pg-dash (indiekitai/pg-dash) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 29 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
D
Caution
52/100

pg-dash

AI-native PostgreSQL health checker with 26 MCP tools for query analysis, bloat detection, migration safety, and CI integration.

→ indiekitai/pg-dash· listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

indiekitai

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 2 critical, 8 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 4 credentials: ANTHROPIC_API_KEY, GOOGLE_API_KEY, OPENAI_API_KEY, PG_DASH_LLM_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes29 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

pg_dash_overview

Get database overview (version, uptime, size, connections)

pg_dash_health

Get health advisor report with score, grade, and issues

pg_dash_tables

List all tables with sizes and row counts

pg_dash_table_detail

Get detailed info about a specific table

pg_dash_activity

Get current database activity (active queries, connections)

pg_dash_schema_changes

Get recent schema changes

pg_dash_fix

Execute safe fix(es) — supports batch: multiple VACUUM/ANALYZE/REINDEX statements separated by semicolons

pg_dash_alerts

Get alert history

pg_dash_explain

Run EXPLAIN ANALYZE on a SELECT query (read-only, wrapped in BEGIN/ROLLBACK)

pg_dash_query

Execute a read-only SELECT query and return results. Auto-adds LIMIT 200 if no LIMIT clause present. Use for ad-hoc data inspection.

pg_dash_batch_fix

Get batch fix SQL for issues (optionally filtered by category)

pg_dash_slow_queries

Get top slow queries from pg_stat_statements

pg_dash_table_sizes

Get table sizes with data/index breakdown (top 30)

pg_dash_export

Export full health report

pg_dash_diff

Compare current health with last saved snapshot

pg_dash_check_migration

Analyze migration SQL for safety risks (lock tables, missing tables, destructive ops)

pg_dash_analyze_query

Deep analysis of a SQL query: runs EXPLAIN ANALYZE, detects missing indexes, and provides specific optimization recommendations

pg_dash_query_regressions

Detect queries that have gotten significantly slower (>50% degradation) compared to historical baselines

pg_dash_compare_env

Compare schema and health between two PostgreSQL environments. Detects missing tables, columns, indexes.

pg_dash_unused_indexes

Find unused indexes that waste space and slow down writes

pg_dash_bloat

Detect table bloat (dead tuples) that slow down queries

pg_dash_autovacuum

Check autovacuum health — which tables are stale or never vacuumed

pg_dash_locks

Show active lock waits and long-running queries blocking the database

pg_dash_config_check

Audit PostgreSQL configuration settings and get tuning recommendations

pg_dash_pgvector

Check pgvector health — installed version, vector columns, index types (IVFFlat/HNSW), dimension analysis, missing indexes, tuning recommendations

fetch_db_context

Get comprehensive database context for AI agents: table structures, columns, types, primary/foreign keys, indexes, business intent inference, and health summary

pg_dash_query_natural

Query database using natural language. The LLM converts your question to SQL and returns results. Example: 'show me slow queries last hour', 'find missing indexes', 'what's the health score', 'list all tables with their sizes'

ci_health_summary

Generate a CI-friendly health summary with AI-powered prioritization. Input: health check result (from pg_dash_health). Output: one-sentence summary + prioritized issue list. Perfect for GitHub Actions/GitLab CI integration.

pg_dash_list_constraints

List all CHECK, UNIQUE, FK, and exclusion constraints on a table. Essential before DROP CONSTRAINT to verify constraint names.

// known CVEs in dependencies2 critical8 high5 medium31 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3.0.0GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

criticalvitest@3.0.0GHSA-9crc-q9x8-hgqq

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

high@hono/node-server@1.11.0GHSA-wc8c-qw6v-h7f6

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

highhono@4.4.0GHSA-3vhc-576x-3qv4

Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)

highhono@4.4.0GHSA-88fw-hqm2-52qc

hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretANTHROPIC_API_KEY
🔐 secretGOOGLE_API_KEY
configMCP_PORT9000 pg-dash-mcp postgres://... --http
🔐 secretOPENAI_API_KEY
configPG_DASH_BIND
configPG_DASH_DATA_DIR
🔐 secretPG_DASH_LLM_API_KEY
configPG_DASH_LLM_BASE_URL
configPG_DASH_LLM_MODEL
configPG_DASH_LLM_PROVIDER
configPG_DASH_LONG_QUERY_THRESHOLD
configPG_DASH_QUERY_STATS_INTERVAL
configPG_DASH_RETENTION_DAYS
configPG_DASH_SNAPSHOT_INTERVAL
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployDATABASE_URL
deployPG_DASH_CONNECTION_STRING
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

29/29 tools missing one or more hints — pg_dash_overview (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); pg_dash_health (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); pg_dash_tables (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +26 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

Only 14/29 tool handlers declare input schemas (48%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool test coverage

Only 0/29 tools referenced in tests (0%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

26 child_process calls — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 6 high severity in production deps — @hono/node-server@1.11.0 (high), hono@4.4.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

4 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/indiekitai/pg-dash?variant=verified)](https://m8ven.ai/mcp/indiekitai/pg-dash)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 52dcb789d497965b94df34632832e29971742d54
code hash: 119318e518ef83f01cf42dce0d6a23d95610a4e177684e0af216dda550d67ffb
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client