Hosting

Remote, Neon-hosted; old local stdio package is deprecated

Transport

Streamable HTTP

Endpoint

https://mcp.neon.tech/mcp

Authentication

OAuth or API key. Supports readonly, projectId, roleName and repeatable category filters. The SSE endpoint is deprecated; use Streamable HTTP.

Requirements

• Neon account and accessible project for database operations
• Compatible remote Streamable HTTP MCP client
• Browser for OAuth, or Neon API key stored locally for non-OAuth clients

Setup steps

1. Add https://mcp.neon.tech/mcp as a remote Streamable HTTP MCP server. For least privilege, use a documented readonly=true and only required category/projectId query parameters.
2. Complete OAuth consent and choose read-only unless write operations are necessary. Alternatively create a least-privilege Neon API key and configure Authorization: Bearer <NEON_API_KEY> in local protected settings.
3. Select only required categories, such as projects, branches, endpoints, querying or schema. An organization/project-scoped key can further limit access.
4. Reconnect and verify with a read-only tool such as list projects, describe schema or a SELECT query. Never use a migration or write tool to test connection.

The official unauthenticated /api/list-tools endpoint returned 127 tools on 2026-10-28 for the unfiltered default endpoint. This snapshot is conditional: readonly, projectId, roleName, category filters, auth grants, plan and regional availability change the exposed set. The docs-page interactive preview showed 119 while the current endpoint returned 127; use the live endpoint for the current inventory.

• list_organizations

  List all organizations the current user belongs to. Supports optional `search` parameter to filter by name or ID.

  01
• run_sql

  Execute one SQL statement on a Neon database. If a prior step created a temporary branch, pass that branch_id. NEVER run destructive SQL autonomously; always ask the user first.

  02
• run_sql_transaction

  Execute multiple SQL statements as one transaction. If a prior step created a temporary branch, pass that branch_id. NEVER run destructive SQL autonomously; always ask the user first.

  03
• describe_table_schema

  Get column definitions, data types, and constraints for a specific table. Do not use when you need all tables in a database (use `get_database_tables` instead).

  04
• get_database_tables

  List all tables in a Neon database. Do not use when you need column-level detail for a specific table (use `describe_table_schema` instead).

  05
• prepare_database_migration

  Apply a schema change on a temporary branch and return a migration_id. Test with run_sql on that branch, ask the user, then complete_database_migration — even if they reject, so the temporary branch is deleted. Pass every field from the prepare response.

  06
• complete_database_migration

  Apply or discard a prepared migration and delete the temporary branch. NEVER run autonomously; always ask the user first. Pass migration_id, migration_sql, database_name, project_id, temporary_branch_id, and parent_branch_id from prepare_database_migration. Set apply_changes false to discard; omitting it applies the migration.

  07
• describe_branch

  Get a tree view of all objects in a branch, including databases, schemas, tables, views, and functions. Do not use when you only need table names (use `get_database_tables` instead) or column detail (use `describe_table_schema` instead).

  08
• get_connection_string

  Get a PostgreSQL connection string for a Neon database. The branch must have a compute endpoint. `create_project` and `create_branch` do not return one; call this after they succeed. Branch, compute, and database are optional and resolved automatically if not specified; `project_id` follows the connection scope. Requires write access: the connection string carries a privileged role password, so it is unavailable in read-only mode. A read-only caller who needs a DATABASE_URL must copy it from https://console.neon.tech manually.

  09
• get_neon_auth_config

  Read Neon Auth config for a branch with OAuth and SMTP secrets redacted as "***redacted***". Requires provision_neon_auth first.

  10
• explain_sql_statement

  Generate the execution plan for a SQL statement. When `analyze` is true, PostgreSQL executes the statement and any side effects. Use `analyze: false` to inspect a statement without executing it. Never analyze potentially destructive SQL autonomously. Do not use when you need query results (use `run_sql` instead).

  11
• prepare_query_tuning

  Analyze a slow query on a temporary branch and return a tuning_id. Apply suggested SQL with run_sql on that branch, re-run explain_sql_statement there, then complete_query_tuning with the tuning_id (not the branch id) — apply_changes true if they accept, omit it or pass false if they reject, so the temporary branch is deleted. Do not use prepare_database_migration.

