setup-mcp

name	setup-mcp
description	Connect OpenClaw or other AI tools to pREST MCP safely. Use when setting up prest-mcp, /_mcp, or read-only agent database access.

Set up AI / MCP access for pREST

When to use

• User wants an agent to work with a pREST-backed PostgreSQL API
• User asks for MCP configuration with pREST
• User wants a read-only local AI-safe setup

Important: what this plugin does not do

This plugin provides guidance only. It does not run pREST or implement MCP tools. pREST exposes the actual HTTP MCP endpoint at /_mcp. The prest-mcp adapter bridges stdio MCP clients to that HTTP endpoint.

Ask first

1. Where is pREST running? (local binary, Docker, remote URL)
2. Is the goal schema exploration, querying via /_QUERIES, MCP tools, or all of the above?
3. Can they create a read-only Postgres role?
4. Does their MCP client need stdio (use prest-mcp) or can it connect to HTTP /_mcp directly?

Recommended approach

A. pREST HTTP MCP (preferred)

pREST exposes MCP at /_mcp on the running instance. Point HTTP-capable clients at:

http://localhost:3000/_mcp

Use authentication (JWT, token, or network isolation) in every non-local deployment.

B. stdio bridge with prest-mcp

For stdio MCP clients (including many OpenClaw embedded setups):

brew install prest/tap/prest-mcp
PREST_MCP_URL=http://localhost:3000/_mcp prest-mcp

Environment variables:

Variable	Required	Purpose
PREST_MCP_URL	Yes	Full URL to pREST MCP, e.g. http://localhost:3000/_mcp
PREST_MCP_TOKEN	No	Bearer token when pREST MCP requires auth
PREST_MCP_TIMEOUT_MS	No	Request timeout override

MCP Registry name for registry-aware clients: io.github.prest/prest

Example OpenClaw MCP config shape (see examples/mcp-readonly/openclaw-mcp.example.json):

{
  "mcpServers": {
    "prest": {
      "command": "prest-mcp",
      "env": {
        "PREST_MCP_URL": "${PREST_MCP_URL}",
        "PREST_MCP_TOKEN": "${PREST_MCP_TOKEN}"
      }
    }
  }
}

Use env substitution; never hardcode passwords or tokens.

C. Safe pREST HTTP for agents (without MCP)

1. Create a read-only Postgres role and use it as PREST_PG_USER.
2. Set access.restrict = true with read-only [[access.tables]] entries.
3. Tighten [expose] if catalog listing should be limited.
4. Bind to localhost for demos; never publish without auth.
5. Verify with GET /_health or GET /_ready, then a narrow GET.

D. Fallback: read-only Postgres MCP (secondary)

If HTTP MCP or prest-mcp is unavailable, a read-only Postgres MCP server is an interim option. Prefer pREST MCP so JWT/ACL stay centralized. See examples/mcp-readonly/postgres-mcp.example.json.

Safety

• Prefer read-only credentials always.
• Never suggest exposing MCP or Postgres ports publicly without authentication.
• Prefer local examples before remote/production.
• Call out that write-capable DSNs in MCP are a critical risk.