PostgreSQL CVE & Release Intelligence

io.github.meob由 GitHub 帳號 meob 發布v1.0.4更新於 Oct 24, 2026

PostgreSQL security for AI agents: CVEs, yanked releases, exploits, and upgrade paths

已驗證STDIO僅桌面資料庫安全與監控

概覽

AI 產生的概覽

本機 MCP 伺服器，為助理提供結構化的 PostgreSQL 安全情報：各版本 CVE、被撤回的發行版、已知漏洞利用與升級路徑。

可以做什麼
  • 查詢某個版本的安全報告：EOL 與被撤回標記、發行日期、統計資料及依 CVSS 排序的 CVE
  • 比較兩個版本，列出已修復、新增與仍存在的 CVE
  • 取得從某版本出發的建議升級路徑及其修復的 CVE
  • 列出所有有公開已知漏洞利用的 CVE，依 CVSS 排序
  • 檢視所追蹤 CVE 資料庫的概況，包含被撤回的發行版
適用情境
適合助理需要回答某個 PostgreSQL 版本是否安全、兩個版本之間有何差異，或該升級到哪個版本時使用，可得到經人工整理的答案，而非原始 NVD 資料流。
執行需求
透過 PyPI 套件 pg-cve-mcp（Python）以 stdio 在本機執行，也可自架為 Streamable HTTP 服務。需要網路連線以取得 CVE 資料集，網路不可用時會退回內建副本。選用環境變數 PG_CVE_MCP_DATA_URL、PG_CVE_MCP_TTL 與 PORT。未宣告任何驗證機制。
安裝前請注意
僅提供唯讀查詢，但會從遠端 URL 取得 CVE 資料集；若將 PG_CVE_MCP_DATA_URL 指向其他主機，該主機將提供助理所依賴的安全資料。快取資料在 TTL 到期前可能落後於資料來源。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 PostgreSQL CVE & Release Intelligence，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

pg-cve-mcp — PostgreSQL CVE & Release Intelligence for AI Agents

[PyPI version] [Python versions] [License]

Give your AI assistant direct access to PostgreSQL security intelligence: CVEs, yanked releases, known exploits, and upgrade paths for any version — queried, not browsed.

Why pg-cve-mcp?

Browsing a CVE dashboard is a human habit. Agents need answers, not pages.

pg-cve-mcp turns the curated dataset of the PG_CVE project — the same one powering the PostgreSQL CVE Dashboard — into MCP tools that any AI assistant (opencode, Claude Desktop, etc.) can call directly. What was a static page becomes a first-class, programmatic part of your AI workflow.

Unlike raw NVD feeds, the PG_CVE dataset is manually curated to carry the same judgment a careful DBA would apply:

  • Yanked releases flagged with the real reason (e.g. "Data corruption using CONCURRENTLY")
  • Known exploits confirmed to exist in the wild
  • EOL branches marked, with a synthetic CVE-EOL-WARNING (CVSS 10.0) prepended to unsupported reports
  • Verified CVEs — no false positives from automated scraping

What your agent can now do

Prompt to your agentTool usedResult
"Is PostgreSQL 15.8 safe?"get_cves("15.8")EOL/yanked flags, release date, full CVE list sorted by CVSS
"Compare 16.3 vs 16.4"compare_versions("16.3", "16.4")fixed / new / still-present CVEs with release dates
"Should I upgrade from 14.10?"get_upgrade_path("14.10")recommended target + the CVEs it fixes + release dates
"Any known exploits right now?"get_exploits()all exploitable CVEs, sorted by CVSS, with release dates
"What does this database track?"get_summary()stats, EOL and yanked-release overview

Agent-first design

Every tool returns structured JSON, sorted by CVSS (highest first). Tools flag yanked and EOL state explicitly on the version metadata, and include release dates for every version. get_upgrade_path distinguishes a safe minor upgrade from a forced major one when a branch is at or near end-of-life — so the agent can give advice, not just data.

See real tool outputs in the live demo.

Quick Start

bash
pip install pg-cve-mcppg-cve-mcp

Or with npx (no install):

bash
npx -y pg-cve-mcp

MCP Tools

ToolDescription
get_cves(version)Complete security report for a version: EOL/yanked status, release date, stats, CVEs sorted by CVSS (a synthetic CVE-EOL-WARNING at 10.0 is prepended for unsupported releases)
compare_versions(v1, v2)Side-by-side CVE comparison (fixed/new/still present) with yanked & EOL flags and release dates
get_upgrade_path(from_version)Recommended upgrade (minor by default; major when EOL or next-to-EOL) with fixed CVEs and release dates
get_exploits()All CVEs with known public exploits, sorted by CVSS, with release dates
get_summary()Overview of the tracked CVE database incl. yanked releases

Transports

stdio (default)

Run locally over stdio for opencode, Claude Desktop, and other stdio MCP clients:

bash
pip install -e .pg-cve-mcp

Streamable HTTP (self-hosted)

For remote or enterprise deployments, serve the same tools over HTTP. Run python run_server.py (or build the Dockerfile); the server listens on $PORT (default 8000) at path /mcp:

bash
python run_server.py# MCP endpoint: http://127.0.0.1:8000/mcp

Configure any MCP client with the URL, e.g. in opencode.json:

json
{  "mcp": {    "pg-cve-mcp": {      "type": "remote",      "url": "http://127.0.0.1:8000/mcp"    }  }}

Configuration

Env VarDefaultDescription
PG_CVE_MCP_TTL86400Cache TTL in seconds for CVE data
PG_CVE_MCP_DATA_URLhttps://meob.github.io/PG_CVE/postgresql_cves.jsonCVE data source URL
PORT8000HTTP port for the Streamable HTTP server (run_server.py)

Development

Run the test suite and linters:

bash
python -m pytestruff check src testsmypy src

Data Source

Data is fetched from the PG_CVE project's GitHub Pages with local caching. Falls back to a bundled copy if the network is unavailable.

Example Prompts

"What CVEs affect PostgreSQL 16.4?"

"Is PostgreSQL 15.8 safe to use?"

"Compare CVEs in 16.3 vs 16.4"

"What's the upgrade path from PostgreSQL 14.10?"

License

Apache 2.0

來源：README.md，提交 e338446

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v1.0.4最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分