The server itself exposes 119 tools, and some of them can write to your Neon account. Behind TrustGate an agent only sees the tools you allow, requests and responses are inspected, and every call is logged. Anything outside the allowlist is denied before it reaches Neon.

How is this different from connecting Neon MCP directly?

Connected directly, an agent sees every tool the server exposes and holds the credential itself. Through TrustGate you choose which tools each agent gets, and every call is logged against the agent that made it.

What if the Neon MCP API changes?

We track the Neon MCP schema, so the tool catalogue stays current. Tools you have already allowed keep working, and anything new stays denied until you enable it.

Can I give different agents different Neon tools?

Yes. Access is set per agent: one can get a handful of read tools, another the full set. You grant the whole MCP or single tools within it.

Where can I see what my agents did in Neon?

Every call is logged against the agent that made it, with the tool it used. Activity can be sent on to your own monitoring.

Do I need to run the Neon MCP server myself?

No. TrustGate connects to the Neon MCP server and sits in front of it. Your agent only talks to your TrustGate URL, never to Neon directly.

Connect Neon MCP to your AI agents, securely.

One secured endpoint for every Neon call your AI agents make, scoped per user, inspected, and logged.

Get started for free

Get a demo

Try Neon MCP now

What your agents can ask once Neon MCP is connected.

Select the tools your AI agents can call

119 tools from the Neon MCP schema.

