Postgres MCP with FastMCP: SQL and typed tools compared

Pamela Fox compares three ways to expose a PostgreSQL database through MCP: unrestricted SQL, read-only SQL and fully typed tools. Her Python examples use FastMCP. An opening demo shows a GitHub Copilot AI agent using Opus 4.6 to query bee observations.

Free-form SQL gives the agent flexibility, but also permits destructive queries. In Fox's deletion example, Opus 4.6 asks for confirmation before removing almost 20,000 rows, while Gemini 2.5 proceeds. She argues that developers must enforce safeguards in their tools rather than depend on model behavior.

The read-only approach combines SQL parsing with database restrictions, a least-privilege role and a 30-second tool timeout. Fox explains that the MCP read-only annotation is only a hint. Her examples also show why a parser alone can miss problematic queries, and why large schemas may benefit from progressive discovery despite requiring more calls.

Typed tools accept parameters for templated queries and cap results, but their scope limits which questions they can answer. MCP elicitation adds explicit user confirmation for deletion or clarification of ambiguous requests. A final experiment shows agents missing data when similar tools split recent and historical observations. Fox proposes a single tool that queries both tables internally and recommends evaluating tool selection.