Report which tools the current role can actually use on this connection, and how the rest fall short.
read-onlyany connectionsweeps instancesweeps group
checkPrivileges()Report which tools the current role can actually use on this connection, and how the rest fall short. Most of this server works for any role that can connect, because the catalog is world-readable; what varies is the monitoring extras and whether the role can read table data. Call this first when working against an unfamiliar connection or a restricted role -- the alternative is discovering the limits tool by tool, and a privilege-filtered answer is easy to mistake for an empty one.
Names no role memberships and no GRANT statements: what a caller needs is which tools work. This is about THIS server's operations for the CONNECTING role, and is not an object permission check -- for whether some other role may read a given table, view or function, and which rows row-level security then leaves it, use the check-role-access prompt. Tools absent from both lists are fully available.
None of its own.
Also accepts connection, instance, group, described once under arguments every tool takes.
Which tools this role can use on this connection. An absent extension or a missing grant is reported as {error, hint} instead.
| Field | Type |
|---|---|
| available | integer | null |
| connection | string | null |
| degraded | array | null |
| denied | array | null |
| role | string | null |
| tools | integer | null |
A physical replica is byte-identical here, so asking each member of a replication group adds nothing.
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "checkPrivileges",
"arguments": {
"connection": "shop_prod"
}
}
}{
"connection": "shop_prod",
"role": "mcp_readonly",
"tools": 68,
"available": 60,
"degraded": [
{
"tool": "currentActivity",
"what": "the query text and some columns of backends belonging to other roles are hidden"
}
],
"denied": [
{
"tool": "tableBloat",
"reason": "the pgstattuple functions are restricted to roles permitted to run table-scanning monitoring functions"
}
]
}Invented values on a fictional shop database, shaped by and checked against this tool's output schema. Real output is returned as structuredContent to clients that negotiate MCP 2025-06-18 or later.