nexql-mcp

Standalone Postgres MCP server — schema-aware, read-only by default, installable everywhere.

NexQL Pro ships an in-process MCP server locked to VS Code (pro/src/mcp/). This repo extracts that capability into an independent Rust binary any MCP client can spawn: Claude Desktop, Cursor, VS Code Copilot, Zed, etc.

Status: Phases 0–6 + Phase 7 extension cutover (stdio spawn) + Phase 8 HTTP (bearer, sessions, rate limit) + Phase 9 write/admin tools landed. 53 tools across Schema, Query, Context, Perf, Write, and Admin. Full OAuth gateway stays pro-only; session-store LRU eviction cap not yet implemented. See docs/CUTOVER.md.

Why this exists

Competing Postgres MCP servers expose connect → run query → return rows. Models hallucinate table names against schemas that do not exist. NexQL's moat is the offline schema index (TF-IDF, join graph with inferred FKs, value profiles, optional embeddings, RRF fusion) built in pro/src/features/dbindex/. This repo ports that index plus 53 query/schema/DBA/meta tools from Pro into a fast, trivially installable binary.

Architecture

crates/
├── nexql-mcp/      CLI, subcommands, wiring (binary)
├── nexql-proto/    MCP JSON-RPC types, transports
├── nexql-tools/    tool registry, schemas, executors
├── nexql-index/    dbindex port (builder, store, lexical, joins, embed)
├── nexql-conn/     connection resolution, pool, credentials
└── nexql-policy/   access modes, allow/deny, PII, caps, audit
npm/                npx shim (per-platform optionalDependencies)
mcpb/               one-click Claude Desktop bundle
docs/               per-client setup, tool reference

Layering is one-directional: policy + conn are leaves → index → tools → binary. nexql-tools never depends on nexql-proto.

Install

Pick whichever fits your workflow — all methods ship the same binary.

Linux system requirements: prebuilt GNU/Linux binaries target glibc 2.35+ (Ubuntu 22.04, Debian 12, RHEL 9, and newer). Releases from v0.2.1 and earlier were built on Ubuntu 24.04 and require glibc 2.39 — if npm install nexql-mcp fails with GLIBC_2.39 not found, upgrade to the next release, use cargo install (builds from source), or run the Docker image. Musl/static Linux builds are not published yet.

Quick install (Linux / macOS / Windows)

Linux & macOS — downloads the latest release, installs to /usr/local/bin (or ~/.local/bin if sudo is unavailable), then prints setup steps:

curl -fsSL https://raw.githubusercontent.com/NexQL-OSS/mcp/main/scripts/install.sh | bash

Pin a version:

NEXQL_MCP_VERSION=v0.2.2 curl -fsSL https://raw.githubusercontent.com/NexQL-OSS/mcp/main/scripts/install.sh | bash

Windows (PowerShell) — installs to %LOCALAPPDATA%\Programs\nexql-mcp and adds it to your user PATH:

irm https://raw.githubusercontent.com/NexQL-OSS/mcp/main/scripts/install.ps1 | iex

Pin a version:

$env:NEXQL_MCP_VERSION = "v0.2.2"; irm https://raw.githubusercontent.com/NexQL-OSS/mcp/main/scripts/install.ps1 | iex

Or download and run the scripts locally: scripts/install.sh · scripts/install.ps1.

After install

# 1. Verify
nexql-mcp --version

# 2. Test a Postgres connection
nexql-mcp postgres://dev@localhost:5432/appdb doctor

# 3. Wire your MCP client (or run the guided wizard)
nexql-mcp init cursor          # Cursor
nexql-mcp init claude-desktop  # Claude Desktop
nexql-mcp init vscode-copilot  # VS Code Copilot
nexql-mcp tui                  # interactive profile + client wiring

Per-client config paths and paste blocks: docs/clients/README.md.

npm / npx

npx -y nexql-mcp postgres://dev@localhost:5432/appdb   # one-off, no install
npm install -g nexql-mcp                                # or install it once

nexql-mcp is a shim (npm/bin/nexql-mcp.js) that resolves the right prebuilt binary from a per-platform optionalDependency (@nexql/mcp-<os>-<arch>) — no Rust toolchain needed.

uv (PyPI)

uv installs CLI tools from PyPI into isolated environments — same prebuilt binary, no Rust toolchain.

