked.pid AS blocked_pid,
@@ -36519,7 +36537,7 @@ var adminTools = [
       includeSystem: external_exports.boolean().default(false).describe("If true, include built-in `pg_*` roles (pg_read_all_data, pg_monitor, etc.).")
     }),
     handler: async (input) => {
-      const { includeSystem } = input;
+      const { includeSystem = false } = input;
       const filter = includeSystem ? "" : "WHERE NOT starts_with(r.rolname, 'pg_')";
       return runInternal(
         // Cast member_of to text[] so node-pg parses it into a JS array.
@@ -36560,7 +36578,7 @@ var adminTools = [
       table: identSchema.optional().describe("Table name. Omit to list privileges for all tables in the schema.")
     }),
     handler: async (input) => {
-      const { schema, table } = input;
+      const { schema = "public", table } = input;
       const tableFilter = table ? "AND table_name = $2" : "";
       const params = [schema];
       if (table) params.push(table);
@@ -36593,7 +36611,7 @@ var adminTools = [
       mode: external_exports.enum(["cancel", "terminate"]).default("cancel").describe("`cancel` aborts the current query; `terminate` closes the connection entirely.")
     }),
     handler: async (input) => {
-      const { pid, mode } = input;
+      const { pid, mode = "cancel" } = input;
       if (!isWritesAllowed()) {
         return {
           ok: false,
@@ -36705,7 +36723,11 @@ var adminTools = [
       limit: external_exports.number().int().min(1).max(500).default(50).describe("Max rows per category (default 50).")
     }),
     handler: async (input) => {
-      const { seqExhaustionThreshold, rlsSchemas, limit } = input;
+      const {
+        seqExhaustionThreshold = 0.5,
+        rlsSchemas = ["public"],
+        limit = 50
+      } = input;
       return withSharedClient(async (run) => {
         const [seqRes, noPkRes, rlsRes] = await Promise.all([
           run(
@@ -36815,11 +36837,10 @@ var adminTools = [
     handler: async (input) => {
       const {
         schema,
-        minDeadRatio,
-        limit,
-        method: rawMethod
+        minDeadRatio = 0.1,
+        limit = 50,
+        method = "estimate"
       } = input;
-      const method = rawMethod ?? "estimate";
       const schemaFilter = schema ? "AND schemaname = $3" : "AND schemaname NOT IN ('pg_catalog', 'information_schema') AND schemaname NOT LIKE 'pg_%'";
       const params = [minDeadRatio, limit];
       if (schema) params.push(schema);
@@ -36973,13 +36994,11 @@ var explainTools = [
     handler: async (input) => {
       const {
         sql,
-        analyze: rawAnalyze,
-        format: rawFormat,
+        analyze = false,
+        format = "text",
         params,
         hypothetical_indexes
       } = input;
-      const analyze = rawAnalyze ?? false;
-      const format = rawFormat ?? "text";
       if (/^\s*EXPLAIN\b/i.test(sql)) {
         return {
           ok: false,
@@ -37046,7 +37065,7 @@ var healthTools = [
       activeQueryLimit: external_exports.number().int().min(1).max(100).default(10).describe("Max active queries to return (default 10, max 100).")
     }),
     handler: async (input) => {
-      const { activeQueryLimit } = input;
+      const { activeQueryLimit = 10 } = input;
       return withSharedClient(async (run) => {
         const [versionRes, sizeRes, connsRes, activeRes, tableCountRes] = await Promise.all([
           run(`SELECT version() AS version`),
@@ -37121,7 +37140,18 @@ var healthTools = [
 var queryTools = [
   {
     name: "pg_readonly",
-    description: "Run a SQL statement guaranteed read-only. Always executes inside a `BEGIN READ ONLY` transaction regardless of `ALLOW_WRITES`, so postgres itself rejects any write attempt. Use this whenever the goal is to read - SELECT, EXPLAIN, SHOW, VALUES, WITH ... SELECT, etc. Hosts that gate tools individually (Claude Code permissions, mcp.hosting) can safely auto-allow this one. Use `params` for parameterized queries to avoid SQL injection. Params can be strings, numbers, booleans, null, arrays (for postgres arrays / ANY), or objects (for json/jsonb columns). Large result sets are truncated to POSTGRES_MAX_ROWS (default 1000) with a `truncated: true` flag.",
+    description: "Run a SQL statement with no persistent data changes. Always executes inside a `BEGIN READ ONLY` transaction regardless of `ALLOW_WRITES`, so postgres itself rejects any INSERT/UPDATE/DELETE/DDL and the transaction is always rolled back. Use this whenever the goal is to read - SELECT, EXPLAIN, SHOW, VALUES, WITH ... SELECT, etc. Scope caveat for hosts that auto-allow this tool: `READ ONLY` constrains writes to the DATABASE, not every side effect. Functions whose effect is outside the table data - `pg_cancel_backend` / `pg_terminate_backend`, `pg_read_file`, `lo_export`, `COPY ... TO PROGRAM` - are NOT blocked here and are NOT behind the `ALLOW_WRITES` gate that `pg_kill` sits behind. They still require the privileges the `DATABASE_URL` role holds, so a least-privileged role (e.g. `pg_read_all_data`) is what actually bounds this tool. Use `params` for parameterized queries to avoid SQL injection. Params can be strings, numbers, booleans, null, arrays (for postgres arrays / ANY), or objects (for json/jsonb columns). Large result sets are truncated to POSTGRES_MAX_ROWS (default 1000) with a `truncated: true` flag.",
+    // DELIBERATE, do not "fix" to match the caveat in the description above.
