Mcpg

Please install the `mcpg` MCP server into my current AI client (that's you).

Required prerequisites (do these first if not already done):
- **Install MCPg** — Install the MCPg Python package from PyPI. The README recommends PyPI and also notes uv tool install as an isolated option. Run: `pip install mcpg` (https://pypi.org/project/mcpg/)
- **Provide a PostgreSQL database URL** — Create or obtain a PostgreSQL connection string for the target database. MCPg requires MCPG_DATABASE_URL. Remote hosts require sslmode=require (or stronger) unless insecure TLS checks are explicitly bypassed.

Canonical MCP server config (stdio transport):
- command: `uvx`
- args: ["mcpg"]
- required environment variables:
  - `MCPG_DATABASE_URL`: Primary PostgreSQL DSN for the target database. Supports URI or keyword forms. (example: `postgresql://<user>:<password>@<host>:<port>/<database>?sslmode=require`)
- optional environment variables:
  - `MCPG_ACCESS_MODE`: Access level: read-only, restricted, or unrestricted. Defaults to read-only. (example: `read-only`)
  - `MCPG_TRANSPORT`: Transport mode. Defaults to stdio; can also be streamable-http or sse. (example: `stdio`)
  - `MCPG_LOG_LEVEL`: Logging level. (example: `INFO`)
  - `MCPG_HTTP_HOST`: Bind address for HTTP transports. (example: `<bind-host>`)
  - `MCPG_HTTP_PORT`: Listen port for HTTP transports. (example: `<port>`)
  - `MCPG_ALLOW_DDL`: Enable DDL-related tools. Requires MCPG_ACCESS_MODE=unrestricted. (example: `true`)
  - `MCPG_ALLOW_SHELL`: Enable subprocess-backed tools such as pg_dump/pg_restore wrappers. (example: `true`)
  - `MCPG_ALLOW_LISTEN`: Enable LISTEN/NOTIFY tools. (example: `true`)
  - `MCPG_AUTH_MODE`: HTTP auth mode: static or oidc. HTTP transports only. (example: `static`)
  - `MCPG_HTTP_AUTH_TOKEN`: Bearer token required when MCPG_AUTH_MODE=static for HTTP transports. (example: `<your-bearer-token>`)
  - `MCPG_OIDC_ISSUER`: OIDC issuer URL. Required when MCPG_AUTH_MODE=oidc. (example: `<your-oidc-issuer-url>`)
  - `MCPG_OIDC_AUDIENCE`: Expected OIDC audience claim. Required when MCPG_AUTH_MODE=oidc. (example: `<your-oidc-audience>`)
  - `MCPG_OIDC_JWKS_URL`: Optional JWKS endpoint override for OIDC. (example: `<your-jwks-url>`)
  - `MCPG_OIDC_ROLE_CLAIM`: JWT claim name whose value is used as the PostgreSQL role. (example: `<your-role-claim-name>`)
  - `MCPG_HTTP_MAX_BODY_BYTES`: Maximum HTTP request body size in bytes. (example: `1048576`)
  - `MCPG_HTTP_ALLOWED_ORIGINS`: Comma-separated CORS allowlist for HTTP transports. (example: `<origin1>,<origin2>`)
  - `MCPG_HTTP_HSTS_MAX_AGE`: HSTS max-age value for HTTP transports. (example: `31536000`)
  - `MCPG_HTTP_REQUEST_TIMEOUT_SECONDS`: Per-request timeout for HTTP transports. (example: `<seconds>`)
  - `MCPG_DEFAULT_ROLE`: Static PostgreSQL role applied to every query. (example: `<postgres-role>`)
  - `MCPG_ALLOWED_ROLES`: Comma-separated allowlist of PostgreSQL roles for multi-tenant use. (example: `<role1>,<role2>`)
  - `MCPG_REPLICA_URLS`: Comma-separated replica PostgreSQL DSNs used for readonly fan-out. (example: `postgresql://<user>:<password>@<host>:<port>/<database>?sslmode=require,postgresql://<user>:<password>@<host>:<port>/<database>?sslmode=require`)
  - `MCPG_POOL_MIN_SIZE`: Minimum connection pool size. (example: `1`)
  - `MCPG_POOL_MAX_SIZE`: Maximum connection pool size. (example: `5`)
  - `MCPG_STATEMENT_TIMEOUT_MS`: Per-session PostgreSQL statement_timeout in milliseconds. (example: `30000`)
  - `MCPG_LOCK_TIMEOUT_MS`: Per-session PostgreSQL lock_timeout in milliseconds. (example: `5000`)
  - `MCPG_ALLOW_INSECURE_TLS`: Bypass remote TLS enforcement checks. (example: `true`)
  - `MCPG_SHUTDOWN_DRAIN_SECONDS`: Graceful shutdown drain timeout. (example: `30`)
  - `MCPG_SHELL_TIMEOUT_SEC`: Timeout for subprocess-backed PostgreSQL client commands when shell tools are enabled. (example: `60`)
