| name | setup-mcp |
| description | Connect OpenClaw or other AI tools to pREST MCP safely. Use when setting up prest-mcp, /_mcp, or read-only agent database access. |
Set up AI / MCP access for pREST
When to use
- User wants an agent to work with a pREST-backed PostgreSQL API
- User asks for MCP configuration with pREST
- User wants a read-only local AI-safe setup
Important: what this plugin does not do
This plugin provides guidance only. It does not run pREST or implement MCP tools. pREST exposes the actual HTTP MCP endpoint at /_mcp. The prest-mcp adapter bridges stdio MCP clients to that HTTP endpoint.
Ask first
- Where is pREST running? (local binary, Docker, remote URL)
- Is the goal schema exploration, querying via
/_QUERIES, MCP tools, or all of the above?
- Can they create a read-only Postgres role?
- Does their MCP client need stdio (use
prest-mcp) or can it connect to HTTP /_mcp directly?
Recommended approach
A. pREST HTTP MCP (preferred)
pREST exposes MCP at /_mcp on the running instance. Point HTTP-capable clients at:
http://localhost:3000/_mcp
Use authentication (JWT, token, or network isolation) in every non-local deployment.
B. stdio bridge with prest-mcp
For stdio MCP clients (including many OpenClaw embedded setups):
brew install prest/tap/prest-mcp
PREST_MCP_URL=http://localhost:3000/_mcp prest-mcp
Environment variables:
| Variable | Required | Purpose |
|---|
PREST_MCP_URL | Yes | Full URL to pREST MCP, e.g. http://localhost:3000/_mcp |
PREST_MCP_TOKEN | No | Bearer token when pREST MCP requires auth |
PREST_MCP_TIMEOUT_MS | No | Request timeout override |
MCP Registry name for registry-aware clients: io.github.prest/prest
Example OpenClaw MCP config shape (see examples/mcp-readonly/openclaw-mcp.example.json):
{
"mcpServers": {
"prest": {
"command": "prest-mcp",
"env": {
"PREST_MCP_URL": "${PREST_MCP_URL}",
"PREST_MCP_TOKEN": "${PREST_MCP_TOKEN}"
}
}
}
}
Use env substitution; never hardcode passwords or tokens.
C. Safe pREST HTTP for agents (without MCP)
- Create a read-only Postgres role and use it as
PREST_PG_USER.
- Set
access.restrict = true with read-only [[access.tables]] entries.
- Tighten
[expose] if catalog listing should be limited.
- Bind to localhost for demos; never publish without auth.
- Verify with
GET /_health or GET /_ready, then a narrow GET.
D. Fallback: read-only Postgres MCP (secondary)
If HTTP MCP or prest-mcp is unavailable, a read-only Postgres MCP server is an interim option. Prefer pREST MCP so JWT/ACL stay centralized. See examples/mcp-readonly/postgres-mcp.example.json.
Safety
- Prefer read-only credentials always.
- Never suggest exposing MCP or Postgres ports publicly without authentication.
- Prefer local examples before remote/production.
- Call out that write-capable DSNs in MCP are a critical risk.
