# Setup MCP

> Connect OpenClaw or other AI tools to pREST MCP safely. Use when setting up prest-mcp, /_mcp, or read-only agent database access.

- Skill: `prest/setup-mcp` (Agent Skill)
- Install (CLI): `npx skillmds@latest add prest/setup-mcp`
- Raw SKILL.md: https://api.skillmd.com/api/skills/prest/setup-mcp/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: prest (https://skillmd.com/u/prest)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/prest/setup-mcp

---


# Set up AI / MCP access for pREST

## When to use

- User wants an agent to work with a pREST-backed PostgreSQL API
- User asks for MCP configuration with pREST
- User wants a read-only local AI-safe setup

## Important: what this plugin does not do

This plugin provides **guidance only**. It does not run pREST or implement MCP tools. pREST exposes the actual HTTP MCP endpoint at `/_mcp`. The [`prest-mcp`](https://github.com/prest/prest-mcp-adapter) adapter bridges stdio MCP clients to that HTTP endpoint.

## Ask first

1. Where is pREST running? (local binary, Docker, remote URL)
2. Is the goal schema exploration, querying via `/_QUERIES`, MCP tools, or all of the above?
3. Can they create a read-only Postgres role?
4. Does their MCP client need stdio (use `prest-mcp`) or can it connect to HTTP `/_mcp` directly?

## Recommended approach

### A. pREST HTTP MCP (preferred)

pREST exposes MCP at `/_mcp` on the running instance. Point HTTP-capable clients at:

```text
http://localhost:3000/_mcp
```

Use authentication (JWT, token, or network isolation) in every non-local deployment.

### B. stdio bridge with prest-mcp

For stdio MCP clients (including many OpenClaw embedded setups):

```bash
brew install prest/tap/prest-mcp
PREST_MCP_URL=http://localhost:3000/_mcp prest-mcp
```

Environment variables:

| Variable | Required | Purpose |
|----------|----------|---------|
| `PREST_MCP_URL` | Yes | Full URL to pREST MCP, e.g. `http://localhost:3000/_mcp` |
| `PREST_MCP_TOKEN` | No | Bearer token when pREST MCP requires auth |
| `PREST_MCP_TIMEOUT_MS` | No | Request timeout override |

MCP Registry name for registry-aware clients: `io.github.prest/prest`

Example OpenClaw MCP config shape (see `examples/mcp-readonly/openclaw-mcp.example.json`):

```json
{
  "mcpServers": {
    "prest": {
      "command": "prest-mcp",
      "env": {
        "PREST_MCP_URL": "${PREST_MCP_URL}",
        "PREST_MCP_TOKEN": "${PREST_MCP_TOKEN}"
      }
    }
  }
}
```

Use env substitution; never hardcode passwords or tokens.

### C. Safe pREST HTTP for agents (without MCP)

1. Create a read-only Postgres role and use it as `PREST_PG_USER`.
2. Set `access.restrict = true` with read-only `[[access.tables]]` entries.
3. Tighten `[expose]` if catalog listing should be limited.
4. Bind to localhost for demos; never publish without auth.
5. Verify with `GET /_health` or `GET /_ready`, then a narrow GET.

### D. Fallback: read-only Postgres MCP (secondary)

If HTTP MCP or `prest-mcp` is unavailable, a **read-only** Postgres MCP server is an interim option. Prefer pREST MCP so JWT/ACL stay centralized. See `examples/mcp-readonly/postgres-mcp.example.json`.

## Safety

- Prefer read-only credentials always.
- Never suggest exposing MCP or Postgres ports publicly without authentication.
- Prefer local examples before remote/production.
- Call out that write-capable DSNs in MCP are a critical risk.