setup-mcp

# Set up AI / MCP access for pREST ## When to use - User wants an agent to work with a pREST-backed PostgreSQL API - User asks for MCP configuration with pREST - User wants a read-only local AI-safe setup ## Important: what this plugin does not do This plugin provides **guidance only**. It does not run pREST or implement MCP tools. pREST exposes the actual HTTP MCP endpoint at `/_mcp`. The [`prest-mcp`](https://github.com/prest/prest-mcp-adapter) adapter bridges stdio MCP clients to that HTTP endpoint. ## Ask first 1. Where is pREST running? (local binary, Docker, remote URL) 2. Is the goal schema exploration, querying via `/_QUERIES`, MCP tools, or all of the above? 3. Can they create a read-only Postgres role? 4. Does their MCP client need stdio (use `prest-mcp`) or can it connect to HTTP `/_mcp` directly? ## Recommended approach ### A. pREST HTTP MCP (preferred) pREST exposes MCP at `/_mcp` on the running instance. Point HTTP-capable clients at: ```text http://localhost:3000/_mcp ``` Use authentication (JWT, token, or network isolation) in every non-local deployment. ### B. stdio bridge with prest-mcp For stdio MCP clients (including many OpenClaw embedded setups): ```bash brew install prest/tap/prest-mcp PREST_MCP_URL=http://localhost:3000/_mcp prest-mcp ``` Environment variables: | Variable | Required | Purpose | |----------|----------|---------| | `PREST_MCP_URL` | Yes | Full URL to pREST MCP, e.g. `http://localhost:3000/_mcp` | | `PREST_MCP_TOKEN` | No | Bearer token when pREST MCP requires auth | | `PREST_MCP_TIMEOUT_MS` | No | Request timeout override | MCP Registry name for registry-aware clients: `io.github.prest/prest` Example OpenClaw MCP config shape (see `examples/mcp-readonly/openclaw-mcp.example.json`): ```json { "mcpServers": { "prest": { "command": "prest-mcp", "env": { "PREST_MCP_URL": "${PREST_MCP_URL}", "PREST_MCP_TOKEN": "${PREST_MCP_TOKEN}" } } } } ``` Use env substitution; never hardcode passwords or tokens. ### C. Safe pREST HTTP for agents (without MCP) 1. Create a read-only Postgres role and use it as `PREST_PG_USER`. 2. Set `access.restrict = true` with read-only `[[access.tables]]` entries. 3. Tighten `[expose]` if catalog listing should be limited. 4. Bind to localhost for demos; never publish without auth. 5. Verify with `GET /_health` or `GET /_ready`, then a narrow GET. ### D. Fallback: read-only Postgres MCP (secondary) If HTTP MCP or `prest-mcp` is unavailable, a **read-only** Postgres MCP server is an interim option. Prefer pREST MCP so JWT/ACL stay centralized. See `examples/mcp-readonly/postgres-mcp.example.json`. ## Safety - Prefer read-only credentials always. - Never suggest exposing MCP or Postgres ports publicly without authentication. - Prefer local examples before remote/production. - Call out that write-capable DSNs in MCP are a critical risk.