Skip to content
anlyon.dev

pg.ddx.io: the PostgreSQL community's memory

io.ddx.pg/archivepg.ddx.iostreamable-httpv2026.10.22Scanned

Every PostgreSQL mailing list since 1991, linked to the commits, code, commitfest and docs.

29 tools: 7 change things and 22 only read.

Tools: 0 delete, 0 irreversible, 7 write, 22 read.
  • Reads private data · 20
  • Reads text others write · 23
  • Can send data out · 0
  • 4 findings

Anlyon alternative

7 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

29 tools

Changes things 7Claude Code: ask
  • blamePer-line blame of a postgres file at any commit (code-history index): the commit that wrote each line, as `git blame` with git's default diff.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Per-line blame of a postgres file at any commit (code-history index): the commit that wrote each line, as `git blame` with git's default diff. ignore_revs (default true) passes through the pgindent/reformat commits of .git-blame-ignore-revs when they replaced lines one-for-one; reverse adds the commit that removed each line later on the version's branch. At most 2000 lines per call; commits lists author, date and subject per short sha. Not the same as git_blame, which returns a file's commit history.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • commit_buildfarm_statusBuildfarm results for one PostgreSQL commit: every animal that built it, with branch, status (passed/failed/flapping), the failing stage and the log url, plus a {passed, failed, fl…Reads text others write1 finding

    Why it is in this group

    • The name "commit_buildfarm_status" says "commit": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "commit_buildfarm_status" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "commit_buildfarm_status" says "commit": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Buildfarm results for one PostgreSQL commit: every animal that built it, with branch, status (passed/failed/flapping), the failing stage and the log url, plus a {passed, failed, flapping, unknown} rollup. commit_sha is a SHA (>= 7 hex) or a branch, tag or major version (17, 9.6) for the commit it points at. Cite the commit SHA and the log urls.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • commit_historyEverything linked to one commit: subject, author and date with its sha, the mail thread its Discussion: link names (participants resolved to people and organizations), the commitfe…Reads text others write1 finding

    Why it is in this group

    • The name "commit_history" says "commit": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "commit_history" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "commit_history" says "commit": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Everything linked to one commit: subject, author and date with its sha, the mail thread its Discussion: link names (participants resolved to people and organizations), the commitfest entry if tracked, and Discord mentions. commit_id takes a SHA (>= 7 hex), branch, tag, major version (17, 9.6), <ref>~N or a commit_id from another tool; repository defaults to postgres. The diff itself is not included (git_diff, or git_show_file for one file). Cite the sha and the thread's https://postgr.es/m/<message_id>.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • cross_referenceWhat relates to one stored item.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    What relates to one stored item. ref: a Message-ID or message URL, a commit SHA, repo@sha or commit URL, a docs URL or page.html, a wiki URL or title, a commitfest URL, or CVE-YYYY-NNNNN. Returns the related mail threads, commits, docs pages, wiki pages, commitfest entries and people, each listing why, strongest first: explicit links (Discussion: trailers, messages citing the SHA, commitfest thread links, pages linking the URL, commits to a docs page's SGML), shared identifiers (BUG #N, CVE ids, code identifiers), then similar topic by embeddings. kinds narrows; limit_per_kind (default 5, max 25); version picks the docs release. ~3 s budget: late kinds go in timed_out with partial=true. Cite each item's url. Same as GET /api/v2/related.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • git_logCommit history like `git log`, newest first, filtered by path (commits touching a file), author (substring), since/until (YYYY-MM-DD or RFC 3339) and branch (any branch, tag or maj…Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "git_log" says "log": a word for reading.
    • The description's first verb is "commit": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • private-dataThe description's first sentence says "commit": it reads repositories.
    • private-dataThe input names a repository (input.repository), and the tool reads: it reads repositories.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "git_log" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "git_log" says "log": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Commit history like `git log`, newest first, filtered by path (commits touching a file), author (substring), since/until (YYYY-MM-DD or RFC 3339) and branch (any branch, tag or major version such as 17 or 9.6; default the indexed default branch). Each commit: sha (40-hex, cite it), commit_id, message (subject for a branch log), author and dates. limit default 50, max 200; offset pages; has_more. repository defaults to postgres.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • retrieve_contextSTART HERE for a question about PostgreSQL.Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "retrieve_context" says "retrieve": a word for reading.
    • The description's first verb is "start": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • private-dataThe description's first sentence says "sql": it reads databases.
    • private-dataThe input names an inbox (input.inbox), and the tool reads: it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "retrieve_context" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "retrieve_context" says "retrieve": a word for reading.

