PostgreSQL CVE & Release Intelligence

io.github.meob由 GitHub 账号 meob 发布v1.0.4更新于 Oct 24, 2026

PostgreSQL security for AI agents: CVEs, yanked releases, exploits, and upgrade paths

已验证STDIO仅桌面数据库安全与监控

概览

AI 生成的概览

本地 MCP 服务器，为助手提供结构化的 PostgreSQL 安全情报：各版本 CVE、被撤回的发布、已知漏洞利用与升级路径。

可以做什么
  • 查询某个版本的安全报告：EOL 与被撤回标记、发布日期、统计信息及按 CVSS 排序的 CVE
  • 对比两个版本，列出已修复、新增和仍存在的 CVE
  • 获取从某版本出发的推荐升级路径及其修复的 CVE
  • 列出所有存在公开已知利用的 CVE，按 CVSS 排序
  • 查看所跟踪 CVE 数据库的概览，包括被撤回的发布
适用场景
当助手需要回答某个 PostgreSQL 版本是否安全、两个版本之间有何变化、或应升级到哪个版本时适用，可获得经过人工整理的回答，而非原始 NVD 数据流。
运行要求
通过 PyPI 包 pg-cve-mcp（Python）以 stdio 在本地运行，也可自托管为 Streamable HTTP 服务。需要网络访问以获取 CVE 数据集，网络不可用时回退到内置副本。可选环境变量 PG_CVE_MCP_DATA_URL、PG_CVE_MCP_TTL 和 PORT。未声明任何认证。
安装前请注意
仅做只读查询，但会从远程 URL 获取 CVE 数据集；若将 PG_CVE_MCP_DATA_URL 指向其他主机，该主机将提供助手所依赖的安全数据。缓存数据在 TTL 到期前可能落后于数据源。

安装

在 SourceWeft 中

  1. 打开 控制台中的 PostgreSQL CVE & Release Intelligence，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

pg-cve-mcp — PostgreSQL CVE & Release Intelligence for AI Agents

[PyPI version] [Python versions] [License]

Give your AI assistant direct access to PostgreSQL security intelligence: CVEs, yanked releases, known exploits, and upgrade paths for any version — queried, not browsed.

Why pg-cve-mcp?

Browsing a CVE dashboard is a human habit. Agents need answers, not pages.

pg-cve-mcp turns the curated dataset of the PG_CVE project — the same one powering the PostgreSQL CVE Dashboard — into MCP tools that any AI assistant (opencode, Claude Desktop, etc.) can call directly. What was a static page becomes a first-class, programmatic part of your AI workflow.

Unlike raw NVD feeds, the PG_CVE dataset is manually curated to carry the same judgment a careful DBA would apply:

  • Yanked releases flagged with the real reason (e.g. "Data corruption using CONCURRENTLY")
  • Known exploits confirmed to exist in the wild
  • EOL branches marked, with a synthetic CVE-EOL-WARNING (CVSS 10.0) prepended to unsupported reports
  • Verified CVEs — no false positives from automated scraping

What your agent can now do

Prompt to your agentTool usedResult
"Is PostgreSQL 15.8 safe?"get_cves("15.8")EOL/yanked flags, release date, full CVE list sorted by CVSS
"Compare 16.3 vs 16.4"compare_versions("16.3", "16.4")fixed / new / still-present CVEs with release dates
"Should I upgrade from 14.10?"get_upgrade_path("14.10")recommended target + the CVEs it fixes + release dates
"Any known exploits right now?"get_exploits()all exploitable CVEs, sorted by CVSS, with release dates
"What does this database track?"get_summary()stats, EOL and yanked-release overview

Agent-first design

Every tool returns structured JSON, sorted by CVSS (highest first). Tools flag yanked and EOL state explicitly on the version metadata, and include release dates for every version. get_upgrade_path distinguishes a safe minor upgrade from a forced major one when a branch is at or near end-of-life — so the agent can give advice, not just data.

See real tool outputs in the live demo.

Quick Start

bash
pip install pg-cve-mcppg-cve-mcp

Or with npx (no install):

bash
npx -y pg-cve-mcp

MCP Tools

ToolDescription
get_cves(version)Complete security report for a version: EOL/yanked status, release date, stats, CVEs sorted by CVSS (a synthetic CVE-EOL-WARNING at 10.0 is prepended for unsupported releases)
compare_versions(v1, v2)Side-by-side CVE comparison (fixed/new/still present) with yanked & EOL flags and release dates
get_upgrade_path(from_version)Recommended upgrade (minor by default; major when EOL or next-to-EOL) with fixed CVEs and release dates
get_exploits()All CVEs with known public exploits, sorted by CVSS, with release dates
get_summary()Overview of the tracked CVE database incl. yanked releases

Transports

stdio (default)

Run locally over stdio for opencode, Claude Desktop, and other stdio MCP clients:

bash
pip install -e .pg-cve-mcp

Streamable HTTP (self-hosted)

For remote or enterprise deployments, serve the same tools over HTTP. Run python run_server.py (or build the Dockerfile); the server listens on $PORT (default 8000) at path /mcp:

bash
python run_server.py# MCP endpoint: http://127.0.0.1:8000/mcp

Configure any MCP client with the URL, e.g. in opencode.json:

json
{  "mcp": {    "pg-cve-mcp": {      "type": "remote",      "url": "http://127.0.0.1:8000/mcp"    }  }}

Configuration

Env VarDefaultDescription
PG_CVE_MCP_TTL86400Cache TTL in seconds for CVE data
PG_CVE_MCP_DATA_URLhttps://meob.github.io/PG_CVE/postgresql_cves.jsonCVE data source URL
PORT8000HTTP port for the Streamable HTTP server (run_server.py)

Development

Run the test suite and linters:

bash
python -m pytestruff check src testsmypy src

Data Source

Data is fetched from the PG_CVE project's GitHub Pages with local caching. Falls back to a bundled copy if the network is unavailable.

Example Prompts

"What CVEs affect PostgreSQL 16.4?"

"Is PostgreSQL 15.8 safe to use?"

"Compare CVEs in 16.3 vs 16.4"

"What's the upgrade path from PostgreSQL 14.10?"

License

Apache 2.0

来源：README.md，提交 e338446

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v1.0.4最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分