用于 TimescaleDB 和 PostgreSQL 数据库的只读 MCP 服务器，作用于调用者的身份
概览
用于 TimescaleDB 和 PostgreSQL 数据库的只读 MCP 服务器。代理获取目录（模式、表、超表、块、连续聚合、后台作业）和一个受保护的 SELECT 表面;服务器接收每个调用背后的联系人，拒绝以无名者身份运行。 基于 mark3labs/mcp-go、giantswarm/mcp-oauth（OAuth 2.1 资源服务器，令牌转发）和 giantswarm/mcp-toolkit（日志、追踪、健康、响应上限和每个工具超时中间件）构建;jackc/pgx 与 PostgreSQL 通信。 每个版本每个平台（mcp-timescale- - ： linux、darwin 和 windows on amd64 和 arm64）都包含一个二进制文件，旁边还有其共同签署的 Sigstore 捆绑包（.bundle）、多架构镜像 gsoci.azurecr.io/giantswarm/mcp-timescale：以及 Giant Swarm 目录中的图表。
概述（AI 翻译）
TimescaleDB 的只读 MCP 服务器 和
PostgreSQL数据库，对呼叫者的身份进行操作。代理获得
目录（模式、表、超表、块、连续聚合，
背景工作）和一个受保护的SELECT表面;服务器会得到该人
每次出勤都背后，拒绝以无名小卒身份参赛。
基于mark3labs/mcp-go，
giantswarm/mcp-oauth（OAuth 2.1
资源服务器，令牌转发）以及
giantswarm/mcp-toolkit（伐木，
追踪、健康、响应上限和每个工具超时中间件）;
jackc/pgx 与 PostgreSQL 通信。
安装
每次发行都有
每个平台（[mcp-timescale- - ）：Linux、Darwin 和
Windows在AMD64和arm64上），与其协同的Sigstore捆绑包相邻
（ .bundle），多拱图像
gsoci.azurecr.io/giantswarm/mcp-timescale: 以及该图表中的
巨型虫群目录。
已安装的二进制文件保持自身最新：
self-update 下载最新版本的二进制文件及其捆绑包
并且只有在捆绑包验证 CircleCI 构建 后才安装
giantswarm/mcp-timescale 反对Sigstore公共利益信托根。A
没有捆绑包的发布，或下载与其签名不符的版本，是
本页由 AI 翻译，技术细节请以原文为准。
README
以下为原文 README 节选，完整内容请查看原文。
mcp-timescale
Read-only MCP server for TimescaleDB and
PostgreSQL databases that acts on the caller’s identity. An agent gets the
catalog (schemas, tables, hypertables, chunks, continuous aggregates,
background jobs) and a guarded SELECT surface; the server gets the person
behind every call and refuses to run as nobody.
Built on mark3labs/mcp-go,
giantswarm/mcp-oauth (OAuth 2.1
resource server, token forwarding) and
giantswarm/mcp-toolkit (logging,
tracing, health, response cap and per-tool timeout middleware);
jackc/pgx talks to PostgreSQL.
Installation
Every release carries
one binary per platform (mcp-timescale--: linux, darwin and
windows on amd64 and arm64) next to its cosign Sigstore bundle
(.bundle), the multi-arch image
gsoci.azurecr.io/giantswarm/mcp-timescale: and the chart in the
Giant Swarm catalog.
# a release binary (verify by hand with cosign v3: verify-blob --bundle .bundle)
curl -fsSLo mcp-timescale https://github.com/giantswarm/mcp-timescale/releases/latest/download/mcp-timescale-linux-amd64
chmod +x mcp-timescale
# or from source
go install github.com/giantswarm/mcp-timescale@latest
An installed binary keeps itself current:
mcp-timescale self-update
self-update downloads the latest release’s binary together with its bundle
and installs it only after the bundle verifies for a CircleCI build of
giantswarm/mcp-timescale against the Sigstore public-good trust root. A
release without a bundle, or a download that does not match its signature, is
refused and the installed binary stays as it is.
CLI
mcp-timescale # same as `mcp-timescale serve`
mcp-timescale serve # --transport stdio|sse|streamable-http, --mcp-addr, --metrics-addr, --databases-file, --debug
mcp-timescale version # version, commit and build time
mcp-timescale self-update # verified update to the latest release
version and --version report the release version; a plain go build
reports Go’s VCS build info (+dirty with untracked files), the generated
make build stamps the same identifiers the CI does (pkg/project).
There is no --read-only or --non-destructive switch as in mcp-capi or
mcp-kubernetes: every tool is read-only by construction, except
timescale_insert_row, which exists only when a database configures an
insert path (see Inserting rows). tools.ReadOnlyTools
and tools.WriteTools are the whole tool classification, the tool tests
安装
docker run -d --name tsdb -e POSTGRES_PASSWORD=pw -p 127.0.0.1:5432:5432 timescale/timescaledb:2.29.2-pg17