Showing 119 tools

list_projectsreadLists Neon projects. A limit caps how many items come back.
describe_projectreadFetches a Neon project by ID.
create_projectwriteCreates a project and waits for the default compute. Does not return a connection string.
delete_projecthigh riskDeletes an existing Neon project and everything in it.
list_organizationsreadLists the organizations the current user has access to, optionally filtered by name or ID.
update_projectwriteUpdates the specified project.
recover_projectwriteRecovers a deleted project within the 7-day deletion recovery period.
list_project_permissionsreadRetrieves the users who have access to the project, with the permission ID and the granted-to email.
list_project_membersreadLists organization members and their per-project roles for an org-owned project.
list_regionsreadLists Neon regions available to the authenticated account.
list_operationsreadLists the operations for a project.
get_operationreadRetrieves details for the specified operation.
list_branchesreadLists the branches in a project. Use it to resolve a branch name to a br- ID.
describe_branchreadRetrieves a tree of databases, schemas, tables, views and functions on a branch.
create_branchwriteCreates a branch with a read-write compute and waits until it is ready. Does not return a connection string.
reset_from_parenthigh riskResets a branch to its parent's current HEAD, discarding writes since the branch diverged. Requires preserve_under_name when the branch has children.
delete_branchhigh riskDeletes a branch.
list_credentialsreadLists the branch-scoped credentials for Object Storage and the AI Gateway.
create_credentialhigh riskCreates a branch-scoped credential for Object Storage or the AI Gateway.
rotate_credentialhigh riskRotates a credential, replacing the secret in place. Not idempotent.
revoke_credentialwriteRevokes a branch-scoped credential.
list_postgres_rolesreadLists the Postgres roles on a branch. Part of the generated branch toolset.
create_postgres_databasewriteCreates a Postgres database on a branch. Part of the generated branch toolset.
get_branchreadRetrieves information about the specified branch.
update_branchwriteUpdates the specified branch.
get_default_branchreadResolves the project's default branch by the default flag, not by name.
set_default_branchwriteSets the specified branch as the project's default branch.
finalize_branch_restorewriteFinalizes a branch created with restore_snapshot and finalize set to false, reassigning computes, which restarts them.
get_postgres_rolereadRetrieves details about the specified role.
create_postgres_rolehigh riskCreates a Postgres role in the specified branch.
delete_postgres_rolehigh riskDeletes the specified Postgres role from the branch.
reset_postgres_role_passwordhigh riskResets the password for the specified Postgres role.
list_postgres_databasesreadRetrieves a list of databases for the specified branch.
get_postgres_databasereadRetrieves information about the specified database.
update_postgres_databasewriteUpdates the specified database in the branch.
delete_postgres_databasehigh riskDeletes the specified database from the branch.
list_postgres_endpointsreadLists the compute endpoints in a project.
list_branch_computesreadLists the computes attached to a branch.
get_postgres_endpointreadGets the details of a compute endpoint.
create_postgres_endpointwriteCreates a compute endpoint on a branch.
update_postgres_endpointwriteUpdates a compute endpoint's configuration.
delete_postgres_endpointhigh riskDeletes a compute endpoint.
start_postgres_endpointwriteStarts a suspended compute endpoint.
suspend_postgres_endpointwriteSuspends a compute endpoint, interrupting live connections.
restart_postgres_endpointwriteRestarts a compute endpoint.
list_snapshotsreadLists the snapshots taken for a branch.
get_snapshot_schedulereadGets the snapshot schedule configured for a branch.
set_snapshot_schedulewriteSets the snapshot schedule for a branch.
create_snapshotwriteCreates a snapshot of a branch.
update_snapshotwriteUpdates a snapshot's metadata.
delete_snapshothigh riskDeletes a snapshot, removing that restore point.
restore_snapshothigh riskRestores a snapshot. Pass target_branch_id to restore onto an existing branch; omit it to create a new one.
get_database_tablesreadLists all tables within a specified Neon database.
describe_table_schemareadRetrieves the schema definition of a table: columns, data types and constraints.
compare_database_schemareadProduces a SQL schema diff of one database against another branch. Omitting base_branch_id compares against the parent.
get_connection_stringhigh riskReturns the database connection string. It carries a privileged role password, so it is withheld in read-only mode.
run_sqlhigh riskExecutes a single SQL query against a Neon database. Supports both read and write operations; in read-only mode it is restricted to reads.
run_sql_transactionhigh riskExecutes a series of SQL queries within a single transaction.
inspect_databasereadRuns 15 predefined read-only Postgres diagnostics on a branch: relation and index sizes, scan usage, active queries and locks, heaviest queries, cache hit rate, autovacuum and bloat, and replication state.
list_slow_queriesreadFinds the slowest queries in a database. Requires the pg_stat_statements extension.
explain_sql_statementreadProvides detailed execution plans for SQL queries.
prepare_database_migrationwriteStarts a migration by applying it to a temporary branch, so it can be tested before touching the main branch.
complete_database_migrationhigh riskApplies a prepared migration to the main branch, merging the temporary branch and cleaning up.
prepare_query_tuningwriteAnalyses query performance and suggests optimizations on a temporary branch.
complete_query_tuningwriteApplies or discards the tuning optimizations and cleans up the temporary branch.
provision_neon_authwriteProvisions Neon Auth for a project.
get_authreadGets the Neon Auth configuration for a project.
get_neon_auth_configreadHost tool returning the Neon Auth configuration with secrets redacted.
update_auth_configwriteUpdates the Neon Auth configuration.
disable_authhigh riskDisables Neon Auth for a project, cutting off sign-in.
list_auth_oauth_providersreadLists the OAuth providers configured for Neon Auth.
add_auth_oauth_providerhigh riskAdds an OAuth provider, changing who can sign in to the application.
update_auth_oauth_providerwriteUpdates an OAuth provider's configuration.
delete_auth_oauth_providerwriteRemoves an OAuth provider.
list_auth_trusted_domainsreadLists the trusted domains configured for Neon Auth.
add_auth_trusted_domainwriteAdds a trusted domain.
delete_auth_trusted_domainwriteRemoves a trusted domain.
create_auth_userhigh riskCreates an auth user in the application.
delete_auth_userhigh riskDeletes an auth user.
update_auth_user_rolehigh riskChanges an auth user's role, altering their privileges.
provision_neon_data_apiwriteProvisions the Data API for a branch database, exposing it over HTTP.
get_data_apireadGets the Data API configuration for a branch database.
update_data_apiwriteUpdates the Data API configuration.
delete_data_apihigh riskRemoves the Data API from a branch database.
query_logsreadQueries OpenTelemetry logs for a branch. POST in the Management API but treated as read-only by the server. Requires the Neon Platform Beta.
list_log_fieldsreadLists the log fields available to enumerate on a branch.
list_log_field_valuesreadLists the distinct values of a log field within a branch and time window.
get_ai_gatewayreadReturns the AI Gateway endpoint host for the specified branch.
searchreadSearches across organizations, projects and branches, returning IDs, titles and Console links.
fetchreadFetches detailed information about an organization, project or branch by ID.
send_feedbackwriteSends anonymous feedback to the Neon team. Only the text is sent, with no account, project or connection details.
list_functionsreadLists the functions deployed on a project.
get_functionreadGets the details of a function.
deploy_functionhigh riskDeploys a function, shipping code that runs against the database.
update_functionwriteUpdates a function's configuration.
delete_functionhigh riskDeletes a function.
list_functions_custom_domainsreadLists the custom domains registered for functions.
register_functions_custom_domainwriteRegisters a custom domain for functions.
delete_functions_custom_domainwriteRemoves a custom domain from functions.
list_triggersreadLists the scheduled function triggers.
get_triggerreadGets the details of a trigger.
create_triggerwriteCreates a scheduled trigger on a five-field UTC cron.
update_triggerwriteUpdates a trigger's schedule or target.
delete_triggerwriteDeletes a scheduled trigger.
list_storage_bucketsreadLists the Object Storage buckets.
create_storage_bucketwriteCreates an Object Storage bucket.
delete_storage_buckethigh riskDeletes an Object Storage bucket and its contents.
list_storage_objectsreadLists the objects in a bucket.
delete_storage_objectwriteDeletes a single object from a bucket.
delete_storage_objects_by_prefixhigh riskDeletes every object under a prefix in one call.
presign_storage_objecthigh riskCreates a presigned URL granting direct access to an object outside the server.
get_storagereadGets the Object Storage configuration for a project.
search_docsreadSearches neon.com docs, API reference, PostgreSQL tutorial, guides, FAQs, changelog and blog, and returns ranked pages.
get_docreadFetches one neon.com page as markdown, by the slug of a search_docs hit.
get_realtimereadRetrieves whether Realtime is enabled for the branch and whether a change is still being applied.
enable_realtimewriteEnables Realtime for the branch, or applies new options to an enabled branch.
disable_realtimehigh riskDisables Realtime for the branch and discards its shared secret.
get_realtime_secrethigh riskRetrieves the secret the application backend issues Realtime tokens with. Requires write access.
rotate_realtime_secrethigh riskReplaces the branch's Realtime shared secret and waits until the change is applied.

What Neon MCP exposes

Neon MCP groups its 119 tools into 14 categories, each with a suggested starting policy.

All 119 tools as JSON, ready to paste.

Category	Covers	Access	Suggested policy
Neon Auth	Auth provisioning and configuration, OAuth providers, trusted domains and auth users	Read / Write	Adding an OAuth provider or a user changes who can sign in to the application; get_neon_auth_config redacts secrets
Functions	Function listing, deployment, updates and deletion, custom domains, and scheduled cron triggers	Read / Write	Deploying a function ships code; triggers run it on a five-field UTC cron
Branches	Branch listing, details, creation, updates, default branch, reset, restore finalization, deletion and description, plus branch-scoped credentials, roles and databases	Read / Write	reset_from_parent discards writes since the branch diverged; credential rotation replaces secrets in place and is not idempotent
Querying & Optimization	Connection strings, SQL execution and transactions, database diagnostics, slow queries, execution plans, migrations and query tuning	Read / Write	get_connection_string returns a privileged role password and is withheld in read-only mode; run_sql stays read-only there
Compute Endpoints	Compute endpoint listing, creation, update, deletion, start, suspend and restart	Read / Write	Suspending or restarting a compute interrupts live connections
Storage	Object Storage buckets, objects, prefix deletion and presigned URLs	Read / Write	A presigned URL grants direct object access outside the server; prefix deletion is bulk and irreversible
Snapshots	Snapshot listing, schedules, creation, update, deletion and point-in-time restore	Read / Write	restore_snapshot can target an existing branch; omit the target to restore onto a new one
Projects	Project listing, description, creation, updates, deletion and recovery, members and permissions, operations, regions and the organizations the user can access	Read / Write	In project-scoped mode, delete_project and the project-less tools are hidden entirely
Data API	Provisioning, reading, updating and deleting the Data API for a branch database	Read / Write	The Data API exposes the database over HTTP; approve provisioning
Schema	Table listing, table schema description and SQL schema diff against another branch	Read	Read-only; safe to allow for exploration
Observability	OpenTelemetry log queries, log fields and field values for a branch, and the AI Gateway endpoint host	Read	Requires the Neon Platform Beta and is currently limited to aws-us-east-2
Search & Feedback	Search across organizations, projects and branches, detail fetch by ID, and anonymous product feedback	Read / Write	send_feedback carries only the text, with no account or connection details
Documentation	Search across neon.com docs, guides and blog, and individual pages as markdown	Read	Available on the no-login docs endpoint; safe to allow broadly
Realtime	Realtime status for a branch, enabling and disabling it, and reading or rotating its shared secret	Read / Write	The shared secret lets the backend issue Realtime tokens; approve reads and rotation, and disabling discards it

Connect Neon MCP to your AI agent

Four steps, under ten minutes.

01
Sign in to NeuralTrust
Open the NeuralTrust platform, sign in and go to Getting started, then Connect your tools.
02
Choose your agent
When asked which agent you use, pick Claude Code, Codex, Cursor, Windsurf, Copilot or your own code.
03
Connect Neon
Find Neon in the tool list and connect it.
04
Connect your agent
Follow the steps on screen to add the config to your agent, then send the test prompt.

Permissions down to the single tool

You do not allow Neon MCP or block it. You allow the exact tools each agent can call, one by one.

Neon MCP	119 TOOLS AVAILABLE
Code review agent	4 tools, read only
Issue triage bot	9 tools
Platform team assistant	all 119 tools

Tool by toolConnecting the server is not the unit of access. Each tool is granted on its own.
Default denyA tool you have not enabled is never exposed to the agent.
Approval on writesTools that change or delete things can require a human to confirm.

Is Neon MCP secure?

One endpoint instead of raw credentials. Every call is checked against policy and logged.

AI agentsConnect through your MCP client configuration.	NeuralTrustApply controls based on your configuration.	Neon MCP119 documented tools across 14 scope categories.
Coding assistants	Connection & credentialsper user	Branches24 tools
Internal copilots	Tool access policiesdeny by default	Neon Auth15 tools
Workflow automations	Request & response inspectioninline	Functions13 tools
Compatible MCP clients	Activity monitoringalerts and logs	All other tools67 tools