+    // `BEGIN READ ONLY` does not block side-effecting functions
+    // (pg_terminate_backend, pg_read_file, COPY ... TO PROGRAM), so these
+    // hints are arguably too generous, and a review pass will keep noticing
+    // that. The decision is to keep them: staying in the host auto-allow class
+    // is the entire reason pg_readonly exists as a separate tool from
+    // pg_query, and the DATABASE_URL role -- not the transaction mode -- is
+    // the control that actually bounds this tool. The description and the
+    // README carry the caveat; a least-privileged role is the enforcement.
+    // Flipping these to destructive would move pg_readonly to "always prompt"
+    // in every existing host config for a bound the role already provides.
     annotations: {
       title: "Run read-only SQL",
       readOnlyHint: true,
@@ -37206,7 +37236,12 @@ var schemaTools = [
       offset: external_exports.number().int().min(0).default(0).describe("Rows to skip for pagination (default 0).")
     }),
     handler: async (input) => {
-      const { schema, includeViews, limit, offset } = input;
+      const {
+        schema = "public",
+        includeViews = false,
+        limit = 500,
+        offset = 0
+      } = input;
       const kinds = includeViews ? "('r', 'v', 'm', 'f', 'p')" : "('r', 'f', 'p')";
       return runInternal(
         `SELECT
@@ -37245,7 +37280,7 @@ var schemaTools = [
       table: identSchema.describe("Table name.")
     }),
     handler: async (input) => {
-      const { schema, table } = input;
+      const { schema = "public", table } = input;
       const kindQuery = `
         SELECT
           CASE c.relkind
@@ -37282,11 +37317,12 @@ var schemaTools = [
         FROM pg_catalog.pg_index i
         JOIN pg_catalog.pg_class c ON c.oid = i.indrelid
         JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
-        JOIN pg_catalog.pg_attribute a ON a.attrelid = c.oid AND a.attnum = ANY(i.indkey)
+        JOIN LATERAL unnest(i.indkey[0:i.indnkeyatts - 1]) WITH ORDINALITY AS k(attnum, ord) ON TRUE
+        JOIN pg_catalog.pg_attribute a ON a.attrelid = c.oid AND a.attnum = k.attnum
         WHERE n.nspname = $1
           AND c.relname = $2
           AND i.indisprimary
-        ORDER BY array_position(i.indkey, a.attnum)
+        ORDER BY k.ord
       `;
       const foreignKeysQuery = `
         SELECT
@@ -37466,7 +37502,7 @@ var schemaTools = [
       includeMaterialized: external_exports.boolean().default(true).describe("If true, include materialized views.")
     }),
     handler: async (input) => {
-      const { schema, includeMaterialized } = input;
+      const { schema = "public", includeMaterialized = true } = input;
       const kinds = includeMaterialized ? "('v', 'm')" : "('v')";
       return runInternal(
         `SELECT
@@ -37496,7 +37532,7 @@ var schemaTools = [
       schema: identSchema.default("public").describe("Schema name (defaults to 'public').")
     }),
     handler: async (input) => {
-      const { schema } = input;
+      const { schema = "public" } = input;
       return runInternal(
         `SELECT
            p.proname AS name,
@@ -37560,7 +37596,7 @@ var schemaTools = [
       limit: external_exports.number().int().min(1).max(1e3).default(100).describe("Max rows to return (default 100).")