  - `MCPG_SHELL_MAX_OUTPUT_BYTES`: Maximum captured subprocess stdout in bytes. (example: `67108864`)
  - `MCPG_SUBPROCESS_BIN_ALLOWLIST`: Comma-separated absolute directories allowed for pg_dump/pg_restore/psql binaries. (example: `<dir1>,<dir2>`)
  - `MCPG_SUBPROCESS_CPU_SECONDS`: Per-child CPU time limit for subprocess tools. (example: `<seconds>`)
  - `MCPG_SUBPROCESS_MEMORY_MB`: Per-child memory limit for subprocess tools. (example: `<megabytes>`)
  - `MCPG_LISTEN_QUEUE_MAX`: Per-channel LISTEN/NOTIFY queue size. (example: `1000`)
  - `MCPG_AUDIT_PERSIST`: Persist run_write and run_ddl audit events to mcpg_audit.events. (example: `true`)
  - `MCPG_AUDIT_REDACT_KEYS`: Comma-separated regex fragments added to the audit secret-name redaction pattern. (example: `<regex1>,<regex2>`)
  - `MCPG_AUDIT_INTEGRITY`: Enable HMAC-chained audit integrity verification. (example: `true`)
  - `MCPG_AUDIT_HMAC_KEY`: Secret key for audit HMAC chaining. Required when MCPG_AUDIT_INTEGRITY=true. (example: `<your-audit-hmac-key>`)
  - `MCPG_SECRETS_BACKEND`: Secrets backend: env or file. (example: `env`)
  - `MCPG_SECRETS_FILE_PATH`: Path to JSON or YAML secrets file. Required when MCPG_SECRETS_BACKEND=file. (example: `<path-to-secrets-file>`)
  - `MCPG_RATE_LIMIT_ENABLED`: Enable token-bucket per-tool rate limiting. (example: `true`)
  - `MCPG_RATE_LIMIT_MAX_REQUESTS`: Global request cap per rate-limit window. (example: `60`)
  - `MCPG_RATE_LIMIT_WINDOW_SECONDS`: Global rate-limit window length in seconds. (example: `60`)
  - `MCPG_RATE_LIMIT_HEAVY_MAX`: Rate-limit cap for heavy tools. (example: `5`)
  - `MCPG_RATE_LIMIT_HEAVY_WINDOW`: Rate-limit window for heavy tools. (example: `60`)
  - `MCPG_CACHE_ENABLED`: Enable adaptive caching. (example: `true`)
  - `MCPG_CACHE_TTL_SECONDS`: Default cache TTL in seconds. (example: `300`)
  - `MCPG_CACHE_MAXSIZE`: Maximum in-memory LRU cache size. (example: `1024`)
  - `MCPG_REDIS_URL`: Optional Redis connection string for external caching. (example: `redis://<host>:<port>/<db>`)
  - `MCPG_ENABLE_HEAVY_DIAGNOSTICS`: Toggle heavy diagnostic and advisor tools. (example: `true`)
  - `ANTHROPIC_API_KEY`: Anthropic API key for NL→SQL provider support. (example: `<your-anthropic-api-key>`)
  - `OPENAI_API_KEY`: OpenAI API key for NL→SQL provider support. (example: `<your-openai-api-key>`)
  - `GEMINI_API_KEY`: Google Gemini API key for NL→SQL provider support. (example: `<your-gemini-api-key>`)
  - `GOOGLE_API_KEY`: Alternative Google API key variable for Gemini support. (example: `<your-google-api-key>`)
  - `MCPG_NL2SQL_PROVIDER`: Default NL→SQL provider: anthropic, openai, or gemini. (example: `openai`)
  - `MCPG_NL2SQL_API_KEY`: Explicit API key for the configured MCPG_NL2SQL_PROVIDER. Requires MCPG_NL2SQL_PROVIDER to be set. (example: `<your-nl2sql-api-key>`)
  - `MCPG_NL2SQL_MODEL`: Override model for the default NL→SQL provider. (example: `<model-name>`)
  - `MCPG_NL2SQL_BASE_URL`: OpenAI-compatible base URL override for the openai NL→SQL provider. (example: `<your-openai-compatible-base-url>`)
  - `MCPG_NL2SQL_MAX_TOKENS`: Maximum generated tokens for NL→SQL. (example: `2048`)

Note: README recommends installing from PyPI, but the quick-start stdio config uses `uvx mcpg` as the client command. MCPg supports stdio, streamable HTTP, and SSE; stdio is the default transport. For HTTP, set MCPG_TRANSPORT=streamable-http or MCPG_TRANSPORT=sse and configure MCPG_HTTP_PORT. Authorization header is only needed when HTTP auth is enabled. X-MCPG-Role is relevant for multi-tenant role routing when allowed roles are configured.

Add this MCP server to my current client's config in the correct format for you. If you need secrets or credentials I haven't provided, ASK me — do not invent values or leave raw placeholders. After adding it, tell me how to verify the server is connected.