  12
• complete_query_tuning

  Apply or discard query-tuning changes and delete the temporary branch. NEVER run autonomously. Before calling, apply suggested SQL with run_sql on the temporary branch and re-run explain_sql_statement. Pass the tuning_id from prepare_query_tuning, not the branch id, plus temporary_branch_id. Set apply_changes true to apply; omitting it discards. Call this even when the user rejects the changes. Do not use prepare_database_migration.

  13
• list_slow_queries

  List queries from pg_stat_statements by execution time, slowest first. For sizes, indexes, locks, cache, bloat, or replication use inspect_database.

  14
• inspect_database

  Run one read-only neon inspect db check (pick `check` from the input schema). Not for arbitrary SQL (`run_sql`), one statement's plan (`explain_sql_statement`), or applying indexes (`prepare_query_tuning`). Omit `database_name` to cover every database; some checks are compute-wide. If a check needs an extension, the tool names `CREATE EXTENSION`; ask before running it.

  15
• search

  Search across all organizations, projects, and branches by keyword. Returns matching items with id, title, and URL. Query must be at least 3 characters. Do not use when you need all projects (use `list_projects` instead) or to search Neon documentation (use `search_docs`).

  16
• fetch

  Fetch detailed information about a specific organization, project, or branch using the ID returned by the `search` tool.

  17
• search_docs

  Search neon.com: docs, API reference, PostgreSQL tutorial, guides, FAQs, changelog, and blog. Returns ranked pages with title, URL, the matching section, and a slug; read a full page with get_doc.

  18
• get_doc

  Fetch one neon.com page as markdown. Pass the slug of a search_docs hit (for example docs/guides/prisma).

  19
• send_feedback

  Send anonymous feedback about Neon or this MCP server to the Neon team. Only call this when the user asks to give feedback. Sends only the feedback text, not account, project, or connection details.

  20
• list_projects

  List Neon projects you own. Returns every page. Pass limit to cap how many. There is no `cursor` argument. `org_id` is optional: organization API keys use their organization; personal API keys auto-select when unambiguous and otherwise return the IDs to choose from.

  21
• describe_project

  Retrieves the project record (settings, compute, usage). Call `list_branches` for branches.

  22
• create_project

  Creates a Neon project and waits until the default compute is ready. `org_id` is optional: organization API keys use their organization; personal API keys auto-select when unambiguous and otherwise return the IDs to choose from. Does not return a connection string; call `get_connection_string` with the project id.

  23
• update_project

  Updates the specified project.

  24
• delete_project

  Delete a Neon project and all its data. NEVER run autonomously; always ask the user first. For a single branch, use `delete_branch`.

  25
• recover_project

  Recovers a deleted project within the 7-day deletion recovery period.

  26
• list_project_permissions

  Retrieves details about users who have access to the project, including the permission `id`, the granted-to email address, and the date project access was granted.

  27
• list_project_members

  Lists organization members and their per-project roles for an org-owned project. Returns every page. Pass limit to cap how many.

  28
• list_regions

  Lists Neon regions available to the authenticated account.

  29
• list_operations

  Lists operations for a project. Omitting `limit` returns every remaining page. There is no `cursor` argument.

  30
• get_operation

  Retrieves details for the specified operation.

  31
• list_branches

  Retrieves a list of branches for the specified project. Returns every page. Pass limit to cap how many.

  32
• get_branch

  Retrieves information about the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  33
• create_branch

  Creates a branch with a read-write compute and waits until it is ready. Pass `no_compute: true` to skip the endpoint. Does not return a connection string; call `get_connection_string` with the project and branch id. Copies the parent at HEAD; point-in-time restore is `restore_snapshot`.

  34
• update_branch

  Updates the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  35
• delete_branch

  Delete a branch and all its data. NEVER run autonomously; always ask the user first. For the whole project, use `delete_project`. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  36
• get_default_branch

  Resolve the project's default branch by the default flag, not by name.

