Assessment: Neon MCP server
Neon runs serverless Postgres, and their MCP server does something most don't: it enforces read-only through the OAuth scope the token was granted, so a read-only connection literally cannot be handed a writing tool. That's a stronger guarantee than a config flag the server checks itself. Generous, verifiable read.
The standout
The standout is the access model. Read-only isn't a boolean the server inspects — it's carried in the OAuth scope granted at authorization, with an approval dialog at connect and the tool list filtered to what the scope permits. A connection granted read-only scope is never even offered the mutating tools. That's defense in depth done at the right layer: the guarantee lives in the grant, not in a check the server has to remember to run. Tools are annotated, and the server is well tested (~50 test files).
The method, check by check
| ✓ | Annotations | ToolAnnotations declared; titles and read/write hints present. |
| ✓ | Access / read-only | Enforced via OAuth scope, not a self-checked flag — read-only tokens can't be offered write tools. Strong. |
| ✓ | Defense in depth (11) | The scope-level enforcement is itself the second layer beneath the tool annotations. |
| ✓ | Tests & CI | ~50 test files with CI. |
| — | Path handling | API-backed; no filesystem surface. |
| ⚠ | Confirmation (8) | Destructive tools (delete branch/project) are gated by scope and approval at connect, but there's no per-action confirmation once a writing scope is granted. |
✓ present · ⚠ the tier-two hardening still open · — not applicable
Verdict
Access done right. Putting read-only in the OAuth scope rather than a server-side flag is the strongest form of that guarantee, and the approval dialog makes the grant explicit. The open tier-two item is per-action confirmation: once a write scope is granted, an individual destructive call isn't separately confirmed. Sound on the basics, ahead on the access model.
Want the same read on yours?
The whole server against both tiers, a document you can forward. How it works · lesliekadenge@gmail.com.
Checkable against github.com/neondatabase/mcp-server-neon. Offered in good faith; named only for what it does well.