      What this check looks for
    Description, as the server wrote it
    START HERE for a question about PostgreSQL. Searches every mailing list (inbox narrows it) with hybrid keyword + semantic ranking and returns cited passages that fit token_budget (default 4000, max 32000): one passage per thread, each the author's own words (quotes, signature and patch removed, cut at ~1200 chars) with url, inbox, message_id, from and date. found=false with a reason when the archive does not appear to discuss the question, instead of weak matches. Retrieval only: write the answer yourself. Cite each claim with its passage url or https://postgr.es/m/<message_id>; open a thread with get_thread.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
  • whats_newCatch up: everything a person or group did, and where they were named, in a window, newest first per kind (mail grouped by thread).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Catch up: everything a person or group did, and where they were named, in a window, newest first per kind (mail grouped by thread). who: a name (fuzzy; close matches return ambiguous [{name, hash}]), email, hash:<8 hex>, team:<slug>, org:<name>, new:<window>, a phrase ('the core team'), or a list. since/until: ISO date, today, 2w/14d/1m, pg19 (a release's development window), all; default 14 days. during: a calendar event uid/url. topic narrows by hybrid search. Kinds: waiting (one person, no topic: what is on their radar, each with group, priority 0-100 and why), mail_from, mail_to_cc, mail_mention, git_author, git_credit, git_mention, wiki_edit, wiki_mention, commitfest, calendar, roster. Names, page hashes and urls only, never addresses. ~4 s budget; late kinds go in timed_out with partial=true. Cite each item's url. Same as GET /api/v2/activity.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
Only reads 22Show 22 read-only tools
  • find_failing_patchesCommitfest entries whose latest cfbot build fails on at least one platform: cf_id, title, entry_status and commitfest_number.Reads text others writeNo findings

