An MCP server for Postgres can be read-only and still hurt production.

Exploratory joins, wide aggregates, synchronized schedules, and concurrent retries consume the same connections, CPU, memory, I/O, and replica capacity as the application.

Read-only describes mutation authority.

It does not describe workload safety.

Treat AI database traffic as a separate workload class: