Skip to main content
Watch: I Built an AI App Without Leaving Databricks

Auth and security - official Teleport server

Teleport database access MCP server

A local stdio MCP server started by the Teleport tsh client (tsh mcp db start). It lets MCP clients list Teleport-enrolled databases and run SQL against PostgreSQL databases using the user's Teleport identity and RBAC. It runs locally; the notes below cover how it authenticates.

Last verified 2 tools5 sources

Install

Cursor

About Cursor
Snippet
tsh mcp db config --db-user=postgres --db-name=employees --client-config=cursor postgres-dev

Generic

JSON
{
  "mcpServers": {
    "teleport-databases": {
      "command": "tsh",
      "args": [
        "mcp",
        "db",
        "start",
        "teleport://clusters/teleport.example.com:443/databases/postgres-dev?dbName=employees&dbUser=postgres"
      ]
    }
  }
}

Tools

teleport_list_databases
Lists database resources accessible with Teleport tools.
teleport_postgres_query
Executes SQL queries on a specified database through Teleport (PostgreSQL databases only).

As documented on October 17, 2026. A running server reports its current list through tools/list.

Notes and caveats

  • Ships in the tsh client and needs a running Teleport cluster, a Teleport Database Service with PostgreSQL enrolled, and a valid tsh login session; for headless use, Machine ID (tbot) issues the credentials.
  • Docs also show tsh writing the Claude Desktop config with --client-config=claude.
  • The source repo is AGPL-3.0; Community Edition builds on goteleport.com/download use a modified Apache 2.0 license.
  • Teleport recommends a read-only database user because models can run any query.
  • For Kubernetes over MCP, Teleport points clients to the third-party kubernetes-mcp-server, so that is not a Teleport server.
  • Teleport MCP access, which enrolls and proxies other MCP servers with RBAC and auditing, is a gateway and not a tool server.

More MCP servers for auth and security

Related reading

FAQ

What does the Teleport database access MCP server do?

A local stdio MCP server started by the Teleport tsh client (tsh mcp db start). It lets MCP clients list Teleport-enrolled databases and run SQL against PostgreSQL databases using the user's Teleport identity and RBAC. The vendor documents 2 tools, including teleport_list_databases and teleport_postgres_query.

How do I add the Teleport database access MCP server to Cursor?

Run tsh mcp db config --db-user=postgres --db-name=employees --client-config=cursor postgres-dev, copied from Teleport's docs. This page also has snippets for Generic.

Does the Teleport database access MCP server need authentication?

It uses a scheme other than OAuth or an API key, such as the session of the app or instance it runs in; the notes on this page describe it. Transport: stdio. Status: Unlabelled, last checked October 17, 2026.

Sources

Last verified against 5 Teleport pages, then re-checked independently.

Newsletter

New MCP servers, the week they ship

One email per week. New official MCP servers, the coding tools that support them and how developers wire them up.