Install uv itself (if needed):

curl -LsSf https://astral.sh/uv/install.sh | sh   # macOS / Linux

irm https://astral.sh/uv/install.ps1 | iex        # Windows

Install nexql-mcp:

uv tool install nexql-mcp
uv tool update-shell    # once, if uv warns the tool bin dir is not on PATH

One-off without installing:

uvx nexql-mcp postgres://dev@localhost:5432/appdb doctor

Pin a version:

uv tool install 'nexql-mcp==0.2.2'

Upgrade later:

uv tool upgrade nexql-mcp

Then follow After install above.

PyPI status: wheels are not published yet. Until the first PyPI release lands, use quick install or npm. Maintainer steps: docs/publish-pypi-uv.md.

cargo (crates.io)

cargo install nexql-mcp

Builds from source, so you need clang/libclang first (pg_query's bindgen requires it):

sudo apt install clang libclang-dev   # Debian/Ubuntu
sudo pacman -S clang                  # Arch

Manual download

Prefer the quick install scripts above. To install by hand, grab the archive for your platform from the Releases page:

Platform	Archive
Linux x64	nexql-mcp-<tag>-x86_64-unknown-linux-gnu.tar.gz
Linux arm64	nexql-mcp-<tag>-aarch64-unknown-linux-gnu.tar.gz
macOS Intel	nexql-mcp-<tag>-x86_64-apple-darwin.tar.gz
macOS Apple Silicon	nexql-mcp-<tag>-aarch64-apple-darwin.tar.gz
Windows x64	nexql-mcp-<tag>-x86_64-pc-windows-msvc.tar.gz

Extract and put nexql-mcp (or nexql-mcp.exe) on your PATH, then follow After install above.

Docker

Prebuilt, published on every release to GHCR:

docker run --rm -i ghcr.io/nexql-oss/mcp:0.2.2 postgres://dev@host.docker.internal:5432/appdb
# or: ghcr.io/nexql-oss/mcp:latest

Or build locally from the distroless Dockerfile:

docker build -t nexql-mcp:0.2.2 .
docker run --rm -i nexql-mcp:0.2.2 postgres://dev@host.docker.internal:5432/appdb

Claude Desktop (MCPB one-click bundle)

Each release attaches a platform .mcpb bundle (nexql-mcp-<vendor>.mcpb) — download the one matching your OS/arch from the Releases page and double-click to install into Claude Desktop. Built from mcpb/manifest.json via scripts/package-mcpb.sh.

Homebrew

No published tap yet — each release renders a formula (Formula/nexql-mcp.rb, via scripts/render-homebrew-formula.sh) and attaches it as a release asset for a future homebrew-tap repo to pick up. Until that tap exists, use the quick install or cargo methods above.

MCP Registry

Listed in the official MCP Registry as io.github.NexQL-OSS/nexql-mcp (server.json), published automatically after each release via GitHub OIDC (no stored credentials) — see .github/workflows/publish-mcp-registry.yml.

• mcp-name: io.github.NexQL-OSS/nexql-mcp

From source

export LIBCLANG_PATH="${LIBCLANG_PATH:-/usr/lib}"   # or your llvm lib dir
cargo build --release -p nexql-mcp
./target/release/nexql-mcp postgres://dev@localhost:5432/appdb

Set up a connection

One-off, no config — pass a connection string directly:

nexql-mcp postgres://dev@localhost:5432/appdb

Saved profiles — put connections in ~/.config/nexql-mcp/config.toml (override the path with NEXQL_MCP_CONFIG):

default_profile = "local"

[profiles.local]
url = "postgres://dev@localhost:5432/appdb"
access_mode = "read"

[profiles.prod]
host = "prod.example.com"
dbname = "app"
user = "readonly_agent"
password_command = "op read op://vault/pg/password"   # never store plaintext secrets
sslmode = "verify-full"
access_mode = "read"
schemas = ["public", "billing"]
deny_tables = ["auth.*"]
pii_columns = ["public.users.ssn", "public.users.email"]
max_rows = 200

Full field reference: docs/config.example.toml. Then run bare (nexql-mcp) to use default_profile, or nexql-mcp --profile prod.

Test a connection before wiring it into a client:

nexql-mcp postgres://dev@localhost:5432/appdb doctor
# or, for a saved profile (note: --profile goes before the subcommand):
nexql-mcp --profile prod doctor

Guided setup — an interactive profile editor plus one-keystroke wiring into whichever clients you use: nexql-mcp tui (see Interactive TUI below).

