prest Set up AI / MCP access for pREST
When to use
- User wants an agent to work with a pREST-backed PostgreSQL API
- User asks for MCP configuration with pREST
- User wants a read-only local AI-safe setup
Important: what this plugin does not do
This plugin provides guidance only. It does not run pREST or implement MCP tools. pREST exposes the actual HTTP MCP endpoint at /_mcp. The prest-mcp adapter bridges stdio MCP clients to that HTTP endpoint.
Ask first
- Where is pREST running? (local binary, Docker, remote URL)
- Is the goal schema exploration, querying via
/_QUERIES, MCP tools, or all of the above? - Can they create a read-only Postgres role?
- Does their MCP client need stdio (use
prest-mcp) or can it connect to HTTP/_mcpdirectly?
Recommended approach
A. pREST HTTP MCP (preferred)
pREST exposes MCP at /_mcp on the running instance. Point HTTP-capable clients at:
http://localhost:3000/_mcp
Use authentication (JWT, token, or network isolation) in every non-local deployment.
B. stdio bridge with prest-mcp
For stdio MCP clients (including many OpenClaw embedded setups):
brew install prest/tap/prest-mcp
PREST_MCP_URL=http://localhost:3000/_mcp prest-mcp
Environment variables:
| Variable | Required | Purpose |
|---|---|---|
PREST_MCP_URL |
Yes | Full URL to pREST MCP, e.g. http://localhost:3000/_mcp |
PREST_MCP_TOKEN |
No | Bearer token when pREST MCP requires auth |
PREST_MCP_TIMEOUT_MS |
No | Request timeout override |
MCP Registry name for registry-aware clients: io.github.prest/prest
Example OpenClaw MCP config shape (see examples/mcp-readonly/openclaw-mcp.example.json):
{
"mcpServers": {
"prest": {
"command": "prest-mcp",
"env": {
"PREST_MCP_URL": "${PREST_MCP_URL}",
"PREST_MCP_TOKEN": "${PREST_MCP_TOKEN}"
}
}
}
}
Use env substitution; never hardcode passwords or tokens.
C. Safe pREST HTTP for agents (without MCP)
- Create a read-only Postgres role and use it as
PREST_PG_USER. - Set
access.restrict = truewith read-only[[access.tables]]entries. - Tighten
[expose]if catalog listing should be limited. - Bind to localhost for demos; never publish without auth.
- Verify with
GET /_healthorGET /_ready, then a narrow GET.
D. Fallback: read-only Postgres MCP (secondary)
If HTTP MCP or prest-mcp is unavailable, a read-only Postgres MCP server is an interim option. Prefer pREST MCP so JWT/ACL stay centralized. See examples/mcp-readonly/postgres-mcp.example.json.
Safety
- Prefer read-only credentials always.
- Never suggest exposing MCP or Postgres ports publicly without authentication.
- Prefer local examples before remote/production.
- Call out that write-capable DSNs in MCP are a critical risk.