    Why it is in this group

    • The name "find_failing_patches" says "find": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Commitfest entries whose latest cfbot build fails on at least one platform: cf_id, title, entry_status and commitfest_number. entry_status filters (default the active reviewable statuses, e.g. needs-review, ready-for-committer); platform narrows to one CI platform; limit caps the list. Cite https://commitfest.postgresql.org/patch/<cf_id>/.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • get_attachmentThe content of one attachment of a mail message (a patch, a log, a test case), chosen by 1-based index or a filename substring, as listed in get_message/get_thread attachments.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_attachment" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "mail": it reads mail.
    • private-dataThe input names an inbox (input.inbox), and the tool reads: it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    The content of one attachment of a mail message (a patch, a log, a test case), chosen by 1-based index or a filename substring, as listed in get_message/get_thread attachments. Text attachments come back as decoded text (a .patch is ready to read or `git apply`), binary ones as base64 with encoding=base64; size is the decoded byte count. Cite the message as https://postgr.es/m/<message_id>.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • get_callersReverse call graph: the symbols that call or reference qualified_name (from search_symbols), each with its file and lines, like `git grep -w <name>` restricted to call sites.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_callers" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "file": it reads files.
    • private-dataThe input names a repository (input.repository), and the tool reads: it reads repositories.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reverse call graph: the symbols that call or reference qualified_name (from search_symbols), each with its file and lines, like `git grep -w <name>` restricted to call sites. HEAD only; macro expansion and function pointers are not followed. limit caps the list. Read a caller with git_show_file at its line.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • get_commitOne postgres commit from the code-history index: message, parsed trailers (names only), Discussion threads (links to the archived thread on /m/), back-patch siblings on other branc…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_commit" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_commit" says "get" and "commit": it reads repositories.
    • private-dataThe description's first sentence says "commit": it reads repositories.
    • private-dataThe input names a repository (input.repository), and the tool reads: it reads repositories.
    • untrusted-inputThe description's first sentence says "message": it reads messages, which other people can write.
    Description, as the server wrote it
    One postgres commit from the code-history index: message, parsed trailers (names only), Discussion threads (links to the archived thread on /m/), back-patch siblings on other branches, the first release tag on each branch that contains it, files changed with line counts, and its diff rendered from the index (at most 3000 lines; diff_complete says whether it was cut). Accepts a SHA (7+ hex), branch, tag or any version form.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_contributorA contributor's profile by email (exact) or name (substring): canonical name, page hash, totals and per-release counts by role (authored, reviewed, committed, reported, ...), the 5…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_contributor" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    A contributor's profile by email (exact) or name (substring): canonical name, page hash, totals and per-release counts by role (authored, reviewed, committed, reported, ...), the 5 latest credited commits with sha, and buildfarm animals they own. People who hid their page are excluded from name lookups. For what they did recently use whats_new. Cite https://pg.ddx.io/community/<hash>.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • get_doc_pageOne PostgreSQL documentation page as text: path (e.g.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_doc_page" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_doc_page" says "get" and "doc": it reads documents.
    • private-dataThe description's first sentence says "sql": it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One PostgreSQL documentation page as text: path (e.g. "brin.html" or "sql-createtable.html") and optional version ("17", "current"; default the latest). Returns its url, path and stored text (body) with fetched_at. Use search_docs to find the path. Cite the returned url.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • get_entryOne commitfest entry by cf_id (the number in commitfest.postgresql.org/patch/<cf_id>/): title, status, commitfest, authors, reviewers, committer, its mail threads and branches.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_entry" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "mail": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    One commitfest entry by cf_id (the number in commitfest.postgresql.org/patch/<cf_id>/): title, status, commitfest, authors, reviewers, committer, its mail threads and branches. Read the thread with get_thread; cfbot state with find_failing_patches. Cite https://commitfest.postgresql.org/patch/<cf_id>/.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • get_messageOne mail message by Message-ID: headers, in_reply_to/references, decoded body text (by default the author's own words: quotes, signature and inline patch removed; full_text=true fo…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_message" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_message" says "get" and "message": it reads messages.
    • private-dataThe description's first sentence says "mail": it reads mail.
    • private-dataThe input names an inbox (input.inbox), and the tool reads: it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "get_message" says "get" and "message": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    One mail message by Message-ID: headers, in_reply_to/references, decoded body text (by default the author's own words: quotes, signature and inline patch removed; full_text=true for everything, quotes included), attachments [{index, filename, content_type, size}] and has_patch. Never raw MIME: get_attachment returns an attachment's content, get_raw_message the RFC 822 source. Finds the list itself unless inbox is given. Cite as https://postgr.es/m/<message_id>.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • get_threadA mail thread, found by any Message-ID in it, oldest first.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_thread" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_thread" says "get" and "thread": it reads messages.
    • private-dataThe description's first sentence says "mail": it reads mail.
    • private-dataThe input names an inbox (input.inbox), and the tool reads: it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "get_thread" says "get" and "thread": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    A mail thread, found by any Message-ID in it, oldest first. Each message: from, to, cc, date, message_id, decoded body text (by default the author's own words: quoted replies, signature and inline patch removed; full_text=true for the whole decoded text; never raw MIME), attachments [{index, filename, content_type, size}] and has_patch. Paged: 20 messages per call (limit max 500; offset/next_offset/has_more); bodies capped at max_body_chars (default 4000; 0 = no cap; body_truncated marks a cut). include_bodies=false gives a cheap outline. Finds the list itself unless inbox is given. Cite as https://postgr.es/m/<message_id>.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • get_wiki_pageOne wiki.postgresql.org page by title: its latest revision content with author and date.Reads text others writeNo findings

    Why it is in this group

    • The name "get_wiki_page" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One wiki.postgresql.org page by title: its latest revision content with author and date. Titles are as on the wiki ("Don't Do This", "Todo"). Use search_wiki to find a title, get_wiki_history for older revisions. Cite https://wiki.postgresql.org/wiki/<title>.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • list_filesList the files of the postgres source under a directory at any commit, branch, tag or date (code-history index), with line counts; depth folds deeper paths into directories with fi…Reads private dataNo findings