  37
• set_default_branch

  Sets the specified branch as the project's default branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  38
• reset_from_parent

  Reset a branch to its parent's current HEAD. Discards every change the branch has written since it diverged. NEVER run autonomously; always ask the user first. `preserve_under_name` saves the current state first and is required when the branch has children; those children move to the new branch. Point-in-time restore is `restore_snapshot`. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  39
• compare_database_schema

  Compare one database's SQL schema on a branch to another. `database_name` is required. Omit `base_branch_id` to compare against the parent; it is a branch id (`br-...`), not a name. Pass `lsn`, `timestamp`, `base_lsn`, or `base_timestamp` only for a point-in-time comparison. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  40
• finalize_branch_restore

  Finalize a branch created with `restore_snapshot` and `finalize: false`: reassign computes (this restarts them) and swap names so it replaces the original branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  41
• list_postgres_roles

  Retrieves a list of Postgres roles from the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  42
• get_postgres_role

  Retrieves details about the specified role. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  43
• create_postgres_role

  Creates a Postgres role in the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  44
• delete_postgres_role

  Deletes the specified Postgres role from the branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  45
• reset_postgres_role_password

  Resets the password for the specified Postgres role. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  46
• list_postgres_databases

  Retrieves a list of databases for the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  47
• get_postgres_database

  Retrieves information about the specified database. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  48
• create_postgres_database

  Creates a database in the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  49
• update_postgres_database

  Updates the specified database in the branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  50
• delete_postgres_database

  Deletes the specified database from the branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  51
• list_postgres_endpoints

  Retrieves a list of compute endpoints for the specified project.

  52
• list_branch_computes

  Retrieves a list of compute endpoints for the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  53
• get_postgres_endpoint

  Retrieves information about the specified compute endpoint.

  54
• create_postgres_endpoint

  Creates a compute endpoint on a branch. Does not return a connection string; call `get_connection_string`.

  55
• update_postgres_endpoint

  Updates the specified compute endpoint.

  56
• delete_postgres_endpoint

  Deletes the specified compute endpoint.

  57
• start_postgres_endpoint

  Starts a compute endpoint.

  58
• suspend_postgres_endpoint

  Suspends the specified compute endpoint.

  59
• restart_postgres_endpoint

  Restarts the specified compute endpoint by immediately suspending it and then starting it again.

  60
• list_snapshots

  Lists the snapshots for the specified project.

  61
• get_snapshot_schedule

  Returns the backup schedule for the specified branch, including the configured snapshot frequencies. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  62
• set_snapshot_schedule

  Replace a branch's automatic snapshot schedule. Frequency must be daily, weekly, or monthly. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  63
• create_snapshot

  Creates a snapshot from the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  64
• update_snapshot

  Updates the specified snapshot.

  65
• delete_snapshot

  Deletes the specified snapshot.

  66
• restore_snapshot

  Restore a snapshot onto a new or existing branch. The call waits until the branch is ready. Pass `target_branch_id` to restore onto an existing branch; omit it to create one. Pass `finalize: false` then call `finalize_branch_restore` to swap names later.

  67
• get_auth

  Retrieves the Neon Auth integration details for the specified branch, including the auth provider type and integration status. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  68
• provision_neon_auth

  Enables Neon Auth for the specified branch by connecting it to an authentication provider. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  69
• disable_auth

  Disables the Neon Auth integration for the specified branch, removing the connection to the authentication provider. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  70
• update_auth_config

  Updates the auth configuration for the branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  71
• list_auth_oauth_providers

  Lists the social login providers (Google, GitHub, Microsoft, Vercel) configured for the branch's Neon Auth integration, which users sign in with. This is not the OAuth Provider plugin that makes Neon Auth an OAuth 2.1 authorization server; for that use `get_auth_oauth_server` and `update_auth_oauth_server`. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  72
• add_auth_oauth_provider

  Adds a social login provider (Google, GitHub, Microsoft, Vercel) that users sign in with to the branch's Neon Auth integration. Takes the provider `id` and optionally `client_id`, `client_secret` and, for Microsoft, `microsoft_tenant_id`. This is not the OAuth Provider plugin that makes Neon Auth an OAuth 2.1 authorization server; for that use `get_auth_oauth_server` and `update_auth_oauth_server`. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  73
• update_auth_oauth_provider

  Updates a social login provider (Google, GitHub, Microsoft, Vercel) that users sign in with on the branch's Neon Auth integration. This is not the OAuth Provider plugin that makes Neon Auth an OAuth 2.1 authorization server; for that use `get_auth_oauth_server` and `update_auth_oauth_server`. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  74
• delete_auth_oauth_provider

  Deletes a social login provider (Google, GitHub, Microsoft, Vercel) from the branch's Neon Auth integration. This is not the OAuth Provider plugin that makes Neon Auth an OAuth 2.1 authorization server; for that use `get_auth_oauth_server` and `update_auth_oauth_server`. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  75
• list_auth_trusted_domains