     }),
     handler: async (input) => {
-      const { pattern, schema, limit } = input;
+      const { pattern, schema, limit = 100 } = input;
       const schemaFilter = schema ? "AND n.nspname = $3" : "AND n.nspname NOT IN ('pg_catalog', 'information_schema') AND n.nspname NOT LIKE 'pg_%'";
       const params = [pattern, limit];
       if (schema) params.push(schema);
@@ -37591,7 +37627,7 @@ var schemaTools = [
 var statsTools = [
   {
     name: "pg_top_queries",
-    description: "Top N queries by total or mean execution time. Requires the `pg_stat_statements` extension to be installed and enabled (most managed Postgres providers have it on by default). Returns normalized query text (constants replaced with `?`), call count, total/mean/min/max time in ms, rows returned, and cache hit ratio. Use this to find slow queries worth optimizing. On pg_stat_statements >= 1.10 (Postgres 15+), also returns `io_read_time_ms` and `io_write_time_ms` to separate IO-bound from CPU-bound queries (null when track_io_timing = off or the query did no measurable IO -- enable track_io_timing in postgresql.conf to get non-null values).",
+    description: "Top N queries by total or mean execution time. Requires the `pg_stat_statements` extension to be installed and enabled (most managed Postgres providers have it on by default). Returns normalized query text (constants replaced with `?`), call count, total/mean/min/max time in ms, rows returned, and cache hit ratio. Use this to find slow queries worth optimizing. On pg_stat_statements >= 1.10 (Postgres 15+), also returns `io_read_time_ms` and `io_write_time_ms` to separate IO-bound from CPU-bound queries (null when track_io_timing = off or the query did no measurable IO -- enable track_io_timing in postgresql.conf to get non-null values). Scoped to the database in DATABASE_URL: pg_stat_statements is cluster-wide, so results are filtered by `dbid` to match every other tool here rather than leaking query text from unrelated databases sharing the cluster.",
     annotations: {
       title: "Top queries by execution time",
       readOnlyHint: true,
@@ -37604,7 +37640,7 @@ var statsTools = [
       limit: external_exports.number().int().min(1).max(100).default(20).describe("Number of rows to return (default 20).")
     }),
     handler: async (input) => {
-      const { orderBy, limit } = input;
+      const { orderBy = "total_time", limit = 20 } = input;
       const versionRes = await runInternal(
         `SELECT extversion AS version FROM pg_catalog.pg_extension WHERE extname = 'pg_stat_statements'`
       );
@@ -37646,6 +37682,7 @@ var statsTools = [
              ELSE NULL
            END AS hit_percent${ioTimingCols}
          FROM pg_stat_statements
+         WHERE dbid = (SELECT oid FROM pg_catalog.pg_database WHERE datname = current_database())
          ORDER BY ${orderCol} DESC NULLS LAST
          LIMIT $1`,
         [limit]
@@ -37668,7 +37705,11 @@ var statsTools = [
       limit: external_exports.number().int().min(1).max(100).default(20).describe("Max rows to return (default 20).")
     }),
     handler: async (input) => {
-      const { schema, minSize, limit } = input;
+      const {
+        schema,
+        minSize = 1e3,
+        limit = 20
+      } = input;
       const schemaFilter = schema ? "AND schemaname = $3" : "AND schemaname NOT IN ('pg_catalog', 'information_schema') AND schemaname NOT LIKE 'pg_%'";
       const params = [minSize, limit];
       if (schema) params.push(schema);
@@ -37709,7 +37750,11 @@ var statsTools = [
       limit: external_exports.number().int().min(1).max(200).default(50).describe("Max rows to return (default 50).")
     }),
     handler: async (input) => {
-      const { schema, maxScans, limit } = input;
+      const {
+        schema,
+        maxScans = 10,
+        limit = 50
+      } = input;
       const schemaFilter = schema ? "AND s.schemaname = $3" : "AND s.schemaname NOT IN ('pg_catalog', 'information_schema') AND s.schemaname NOT LIKE 'pg_%'";
       const params = [maxScans, limit];
       if (schema) params.push(schema);
@@ -37751,12 +37796,25 @@ function compareVersions(a, b) {
 }
 
 // src/index.ts
-var version2 = true ? "0.7.0" : await readPackageVersion();
+var version2 = true ? "0.9.0" : await readPackageVersion();
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);
   process.exit(0);
 }
+if (subcommand !== void 0 && !subcommand.startsWith("-")) {
+  const looksLikeDsn = /^postgres(ql)?:\/\//i.test(subcommand);
+  const message = looksLikeDsn ? `postgres-mcp: connection strings are not accepted as an argument.
+Set DATABASE_URL in the MCP server env instead:
+  "env": { "DATABASE_URL": "postgres://..." }
+` : `postgres-mcp: unknown subcommand '${subcommand}'
+Usage:
+  postgres-mcp            start the MCP server on stdio
+  postgres-mcp version    print the version and exit
+`;
+  writeSync(2, message);
+  process.exit(1);
+}
 var allTools = [...queryTools, ...schemaTools, ...explainTools, ...healthTools, ...statsTools, ...adminTools];
 var server = new McpServer({
   name: "@yawlabs/postgres-mcp",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/postgres-mcp",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "mcpName": "io.github.YawLabs/postgres-mcp",
   "description": "PostgreSQL MCP server - query, schema introspection, explain, and health checks for AI assistants",
   "license": "MIT",
@@ -28,9 +28,10 @@
   "type": "module",
   "main": "dist/index.js",
   "bin": {
-    "postgres-mcp": "dist/index.js"
+    "postgres-mcp": "bin/postgres-mcp.mjs"
   },
   "files": [
+    "bin/postgres-mcp.mjs",
     "dist/index.js",
     "LICENSE",
     "README.md",