    Why it is in this group

    • The name "list_files" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_files" says "list" and "file": it reads files.
    • private-dataThe description's first sentence says "list" and "file": it reads files.
    • private-dataThe input names a repository (input.repository), and the tool reads: it reads repositories.
    Description, as the server wrote it
    List the files of the postgres source under a directory at any commit, branch, tag or date (code-history index), with line counts; depth folds deeper paths into directories with file counts; glob filters paths.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_sourcesEvery source behind this server with its kind (inbox, repository, docs, wiki, discord), item count, last update and freshness (fresh/stale): the 56 mailing lists, the git repositor…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_sources" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "inbox": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "inbox": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Every source behind this server with its kind (inbox, repository, docs, wiki, discord), item count, last update and freshness (fresh/stale): the 56 mailing lists, the git repositories, the documentation releases, the wiki and Discord. Use it to learn the inbox and repository names other tools accept and how current each is. kind filters; min_items drops small sources.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • read_fileRead a file of the postgres source at any commit, branch, tag or date from the code-history index: numbered lines, at most 2000 per call (page with start_line/end_line), byte-exact…Reads private dataNo findings

    Why it is in this group

    • The name "read_file" says "read": a word for reading.

    What it can reach

    • private-dataThe name "read_file" says "read" and "file": it reads files.
    • private-dataThe description's first sentence says "read" and "file": it reads files.
    • private-dataThe input names a repository (input.repository), and the tool reads: it reads repositories.
    Description, as the server wrote it
    Read a file of the postgres source at any commit, branch, tag or date from the code-history index: numbered lines, at most 2000 per call (page with start_line/end_line), byte-exact to git. Says total_lines and complete; binary files return their metadata only.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • search_commitfestFull-text search of commitfest entries (title first, then author/reviewer/committer names), in the current commitfest by default, or commitfests="all" (back to 2014) or a comma lis…Reads text others writeNo findings

    Why it is in this group

    • The name "search_commitfest" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Full-text search of commitfest entries (title first, then author/reviewer/committer names), in the current commitfest by default, or commitfests="all" (back to 2014) or a comma list of numbers. Websearch syntax: "phrase", -term, or. Each result: cf_id, title, status, commitfest(s), people, last update, the commitfest.postgresql.org patch url and the pg.ddx.io thread link. limit default 20, max 50. Details with get_entry; cite the patch url.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • search_commitsSearch postgres commits (code-history index), newest first, like git log: range (a rev, or A..B; default the newest release branch), message (regex, case-insensitive), author (rege…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "search_commits" says "search": a word for reading.

    What it can reach

    • private-dataThe name "search_commits" says "search" and "commit": it reads repositories.
    • private-dataThe description's first sentence says "search" and "commit": it reads repositories.
    • private-dataThe input names a repository (input.repository), and the tool reads: it reads repositories.
    • untrusted-inputThe description's first sentence says "search" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    Search postgres commits (code-history index), newest first, like git log: range (a rev, or A..B; default the newest release branch), message (regex, case-insensitive), author (regex over author, committer and Author/Co-authored-by/Reviewed-by trailers), paths, since/until (YYYY-MM-DD), changed_lines (a regex an added or removed line matches, as git log -G) and occurrences (a string whose count in a file changed, as git log -S).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • search_docsFull-text search of the PostgreSQL documentation (websearch syntax: "phrase", -term, or), title matches first.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "search_docs" says "search": a word for reading.

    What it can reach

    • private-dataThe name "search_docs" says "search" and "doc": it reads documents.
    • private-dataThe description's first sentence says "sql": it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Full-text search of the PostgreSQL documentation (websearch syntax: "phrase", -term, or), title matches first. Searches the current release unless version (one, e.g. "17") or versions (several) is given; a page matching in several selected versions is one result listing each version and its URL. Returns title, path, url, the versions it matched and a snippet. Read a page with get_doc_page; cite its postgresql.org/docs url.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • search_symbolsFind C functions, macros, types and variables by name in the indexed source (HEAD): BM25 on names, then fuzzy and body matches.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "search_symbols" says "search": a word for reading.

    What it can reach

    • private-dataThe input names a repository (input.repository), and the tool reads: it reads repositories.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Find C functions, macros, types and variables by name in the indexed source (HEAD): BM25 on names, then fuzzy and body matches. Filter by kind (function, struct, macro, ...), language, repository. Each result: qualified_name, name, kind, language, file, start_line and end_line. Like `ctags`/`git grep -w` for definitions. Follow with get_callers, or git_show_file with start_line/end_line to read the body.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • search_wikiFull-text search (websearch syntax) of wiki.postgresql.org.Reads text others writeNo findings

    Why it is in this group

    • The name "search_wiki" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Full-text search (websearch syntax) of wiki.postgresql.org. By default searches each page's current text; history=true searches every revision and returns, per page, the latest matching revision (rev_id, revision_url, author, comment, timestamp, is_current) and how many matched; since/until bound the revision dates. Read a page with get_wiki_page; cite its wiki url.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data20
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write23
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

4 warn
  • Warnretrieve_context

    The server marks "retrieve_context" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "retrieve_context" says "retrieve": a word for reading.