Wire a client

nexql-mcp postgres://dev@localhost:5432/appdb init cursor

Supported init clients: claude | claude-desktop | claude-code | cursor | vscode | vscode-copilot | zed | windsurf | continue | jetbrains | openai-agents.

Per-client paste blocks: docs/clients/README.md.

Use with the NexQL VS Code extension

If you already use ric-v.postgres-explorer (+ NexQL Pro), you don't need any of the above — the extension can spawn this binary itself and reuse your existing saved connections instead of a separate config.toml.

1. Settings → search NexQL: Mcp: Enabled (postgresExplorer.mcp.enabled) → check it. Off by default.
2. That's it — it takes effect immediately (no reload needed) and picks up every connection already saved in postgresExplorer.connections. It shows up as an MCP server named NexQL in Copilot Chat / agent-mode tool pickers.

The extension resolves the binary in this order: postgresExplorer.mcp.binaryPath setting → NEXQL_MCP_BIN env var → a copy bundled with the extension → whatever nexql-mcp is on your PATH (i.e. anything installed via npm/cargo/curl above). Set postgresExplorer.mcp.binaryPath explicitly if you want the extension to use a specific install.

Interactive TUI

nexql-mcp tui

Guided profile editor: add/edit/delete a connection profile, test-connect it live before saving, then pick any of 7 clients (Claude Desktop, Claude Code, Cursor, VS Code, Copilot Chat, Zed, Windsurf) to wire it into at once. Each selected client's real config file is read, merged (existing unrelated servers are preserved), shown as a diff, and only written after you confirm — a timestamped backup is kept alongside it. continue / jetbrains / openai-agents have no safe on-disk merge target, so those stay copy-paste snippets in the summary screen, same as init.

Keys: n new · e/Enter edit · d delete · t test · w wire into clients · q quit. Bare nexql-mcp (no URL, no flags) launches the TUI automatically when nothing else resolves a connection.

Releases

Pushing a v* tag triggers .github/workflows/release.yml: builds darwin arm64/x64, linux gnu arm64/x64, and windows x64; attaches archives, per-platform .mcpb bundles, a CycloneDX SBOM, and a rendered Homebrew formula to a GitHub release; publishes the npm packages and GHCR image; and publishes the workspace crates to crates.io in dependency order. A follow-up workflow (publish-mcp-registry.yml) then lists the release on the MCP Registry via GitHub OIDC. Linux GNU binaries are built on Ubuntu 22.04 (glibc 2.35). Musl targets remain deferred until a clang-enabled musl builder is validated.

Development

cargo check          # workspace compile
cargo run -p nexql-mcp -- doctor
cargo test -p nexql-mcp -- init_clients
cargo fmt --all
cargo clippy --workspace --all-targets

Read CLAUDE.md and docs/REFERENCE.md before implementing.

License

GPL-3.0-only for all crates in this repo, from v0.2.0 onward. If you distribute this program or a derivative — including bundled inside another application — you must release your source under the GPL as well.

Releases up to and including v0.1.6 were published under Apache-2.0. That grant is irrevocable for those versions and is unaffected by this change.

Copyright is held solely by the NexQL-OSS Team, so commercial licenses that lift the GPL obligation are available on request. Premium extensions (provider embeddings, team sync, hosted gateway) live in a separate proprietary crate.

Roadmap

Phase	Deliverable
0	Spike: tokio-postgres + candle MiniLM proof
1	nexql-conn + nexql-policy + pg_query validator
2	MCP stdio transport + ~8 catalog tools
3	nexql-index (byte-compatible with TS format)
4	Full tool surface, resources, prompts, completions
5	Local embeddings + RRF fusion
6	v1.0 ship: cargo-dist, npm, brew, Docker, MCPB
7	Extension cutover — VS Code spawns binary via stdio MCP definition
8	Streamable HTTP + bearer token (--http / NEXQL_MCP_HTTP_TOKEN) — OAuth gateway = pro
9	Write/admin tools + validate_write_sql (opt-in --access-mode write|admin)

Full plan: internal design doc (federated-greeting-badger). Cutover details: docs/CUTOVER.md.

Reference implementation

TypeScript sources in the sibling nexql-pro checkout (chat still uses these; MCP HTTP stack removed):

• pro/src/mcp/McpDefinitionProvider.ts — stdio spawn of this binary
• pro/src/mcp/NexqlMcpStdioHost.ts — ephemeral profile + binary resolve
• pro/src/providers/chat/tools/ToolSpec.ts
• pro/src/providers/chat/tools/ToolExecutor.ts
• pro/src/features/dbindex/*