  Lists the trusted domains in the redirect URI whitelist for the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  76
• add_auth_trusted_domain

  Adds a domain to the redirect URI whitelist for the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  77
• delete_auth_trusted_domain

  Removes a domain from the redirect URI whitelist for the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  78
• create_auth_user

  Creates a new user in the Neon Auth user directory for the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  79
• delete_auth_user

  Deletes the specified user from the Neon Auth user directory for the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  80
• update_auth_user_role

  Updates the role of a user in the Neon Auth user directory for the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  81
• get_auth_oauth_server

  Retrieves how Neon Auth acts as an OAuth 2.1 authorization server for the branch, including for MCP servers. This is Better Auth's OAuth Provider plugin (API plugin `oauth_provider`), not social login; for providers such as GitHub or Google call `list_auth_oauth_providers`. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  82
• update_auth_oauth_server

  Configures Neon Auth as an OAuth 2.1 authorization server for the branch, including for MCP servers. This is Better Auth's OAuth Provider plugin (API plugin `oauth_provider`), not social login; for providers such as GitHub or Google see `list_auth_oauth_providers`. Enabling requires `login_page`, `consent_page` and at least one resource (or an MCP resource). `resources` replaces the stored list: call `get_auth_oauth_server` first and send the full list to add or remove one. `mcp.resource` is required whenever `mcp` is sent; omitted `mcp` booleans keep their stored value, and `mcp.resource: ""` removes the MCP configuration. Prefer `client_id_metadata_documents` over the deprecated `dynamic_registration`. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  83
• list_auth_oauth_clients

  Lists the OAuth clients registered with the branch's Neon Auth OAuth server (apps and MCP clients that users authorize). Not social login providers. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  84
• get_auth_oauth_client

  Returns an OAuth client registered with the branch's Neon Auth OAuth server. Not a social login provider. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  85
• create_auth_oauth_client

  Registers an OAuth client with the branch's Neon Auth OAuth server. A confidential client returns `client_secret` only once: show it to the user and tell them to store it. Every entry in `resources` must already be configured on the OAuth server (see `get_auth_oauth_server`) or be its MCP resource. `type` cannot be changed later. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  86
• update_auth_oauth_client

  Updates an OAuth client of the Neon Auth OAuth server. `redirect_uris` and `resources` replace the stored lists, so send the full list. At least one resource is required. `type` cannot be changed. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  87
• delete_auth_oauth_client

  Deletes an OAuth client from the Neon Auth OAuth server. Irreversible. Tokens already issued to the client are not revoked. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  88
• rotate_auth_oauth_client_secret

  Generates a new secret for a confidential client of the Neon Auth OAuth server. The old secret stops working immediately. The new `client_secret` is shown only once: show it to the user and tell them to store it. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  89
• get_data_api

  Retrieves the Neon Data API configuration for the specified branch, including endpoint URL, enabled state, and database settings. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  90
• provision_neon_data_api

  Creates a new instance of Neon Data API in the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  91
• update_data_api

  Updates the Neon Data API configuration for the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  92
• delete_data_api

  Deletes the Neon Data API for the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  93
• query_logs

  Returns logs for a branch. Pass `limit` to cap how many. There is no `cursor` argument. Filters combine with AND. Pass `logql` instead of structured filters, not with them. Give the window as `since` or `start_time`, not both; default is the previous hour, max seven days; `end_time` is exclusive. Private beta; a branch without logs access returns HTTP 404 with reason "telemetry_not_enabled". branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  94
• list_log_fields

  Lists the low-cardinality log fields observed on this branch. Call `list_log_field_values` with `field_name` to list distinct values. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  95
• list_log_field_values

  Lists distinct values for a low-cardinality log field. Call `list_log_fields` first for `field_name`; a field the branch has never emitted returns `unknown_field`. Pass `since` or `start_time`, not both; default is the previous six hours, max seven days. Private beta. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  96
• get_ai_gateway

  Returns the AI Gateway endpoint host for the specified branch, used to render code-snippet base URLs. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  97
• list_functions

  Lists functions on the specified branch. Returns every page. Pass limit to cap how many. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  98
• get_function

  Returns the function identified by its slug. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  99
• update_function

  Updates the function's mutable metadata — currently only the display `name`. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  100
• delete_function

  Deletes the function identified by its slug. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  101
• deploy_function

