Safe AI-Assisted PostgreSQL Troubleshooting with MCP

AI agents are becoming increasingly capable at operational tasks: summarizing logs, analyzing query plans, identifying anomalies, and assisting with incident response. For databases, the opportunity is obvious. The more interesting question isn't whether an LLM can help analyze a production database. It can. The harder question is how to let it do so safely. This talk examines that problem through the lens of Model Context Protocol (MCP), using `postgres-mcp` as a concrete case study. We'll walk through what "restricted mode" actually means in practice: a read-only transaction at the database level, a second validation layer that parses SQL using PostgreSQL's grammar via `pglast`, and execution time limits as a third line of defense. We will see why the first layer alone isn't enough. A carefully crafted multi-statement input can terminate a read-only transaction and execute a destructive statement in a new one. Grammar-level parsing closes that gap and provides stronger guarantees about what an agent is allowed to execute. From there, we'll look at how the same principle separating measurement from reasoning , extends to performance tuning. Using `hypopg`, an agent can evaluate thousands of hypothetical indexes without writing anything to disk, while a greedy search strategy adapted from the Anytime Algorithm allows it to efficiently explore the search space. Finally, we will discuss the limitations that remain: prompt injection originating from table data rather than the prompt itself, session-scoped assumptions breaking under PgBouncer transaction pooling, and why the interpretation layer remains fundamentally probabilistic even when the measurements underneath it are exact. Attendees will leave with a practical framework for thinking about AI agents in production systems: where hard guarantees are possible, where they are not, and how to design database tooling that safely combines deterministic measurements with probabilistic reasoning.