Secure Neon access for AI agents
Serverless Postgres projects, branches, SQL, schema migrations, and query tuning via Neon's official MCP server.
Connect Neon to the gateway to give agents governed access to your Neon account — projects, branches, databases, SQL execution, schema migrations, query tuning, and the Neon docs.
Server URL: https://mcp.neon.tech/mcp
Setup
Neon's MCP server supports Dynamic Client Registration, so there's no app to create on Neon's side — the gateway registers an OAuth client automatically per org. See Dynamic client registration.
Dynamic client registration
- In the gateway, open Resources -> Add -> Neon.
- Choose Dynamic Client Registration. The gateway self-registers an OAuth client with Neon; no client ID/secret needed.
- Each user authorizes their own Neon account. The connection is bounded by that user's Neon permissions — no scopes are requested at registration.
Warning: Neon's MCP server runs in write mode and exposes destructive tools (
delete_project,delete_branch,run_sql). Scope them down with a policy before giving agents broad access.
Available tools
| Tool | Access | Description |
|---|---|---|
list_projects | read | List Neon projects in the account |
list_organizations | read | List organizations the user belongs to |
list_shared_projects | read | List projects shared with the user |
describe_project | read | Get a project's branches, databases, and metadata |
create_project | write | Create a new Neon project |
delete_project | delete | Delete a project and all its data |
create_branch | write | Create a branch in a project |
describe_branch | read | Get objects and metadata for a branch |
delete_branch | delete | Delete a branch |
reset_from_parent | write | Reset a branch to its parent's state |
list_branch_computes | read | List compute endpoints for a branch |
run_sql | write | Execute a single SQL statement |
run_sql_transaction | write | Execute multiple SQL statements in a transaction |
explain_sql_statement | read | EXPLAIN/ANALYZE a query plan |
describe_table_schema | read | Describe a table's schema |
get_database_tables | read | List tables in a database |
get_connection_string | read | Get a Postgres connection string (includes credentials) |
compare_database_schema | read | Diff a branch's schema against its parent |
prepare_database_migration | write | Apply a schema migration in a temporary branch |
complete_database_migration | write | Apply a prepared migration to the main branch |
prepare_query_tuning | write | Analyze and tune a query in a temporary branch |
complete_query_tuning | write | Apply or discard tuning changes on the main branch |
list_slow_queries | read | List slow queries (requires pg_stat_statements) |
provision_neon_auth | write | Provision Neon Auth for a project |
configure_neon_auth | write | Configure Neon Auth settings |
get_neon_auth_config | read | Get the current Neon Auth configuration |
provision_neon_data_api | write | Provision the Neon Data API for a branch |
search | read | Search the Neon documentation |
fetch | read | Fetch a Neon docs search result by ID |
list_docs_resources | read | List available Neon docs resources |
get_doc_resource | read | Get Neon docs resources by path |
Policy examples
Read-only Neon access for all agents:
Allow - MCP: neon - Tools: list_*, describe_*, get_*, explain_sql_statement, compare_database_schema, search, fetch - Effect: AllowBlock destructive operations while allowing everything else (higher-priority deny):
Deny - MCP: neon - Tools: delete_*, run_sql, run_sql_transaction - Effect: Deny