  Creates a deployment for the function. Supply at least one of `zip`, `environment`, or `runtime`; omitted fields inherit the latest version. The first deployment must include `zip`. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  102
• list_functions_custom_domains

  Lists all custom domains registered on the branch, across every target entity. Returns every page. Pass limit to cap how many. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  103
• register_functions_custom_domain

  Registers a hostname on the branch and routes it to a function. Pass `entity_type: "function"` and `entity_id` as the slug from `list_functions`. Point a CNAME at the returned `cname_target`. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  104
• delete_functions_custom_domain

  Removes a custom domain registered on the branch and stops routing it. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  105
• list_triggers

  Lists the complete project-bounded set of triggers visible on the branch, ordered by `trigger_id`. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  106
• get_trigger

  Returns the trigger visible on the branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  107
• create_trigger

  Creates a trigger for a Function visible on the branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  108
• update_trigger

  Applies a partial update. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  109
• delete_trigger

  Deletes a branch-local trigger or writes a branch-local tombstone for an inherited trigger so it does not reappear. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  110
• list_credentials

  Returns metadata for customer-issued credentials on the branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  111
• create_credential

  Issues a new scoped service credential anchored to the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  112
• revoke_credential

  Soft-deletes the credential. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  113
• rotate_credential

  Replaces the secret material on an existing scoped credential in place. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  114
• get_storage

  Returns whether branchable object storage is usable for the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  115
• list_storage_buckets

  Lists branchable object storage buckets visible on the specified branch, including those inherited from ancestor branches. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  116
• create_storage_bucket

  Creates a new branchable object storage bucket on the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  117
• delete_storage_bucket

  Deletes the named bucket from the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  118
• list_storage_objects

  Lists objects visible in the named bucket on the specified branch, including those inherited from ancestor branches. Returns every page. Pass limit to cap how many. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  119
• delete_storage_object

  Deletes the named object from the bucket on the specified branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  120
• delete_storage_objects_by_prefix

  Soft-deletes every object on the specified branch whose key starts with `prefix`, in a single call. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  121
• presign_storage_object

  Returns a presigned URL that transfers bytes directly to or from the object's bucket on the specified branch, without the caller ever handling S3 credentials. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  122
• get_realtime

  Retrieves whether Realtime is enabled for the branch, whether a change is still being applied, and, once provisioned, its invocation URL and allowed origins. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  123
• enable_realtime

  Enables Realtime for the branch, or applies new options to an enabled branch. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  124
• disable_realtime

  Disables Realtime for the branch and discards its shared secret. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  125
• get_realtime_secret

  Retrieves the secret the application backend issues Realtime tokens with. Requires write access: the secret lets its holder issue Realtime tokens for the branch, so it is unavailable in read-only mode. Call `enable_realtime` first. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  126
• rotate_realtime_secret

  Replaces the branch's Realtime shared secret and waits until the change is applied. NEVER run autonomously; always ask the user first. Call `get_realtime_secret` afterwards and update the application backend with the new value. branch_id is a branch id (br-...), not a branch name. Call list_branches to resolve a name.

  127

• Neon explicitly advises against using the server in production environments because powerful operations can cause accidental or unauthorized changes.
• Default grants may permit write operations; use readonly=true or OAuth read-only consent when possible.
• read-only mode removes writes but still exposes read_sql/data access; only connect to databases the user is authorized to disclose.
• The local stdio @neondatabase/mcp-server-neon package is deprecated; use the managed remote server, or mcp-remote if the client only supports stdio.
• Legacy /sse endpoint is deprecated and scheduled to stop working on or after 2026-10-01; use /mcp.

• Neon maintains both a deprecated local stdio package and the current managed remote MCP. This record describes the current remote server; the local package is noted only as deprecated compatibility context.

• official tool reference

  Neon documents a public unauthenticated /api/list-tools endpoint to preview the live tool set. The current default endpoint returned 127 tools at retrieval time. This is conditional: read-only mode, project scoping, category filters, OAuth grants and plan/region support can change the live tools/list.

• official live tool catalog

  Neon documents a public unauthenticated /api/list-tools endpoint to preview the live tool set. The current default endpoint returned 127 tools at retrieval time. This is conditional: read-only mode, project scoping, category filters, OAuth grants and plan/region support can change the live tools/list.

Documentation checked 2026-10-28T12:50:00.000Z. Connection has not been runtime tested.