Today
~/.config/…/mcp.json "DATABASE_URL": "postgres://app:[email protected]/app" # the password sits there in clear text # the database is private: tunnel needed anyway # and nothing says this is production
An MCP Postgres runs the queries. Kestro holds the door.
They answer different questions. DBHub, Postgres MCP Pro or Supabase MCP can read a schema, explain a plan, suggest an index: Kestro does none of that and will not try. What they lack is any notion of environment: nothing in a connection string says this one leads to production.
macOS 11+ · Windows soon
Where the decision lives
On the left, in a file. On the right, in an application.
A database MCP server is configured with a connection string. It points where you put it, and it will still point there in six months.
With Kestro
Settings › AI: one switch No connection string anywhere. The tunnel is a local door, held by Kestro. Production closed
Point by point
Two tools, two questions.
| A database MCP | With Kestro | |
|---|---|---|
| What it can do | read a schema, run SQL, explain a plan | open the door, and close it |
| Reaching a database with no public address | up to you to build the tunnel: some have one built in | that is precisely the subject |
| Where the credentials live | a connection string in a config file | nowhere: no string, no password |
| Telling production from staging | nothing in the protocol provides for it | a setting, and the only one closed by default |
| Preventing a write | a read-only mode, depending on the server | not applicable: Kestro never touches your data |
| Seeing what the assistant asked for | depending on the server, often nothing | a local log, if you switch it on |
| What it sees beyond the database | nothing: it is a database tool | projects, services, program output |
| Both together | it queries through the local port | Kestro holds that port, and decides it exists |
| Cost | free and open source, mostly | €29.99$29.99£25.99CHF 25.90CA$40.99A$45.99 once |
Checked on 6 August 2026 · Anthropic’s reference Postgres server has been archived since July 2025; DBHub, Postgres MCP Pro and Supabase MCP are the common alternatives
What Kestro adds
Four things a database server cannot know.
None of this is about SQL, which is exactly why none of them deals with it.
The notion of an environment
Every tunnel, service and command carries its label: dev, staging, production, and that is what the barrier reads. A connection string carries nothing: it is an address, and a production address looks exactly like any other.
No secret to copy anywhere
A database password never enters Kestro: the tunnel opens with the tools you have already authenticated, ssh, gcloud, aws, and what the assistant sees is a local port. Nothing to revoke the day a config file ends up in a backup.
The door closes
A configured MCP server stays configured. A tunnel opens and closes with a switch, and the count of what is open lives in the menu bar: including how many doors lead to a production.
The rest of what you run
The database is never alone: there is the dev server that connects to it, the compose stack next door, the command that just failed. Your assistant sees them in the same inventory, and reads their output without being handed a shell.
Kestro1 tunnel open · 1 service isn’t answering
bastion-prodprodSSHshellbastion.kestro.internalclosed
notes-dbstagingPostgreslocalhost:5432pg-staging.eu-west-1.rdsopen
run-eventsprodMongolocalhost:27017mongo-prod.atlasclosed
⌘K palette↑↓ navigate␣ togglecloses if you click elsewhere
run-tracker , zsh
➜
Applying 2 migrations to shop-staging-db…
20240612_add_orders_index ok
done in 1.4s
run-tracker , zsh
# the exact line is in Settings › AI, ready to copy
➜
Added stdio MCP server kestro
On your machine
Everything stays with you.
Your connections run from your computer to your servers, never through us.
No account
Nothing to create, no password.
Your keys stay put
SSH, Google Cloud, AWS: Kestro uses your own tools, locally.
No usage statistics
We don’t know what you open, or when.
One exception
Your licence renews with us. Nothing else leaves.
When a database MCP is still essential
Three cases where Kestro replaces nothing at all.
We will never write a query engine, and it is better said here.
Querying, explaining, indexing
Reading a schema, running a SELECT, analysing an execution plan, proposing an index: that is their job, they do it well, and Kestro does none of it. Connect both, yours will point at the local port Kestro holds.
A database already reachable, with no label to set
A local Postgres in a container, a development database open on the team network: there is no door to open, so nothing Kestro can add. An MCP server is enough.
Anywhere other than a Mac
Kestro is a desktop app, on macOS 11 and later: Windows in the works, Linux not planned. MCP servers run wherever Node or Python runs.
Pricing
You pay once. That’s it.
A tool you open forty times a day shouldn’t send an invoice every month.
Kestro licence
€29.99$29.99£25.99CHF 25.90CA$40.99A$45.99€39.99$39.99£34.99CHF 33.90CA$54.99A$61.99 · Launch offer · upcoming price
1 computer · one-time
- Every feature of the app, no tiers, no “Pro” edition
- One year of updates included, then renew if you want to
- The app stays yours, renewed or not
- One key, the same on all your computers
- Switch machines whenever you like, no limit
- No account to create: the key arrives by email
Or download it for free first →
Refunded within 14 days, no questions asked.
Questions we get
Does Kestro replace my Postgres MCP server?
No, and claiming otherwise would do you a disservice. Kestro runs no query, reads no schema and will never see your data: it opens the door and decides who may go through. The right setup is both together, your database server points at the local port Kestro holds, and reaches nothing while the tunnel is closed.
Concretely, how do I wire them together?
You open the tunnel in Kestro, which gives you a local port: 5432, say. Your MCP server’s connection string points at localhost, that port. While the tunnel is closed, the server reaches nothing: your switch decides, not a config file written six months ago.
Why is the official Postgres server no longer recommended?
It has been deprecated since July 2025 and archived on GitHub, npm and Docker Hub, after a SQL injection was found in it: its read-only transaction could be closed by a COMMIT smuggled into a multi-statement query, and what followed ran with full privileges. It is still installed massively, and that is the heart of the story: nobody re-reads the configuration of a tool that works. Which is exactly why the barrier is better off living somewhere other than that file.
DBHub can open an SSH tunnel, can it not?
It can, and it is a good feature: it can also cap returned rows and enforce read-only at the engine level. What it does not do, nor does any of them, is let you decide, in an application, that production stays closed whatever it is asked. Its tunnel is configured in the same place as its connection string: in a file the assistant can read.
Do my queries go through Kestro?
No. Kestro opens the tunnel, then steps aside: traffic goes from your machine to your database, along the path ssh, gcloud or aws establishes. It reads neither your queries nor your results, and has no way to, it is not an application proxy, it is a door.
Does the trial ask for a card?
No, and it does not ask for an account either. You download, you get 7 full days. No card is asked for until you decide to buy.