Fix: Handle self-signed certificates in PostgreSQL SSL connections

[scrobot]

Fix: Handle self-signed certificates in PostgreSQL SSL connections

Problem

When connecting to PostgreSQL databases with SSL enabled (particularly AWS RDS instances), the MCP server fails with the error:

MCP error -32603: self-signed certificate in certificate chain

This issue occurs because AWS RDS uses SSL certificates that may not be in the default trusted certificate store, and the node-postgres library fails to validate the certificate chain.

Solution

This PR implements a flexible solution for handling SSL connections in the PostgreSQL MCP server:

1. Conditional SSL Configuration: SSL settings are only applied when needed, based on the connection string parameters (sslmode=require, prefer, verify-ca, or verify-full).

2. Configurable Certificate Validation: Added support for the rejectUnauthorized parameter in the connection string to control certificate validation:

   • rejectUnauthorized=false: Disables certificate validation (needed for AWS RDS with self-signed certs)
   • rejectUnauthorized=true: Enforces certificate validation (default for security)

3. Improved Client Connections: Individual client connections now properly inherit SSL settings from the connection string.

Usage Examples

1. For AWS RDS with self-signed certificates:

postgresql://username:password@host:port/dbname?sslmode=require&rejectUnauthorized=false

2. For secure connections with certificate validation:

postgresql://username:password@host:port/dbname?sslmode=require&rejectUnauthorized=true

3. For non-SSL connections:

postgresql://username:password@host:port/dbname

Related Issues

Fixes #1047

[olaservo]

Thanks for contributing this PR. This server has been moved to the archived repository at https://github.com/modelcontextprotocol/servers-archived to reduce maintenance overhead, so we can focus our efforts on a smaller set of core servers.
Since we're no longer accepting contributions to this server, we won't be able to merge this PR. If you're interested in contributing similar functionality, we recommend checking out the alternatives listed in the Readme.