@apexradius/apex-data-mcp

PostgreSQL and SSH MCP server for database inspection, remote operations, and VPS maintenance from MCP-capable clients.

Install

npx @apexradius/apex-data-mcp --pg-url "$APEX_PG_URL" --read-only

For local development:

npm ci
npm run build
npm start -- --pg-url "$APEX_PG_URL"

Configuration

Postgres can be configured with a connection URL or individual fields:

APEX_PG_URL=postgres://user:pass@host:5432/db
APEX_PG_PASSWORD=...

CLI flags:

--pg-url <url>
--pg-host <host>
--pg-port <port>
--pg-db <database>
--pg-user <user>
--pg-password <password>
--ssl
--read-only
--max-rows <n>
--timeout <ms>
--ssh-host <host>
--ssh-port <port>
--ssh-user <user>
--ssh-key <path>
--ssh-password <password>

Additional SSH servers can be provided with environment variables:

APEX_SSH_VPS_HOST=100.68.57.21
APEX_SSH_VPS_USER=adam
APEX_SSH_VPS_PORT=22
APEX_SSH_VPS_KEY=/path/to/key

The alias is the middle segment, lowercased. In the example above, use server_id: "vps".

MCP Client Example

{
  "mcpServers": {
    "apex-data-mcp": {
      "command": "npx",
      "args": [
        "@apexradius/apex-data-mcp",
        "--pg-url",
        "${APEX_PG_URL}",
        "--read-only"
      ],
      "env": {
        "APEX_PG_URL": "postgres://user:pass@localhost:5432/app"
      }
    }
  }
}

Tool Reference

Postgres tools:

• pg_query
• pg_explain
• pg_list_schemas
• pg_list_tables
• pg_describe_table
• pg_table_stats
• pg_db_health

SSH execution and sessions:

• ssh_execute
• ssh_execute_sudo
• ssh_execute_group
• ssh_command_alias
• ssh_session_start
• ssh_session_send
• ssh_session_list
• ssh_session_close
• ssh_history

SSH network and files:

• ssh_tunnel_create
• ssh_tunnel_close
• ssh_tunnel_list
• ssh_upload
• ssh_download
• ssh_sync

ssh_sync runs rsync locally. With server_id, mark the remote side with remote:/path, for example:

source: ./dist/
destination: remote:/var/www/app/dist/
server_id: vps

Server management and monitoring:

• ssh_list_servers
• ssh_connection_status
• ssh_health_check
• ssh_service_status
• ssh_alias
• ssh_key_manage
• ssh_group_manage
• ssh_profile
• ssh_process_manager
• ssh_monitor
• ssh_tail
• ssh_alert_setup
• ssh_deploy

Database and backup operations over SSH:

• ssh_db_list
• ssh_db_query
• ssh_db_dump
• ssh_db_import
• ssh_backup_create
• ssh_backup_list
• ssh_backup_restore
• ssh_backup_schedule

Apex-specific:

• keystone_vps_push

The removed ssh_hooks tool is intentionally absent. The previous implementation advertised session-scoped hooks without actually executing them.

Security Model

• --read-only applies to the direct Postgres client.
• SSH database queries reject multi-statement SQL and mutating keywords.
• SSH file and backup tools reject .. path traversal segments.
• ssh_backup_schedule accepts only five-field numeric cron expressions.
• ssh_deploy validates branch names before shell execution.
• ssh_deploy pre_deploy and restart_command run remote shell commands; only pass trusted operator input.
• SSH key files with group or world permissions emit a warning.
• Extra APEX_SSH_* servers without USER are skipped with a startup warning.
• The system health check runs a real SSH echo ok probe when SSH is configured.

No secrets should be committed in MCP client config. Use environment variables or the local secret manager.