    What this check looks for
  • Warncommit_buildfarm_status

    The server marks "commit_buildfarm_status" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "commit_buildfarm_status" says "commit": a word for a change.

    What this check looks for
  • Warncommit_history

    The server marks "commit_history" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "commit_history" says "commit": a word for a change.

    What this check looks for
  • Warngit_log

    The server marks "git_log" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "git_log" says "log": a word for reading.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 2026.10.22. Values in angle brackets are yours to fill in.

claude mcp add --transport http archive https://pg.ddx.io/mcp
claude mcp add --transport http archive https://pg.ddx.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__archive__find_failing_patches",
      "mcp__archive__get_attachment",
      "mcp__archive__get_callers",
      "mcp__archive__get_contributor",
      "mcp__archive__get_doc_page",
      "mcp__archive__get_entry",
      "mcp__archive__get_message",
      "mcp__archive__get_thread",
      "mcp__archive__get_wiki_page",
      "mcp__archive__git_search",
      "mcp__archive__hybrid_search",
      "mcp__archive__list_sources",
      "mcp__archive__search_commitfest",
      "mcp__archive__search",
      "mcp__archive__search_docs",
      "mcp__archive__search_symbols",
      "mcp__archive__search_wiki",
      "mcp__archive__code_search",
      "mcp__archive__read_file",
      "mcp__archive__list_files",
      "mcp__archive__get_commit",
      "mcp__archive__search_commits"
    ],
    "ask": [
      "mcp__archive__retrieve_context",
      "mcp__archive__commit_buildfarm_status",
      "mcp__archive__commit_history",
      "mcp__archive__git_log",
      "mcp__archive__cross_reference",
      "mcp__archive__whats_new",
      "mcp__archive__blame"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as archive. Review it before you use it.

Capability tags behind 26 rules
  • mcp__archive__retrieve_context private-data, untrusted-input
  • mcp__archive__commit_buildfarm_status untrusted-input
  • mcp__archive__commit_history untrusted-input
  • mcp__archive__find_failing_patches untrusted-input
  • mcp__archive__get_attachment private-data, untrusted-input
  • mcp__archive__get_callers private-data, untrusted-input
  • mcp__archive__get_contributor private-data, untrusted-input
  • mcp__archive__get_doc_page private-data, untrusted-input
  • mcp__archive__get_entry private-data, untrusted-input
  • mcp__archive__get_message private-data, untrusted-input
  • mcp__archive__get_thread private-data, untrusted-input
  • mcp__archive__get_wiki_page untrusted-input
  • mcp__archive__git_log private-data, untrusted-input
  • mcp__archive__git_search private-data, untrusted-input
  • mcp__archive__hybrid_search private-data, untrusted-input
  • mcp__archive__list_sources private-data, untrusted-input
  • mcp__archive__search_commitfest untrusted-input
  • mcp__archive__search private-data, untrusted-input
  • mcp__archive__search_docs private-data, untrusted-input
  • mcp__archive__search_symbols private-data, untrusted-input
  • mcp__archive__search_wiki untrusted-input
  • mcp__archive__code_search private-data
  • mcp__archive__read_file private-data
  • mcp__archive__list_files private-data
  • mcp__archive__get_commit private-data, untrusted-input
  • mcp__archive__search_commits private-data, untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.ddx.pg/archive/verify?hash=6e37fd561ec632c57dcea7f37b391b892d8c84a985d3ab444b173b154f9fdb03" | jq -e '.changed == false'

Pinned hash 6e37fd561ec6, from Oct 23, 2026, 02:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.ddx.pg/archive/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.ddx.pg/archive
[![anlyon.dev](https://anlyon.dev/badge/io.ddx.pg/archive.svg)](https://anlyon.dev/servers/io.ddx.pg/archive)

Source: MCP Registry. Synced Oct 23, 2026, 02:17 UTC.