PostgreSQL CVE & Release Intelligence
PostgreSQL security for AI agents: CVEs, yanked releases, exploits, and upgrade paths
Open source Open in the app JSON README (API)
About
PostgreSQL security for AI agents: CVEs, yanked releases, exploits, and upgrade paths
Details
- Kind
- MCP servers
- Topic
- Databases
- Publisher
- meob
- Origin
- official
- Category
- ferramentas
- Transport
- local
- Version
- 1.0.4
- Last push
- 2026-08-17T21:17:36Z
- Repository state
- ativo
- Language
- Python
- License
- Apache-2.0
- Added
- 2026-08-29 04:00:46
- Updated
- 2026-08-29 04:00:46
- Origin id
io.github.meob/pg-cve-mcp
README
# pg-cve-mcp — PostgreSQL CVE & Release Intelligence for AI Agents
[](https://pypi.org/project/pg-cve-mcp/)
[](https://pypi.org/project/pg-cve-mcp/)
[](https://github.com/meob/PG_CVE-MCP/blob/main/LICENSE)
<!-- mcp-name: io.github.meob/pg-cve-mcp -->
**Give your AI assistant direct access to PostgreSQL security intelligence: CVEs, yanked releases, known exploits, and upgrade paths for any version — queried, not browsed.**
---
## Why pg-cve-mcp?
Browsing a CVE dashboard is a human habit. **Agents need answers, not pages.**
`pg-cve-mcp` turns the curated dataset of the [**PG_CVE**](https://github.com/meob/PG_CVE) project — the same one powering the [PostgreSQL CVE Dashboard](https://meob.github.io/PG_CVE/) — into MCP tools that any AI assistant (opencode, Claude Desktop, etc.) can call directly. What was a static page becomes a first-class, programmatic part of your AI workflow.
Unlike raw NVD feeds, the PG_CVE dataset is **manually curated** to carry the same judgment a careful DBA would apply:
- **Yanked releases** flagged with the real reason (e.g. *"Data corruption using CONCURRENTLY"*)
- **Known exploits** confirmed to exist in the wild
- **EOL branches** marked, with a synthetic `CVE-EOL-WARNING` (CVSS 10.0) prepended to unsupported reports
- **Verified CVEs** — no false positives from automated scraping
### What your agent can now do
| Prompt to your agent | Tool used | Result |
|---|---|---|
| "Is PostgreSQL 15.8 safe?" | `get_cves("15.8")` | EOL/yanked flags, release date, full CVE list sorted by CVSS |
| "Compare 16.3 vs 16.4" | `compare_versions("16.3", "16.4")` | fixed / new / still-present CVEs with release dates |
| "Should I upgrade from 14.10?" | `get_upgrade_path("14.10")` | recommended target + the CVEs it fixes + release dates |
| "Any known exploits right now?" | `get_exploits()` | all exploitable CVEs, sorted by CVSS, with release dates |
| "What does this database track?" | `get_summary()` | stats, EOL and yanked-release overview |
### Agent-first design
Every tool returns **structured JSON**, sorted by CVSS (highest first). Tools flag *yanked* and *EOL* state explicitly on the version metadata, and include **release dates** for every version. `get_upgrade_path` distinguishes a safe **minor** upgrade from a forced **major** one when a branch is at or near end-of-life — so the agent can give advice, not just data.
See real tool outputs in the [live demo](docs/demo.md).
---
## Quick Start
```bash
pip install pg-cve-mcp
pg-cve-mcp
```
Or with `npx` (no install):
```bash
npx -y pg-cve-mcp
```
## MCP Tools
| Tool | Description |
|------|-------------|
| `get_cves(version)` | Complete security report for a version: EOL/yanked status, release date, stats, CVEs sorted by CVSS (a synthetic `CVE-EOL-WARNING` at 10.0 is prepended for unsupported releases) |
| `compare_versions(v1, v2)` | Side-by-side CVE comparison (fixed/new/still present) with yanked & EOL flags and release dates |
| `get_upgrade_path(from_version)` | Recommended upgrade (minor by default; major when EOL or next-to-EOL) with fixed CVEs and release dates |
| `get_exploits()` | All CVEs with known public exploits, sorted by CVSS, with release dates |
| `get_summary()` | Overview of the tracked CVE database incl. yanked releases |
## Transports
### stdio (default)
Run locally over stdio for opencode, Claude Desktop, and other stdio MCP clients:
```bash
pip install -e .
pg-cve-mcp
```
### Streamable HTTP (self-hosted)
For remote or enterprise deployments, serve the same tools over HTTP. Run
`python run_server.py` (or build the Dockerfile); the server listens on `$PORT`
(default 8000) at path `/mcp`:
```bash
python run_server.py
# MCP endpoint: http://127.0.0.1:8000/mcp
```
Configure any MCP client with the URL, e.g. in `opencode.json`:
```json
{
"mcp": {
"pg-cve-mcp": {
"type": "remote",
"url": "http://127.0.0.1:8000/mcp"
}
}
}
```
## Configuration
| Env Var | Default | Description |
|---------|---------|-------------|
| `PG_CVE_MCP_TTL` | `86400` | Cache TTL in seconds for CVE data |
| `PG_CVE_MCP_DATA_URL` | `https://meob.github.io/PG_CVE/postgresql_cves.json` | CVE data source URL |
| `PORT` | `8000` | HTTP port for the Streamable HTTP server (`run_server.py`) |
## Development
Run the test suite and linters:
```bash
python -m pytest
ruff check src tests
mypy src
```
## Data Source
Data is fetched from the [PG_CVE](https://github.com/meob/PG_CVE) project's GitHub Pages with local caching. Falls back to a bundled copy if the network is unavailable.
## Example Prompts
> "What CVEs affect PostgreSQL 16.4?"
>
> "Is PostgreSQL 15.8 safe to use?"
>
> "Compare CVEs in 16.3 vs 16.4"
>
> "What's the upgrade path from PostgreSQL 14.10?"
## License
Apache 2.0