CockroachDB MCP Server

​

Requirements

• An existing with a whose are suitable for the operations that you want your AI agents to perform.
• Installing with go install or building from source requires Go 1.26 or later. Alternatively, you can install with pre-built binaries (for Linux and Windows), and a Docker image is also available.

​

How it works

• stdio (default): Your AI tool launches the server as a local subprocess and communicates with it over standard input/output. Each user runs their own server instance, authenticated to the cluster with their own SQL credentials. This is the simplest deployment and the recommended starting point.
• HTTP: The server runs as a long-lived process that multiple MCP clients connect to over HTTPS with a bearer token. This is best for shared or remote deployments.

​

Security

• Read-only by default. Unless you explicitly enable write tools with the environment variable, only read tools are registered, and every SQL session is additionally forced read-only with default_transaction_read_only=true. For per-operation control, grant the connecting SQL role only the privileges you want: for example, SELECT, INSERT, and UPDATE but not DELETE to allow writes without deletes.
• SQL grants are the permission boundary. Security ultimately comes from what the connecting SQL user is allowed to do in CockroachDB (via ), not from which environment variables you set on the MCP server. The server configuration controls which tools are registered, but even with write tools enabled, the SQL user can only do what its grants allow. Least-privilege grants are also the containment for prompt injection: the server cannot distinguish a tool call you intended from one induced by malicious content that the agent has read.
• Password authentication is rejected by default. In stdio mode the server runs as a subprocess of the AI agent host, which can read passwords from the process environment or ~/.pgpass. Certificate-based authentication is recommended; password-based authentication requires an explicit opt-in.
• TLS by default, in both directions. Connections to the cluster require sslmode of require or stronger, and HTTP mode refuses to start without a TLS certificate and key. Running without TLS—for local development or behind a TLS-terminating reverse proxy—requires explicit opt-in.
• Background quality of service. By default, queries run at default_transaction_quality_of_service=background, so agent traffic does not contend with latency-sensitive foreground workloads.

​

Tools

​

Example usage

List all of the tables in the movr database.

I need to add a reviews table to the movr database so that riders can rate their rides.

For the schema, I'm thinking we need:
- Review ID (primary key)
- Rider reference (foreign key to movr.users)
- Ride reference (foreign key to movr.rides)
- A 1–5 star rating
- Optional text feedback
- Timestamp

Let's include a secondary index on the rating column.

Show me the CREATE TABLE statement so that we can talk it through before you actually create the table.

​

See also